Unpatched Linux Lives 3 Months on Internet 56
Allnighterking writes "The Honeypot project Honeynet.org has released their study on the expected lifetime of an unpatched default Linux install. If some of you remember AvanteGarde recently did a study of its own with several versions of Windows products and found that the average lifetime was about four minutes. Internet Week has an article on the study and the PDF with the full details of the study is available on Honeynet.org. Needless to say, from my viewpoint this is a good reason to limit Windows installations in IT that any PHB and/or Smiling Man can understand. Have them put into a spreadsheet and see what this kind of security means to their bottom line."
Distro choice (Score:4, Interesting)
It would be an interesting thing to see how the other dists would fare. I suspect Debian and Gentoo should survive quite a bit longer than those 3 months. After all, a default minimal Debian Woody installation is 34MB, compared to 0.5GB of Red Hat, and this means you simply don't have that many unnecessary services that can fail.
4 Minutes, or never (Score:5, Interesting)
Windows XP SP1 with the for-free ZoneAlarm firewall, however, as well as Windows XP SP2, fared much better. Although both configurations were probed by attackers, neither was compromised during the two weeks.
Also:
The Macintosh machine, on the other hand, was assaulted as often as the Windows XP SP1 box, but never was grabbed by a hacker, thanks to the tunnel vision that attackers have for Windows. "The automated bot/worm attackers were exclusively using Windows-based attacks," said Colombano, so Mac and Linux machines are safe. For now. "[But] it would have been very vulnerable had code been written to compromise its system," he added
And finally and most importantly:
"No machine is immune," he counseled. "No human is safe from every virus, and it's the same for machines. That's why people have to have some personal responsibility about security. You have to be a good citizen on the network, so you're not only protecting yourself, but others who might be attacked from exploits originating on your machine."
This is senseless (Score:5, Interesting)
The Linux box wasn't compromised because it was being attacked as if it were a Windows box.
Therefore, in this case, the article is suggesting that Linux is secure because it is *obscure*. Linux can't be hacked because nobody would want to/nobody knows how to because it's so rare in comparison to Windows = Security through Obscurity.
Microsoft also uses this practice by threatening to sue anyone who exposes a vulnerability in their OS, and by hiding their source code. Hiding source code and vulnerabilities = Security through Obscurity.
I find it morally offensive that Linux hacks are trying to pass of Linux as secure on exactly the same grounds that Microsoft uses to try and keep their own leaky OS as private and secure as they can. Thankfully the author is sensible enough to write a few disclaimers, but as usual, the Slashdot submitter decided to omit that for the sake of sensationalism (and for a quick boot into Microsoft because we all like that).
I bet I could put an unpatched Windows 3.11 box on the internet, too. I bet no-one would hack that. I'd suggest more people are out trying to exploit even Linux or Mac than old Win3.11/DOS. Or how about an OS/2 box? I bet that would last even longer than Linux. Perhaps we should all switch to OS/2?
Re:Question about Red Hat (Score:3, Interesting)
if your cable modem has a firewall, turn that on also.
the less public you make your home box, the less up-to-date it has to be, in terms of security patches.
I still prefer to keep my internal boxes up to date. and it all boils down to how much you trust your vendor and the patch/pkg process (and the reviewers of all the code and patches).
after spending about 5 yrs in the linux world of things, chasing this and that distro, fixing pkgs mostly by hand, tracking things mostly myself - it got old, real fast. then I saw the wonder of the bsd's (freebsd, since I'm still all x86 based). ONE disto. ONE pkg system. ALL eyes are spent on bsd code (ie, all the ones who care about freebsd, review THE freebsd.) that kind of singularity seemed like the best model - especially if you are worried about security.
compare to the linux world where pkg owners update things on their own and vendors are a level between them and you (the user). in bsd, that middle layer (the vendor) is kind of a pass-thru. and when a check-in breaks, its quickly noticed and cvs'd out or fixed in very short order. again, the 'one set of eyes' principle here.
you can fix and secure almost any o/s. but for my money, I daily do a cvsup on my bsd systems, rebuild kernel and world and then updates
quite a diff model than linux. worth looking into.