Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Software Linux

Unpatched Linux Lives 3 Months on Internet 56

Posted by CowboyNeal from the dies-after-reading-livejournal dept.
Allnighterking writes "The Honeypot project Honeynet.org has released their study on the expected lifetime of an unpatched default Linux install. If some of you remember AvanteGarde recently did a study of its own with several versions of Windows products and found that the average lifetime was about four minutes. Internet Week has an article on the study and the PDF with the full details of the study is available on Honeynet.org. Needless to say, from my viewpoint this is a good reason to limit Windows installations in IT that any PHB and/or Smiling Man can understand. Have them put into a spreadsheet and see what this kind of security means to their bottom line."
This discussion has been archived. No new comments can be posted.

Unpatched Linux Lives 3 Months on Internet More

Unpatched Linux Lives 3 Months on Internet

Comments Filter:

  • It depends (Score:3, Insightful)

    by PrivateDonut ( 802017 ) <chris5377@mai[ ]n.com ['lca' in gap]> on Friday December 24, 2004 @02:43AM (#11175178)
    That value would depend on the distro and its age.

  • Distro choice (Score:4, Interesting)

    by KiloByte ( 825081 ) on Friday December 24, 2004 @03:12AM (#11175244)
    Note that the distros they used were basically just Red Hat variants (RH7.2, 5*RH7.3, RH8.0, 8*RH9, 2*FC1) and Suse (6.3 and 7.2). Suse is very similar to Red Hat, and Red Hat is what my friends call "Microsoft Linux" as it doesn't exactly excel in security.

    It would be an interesting thing to see how the other dists would fare. I suspect Debian and Gentoo should survive quite a bit longer than those 3 months. After all, a default minimal Debian Woody installation is 34MB, compared to 0.5GB of Red Hat, and this means you simply don't have that many unnecessary services that can fail.

    • Re:Distro choice (Score:4, Informative)

      by dasunt ( 249686 ) on Friday December 24, 2004 @03:19AM (#11175260)

      It would be an interesting thing to see how the other dists would fare. I suspect Debian and Gentoo should survive quite a bit longer than those 3 months. After all, a default minimal Debian Woody installation is 34MB, compared to 0.5GB of Red Hat, and this means you simply don't have that many unnecessary services that can fail.

      Due to age, I am guessing that a Debian woody installation would fall rather quickly -- its just too old. Sure, the minimal install is tiny, with almost nothing to hijack, but a typical default server install has far too many things listening on every interface.

      I'm curious how long an older (3.4 or 3.3) version of OpenBSD would have faired with a typical (not default) setup.

      (My server right now is running Debian Woody, and has been since Potato was stable.)

      • I'd expect Woody to survive a very long time, as it's just too old.

        You see, the packages in Woody are kept up-to-date in the security department. The age of the packages is irrelevant to the security of the packages. All security fixes are backported to the Debian stable distribution.

        • Re:Distro choice (Score:3, Informative)

          by dasunt ( 249686 )

          You see, the packages in Woody are kept up-to-date in the security department. The age of the packages is irrelevant to the security of the packages. All security fixes are backported to the Debian stable distribution.

          I was referring to the test -- which did not involve any security updates.

          In such a situation, an unpatched debian woody distro may fall rather quickly.

          • I think you would be correct in the case where one installed Debian Woody using some dusty old CDs. However, the normal way of installing Debiean is to install over the internet from the Debian servers, which are by definition up to date with security patches.
    • Red Hat may not be the underdog in the Linux world - and ppl love the underdog and hate the top dog. But I wouldn't call it insecure because some people call it "Microsoft Linux".

      Why? I have never ever had any security problems. With or without iptables on. I have never used SELinux, I hear the security is beefed up.

      I have never encountered a "failed service" on RH or FC. OK VMware sometimes comes close ;-) But security being affected doesn't enter the equation.

      I would think an FC3 box with iptables, SEL
    • Although exploits of facilities implemented in standard linux kernels, such as arp requests or ICMP echo requests, are possible, they are far rarer than exploits of higher-level network services, such as HTTP or SSH. Consequently, a basic install of a distribution such as Gentoo, in which only those basic network services implemented in the kernel are active, would likely remain unexploited for years. Of course, this only shows that in the case of Linux, the `base install' does not provide for a very good

  • 4 Minutes, or never (Score:5, Interesting)

    by MadMirko ( 231667 ) on Friday December 24, 2004 @03:12AM (#11175245)
    From TFA:

    Windows XP SP1 with the for-free ZoneAlarm firewall, however, as well as Windows XP SP2, fared much better. Although both configurations were probed by attackers, neither was compromised during the two weeks.

    Also:

    The Macintosh machine, on the other hand, was assaulted as often as the Windows XP SP1 box, but never was grabbed by a hacker, thanks to the tunnel vision that attackers have for Windows. "The automated bot/worm attackers were exclusively using Windows-based attacks," said Colombano, so Mac and Linux machines are safe. For now. "[But] it would have been very vulnerable had code been written to compromise its system," he added

    And finally and most importantly:

    "No machine is immune," he counseled. "No human is safe from every virus, and it's the same for machines. That's why people have to have some personal responsibility about security. You have to be a good citizen on the network, so you're not only protecting yourself, but others who might be attacked from exploits originating on your machine."

    • The assholes that release viruses, worms and other malware on the computing world are also well aware that the average Linux user is much more difficult to hoodwink than the average Windows user (your grandma, for example).

      The past ~10 years of the popular web has exposed the best (altruism, open source efforts, education, anti-bullshit) and the worst (scammers, spammers, hate groups, SCO) of global society.

      Have a great 2005 everyone.

    • The Macintosh machine, on the other hand, was assaulted as often as the Windows XP SP1 box, but never was grabbed by a hacker, thanks to the tunnel vision that attackers have for Windows. "The automated bot/worm attackers were exclusively using Windows-based attacks," said Colombano, so Mac and Linux machines are safe. For now. "[But] it would have been very vulnerable had code been written to compromise its system," he added

      Prove it. (I'm talking more to the guy in the article than you, btw.)

      That is

  • Because Administrators can't patch their own shit? What makes you think they would patch Linux if they were to switch?
    • For example, if you're running Debian stable, most security updates require two commands: 'apt-get update && apt-get dist-upgrade'. Because it's 'stable', Debian guarantees that the security fixes will not change the functionality of the program.

      I don't know if Microsoft guarantees that its fixes won't screw things up (or even work), but there track history would make me hesitant before deploying 'fixes'.
      • Well, my whole point is that in order to have an unsecured system attached to the 'Net, you need an Admin who either doesn't know or doesn't care. In which case, no system would be a good idea. The article attempts to place blame on Microsoft for people's laziness and ineptness, which is just more of the anti-Microsoft zealot-ism drivel I've come to hate from Slashdot as of late.
  • I assure you that i can run a box with any OS without any sort of internet attacks longer than you can.*

    *it will not be connected to any outside network at all. your box will be. (Microsoft pulled this to give a high security rating to NT, i believe)

    • Re:Best security (Score:4, Informative)

      by Isao ( 153092 ) on Friday December 24, 2004 @07:48AM (#11175871)
      it will not be connected to any outside network at all. your box will be. (Microsoft pulled this to give a high security rating to NT, i believe)

      Not exactly. I don't want to be an MS apologist, but the TCSEC rating that MS got for Windows NT was indeed while it was not connected to a network. We all agree that is rather useless these days. The problem was the TCSEC (Orange Book) certification; it specifically does not cover networked systems. Networks are covered by the Red Book. This problem is one of the reasons the Common Criteria was created, which can certify systems including networks.

  • SuSE 6.2 (release date: August 1999)

  • Actually no, (Score:2, Insightful)

    by SimianOverlord ( 727643 )
    Linux versus windows in the workplace will not be decided by showing them a spreadsheet of fiddled figures. This test is hardly a good way to test security, its an interesting sideshow, no more.

    The message isn't Linux > Windows, it's that not keeping up to date with your patches is dangerous, and Linux is less of a target than Windows at the moment. By the submitters criterion, you would be recommending Apple to your PHB, not Linux, as an unpatched box wasn't even hit with any OS specific exploits!

    An

    • Re:Actually no, (Score:3, Insightful)

      by node 3 ( 115640 )
      What the hell are you talking about? This article is like *any* article in that it applies only in the areas it applies.

      The relevant data here is that if you are going to set up an internet server, a computer that will connect directly to the internet, or a computer in an untrusted environment in general, that Linux and Mac OS X are statistically least vulnerable to remote exploits (with some caveats related to the configuations tested).

      It's just another (and a very important, but not necessarily the *mos

  • This is senseless (Score:5, Interesting)

    by obeythefist ( 719316 ) on Friday December 24, 2004 @06:38AM (#11175708) Journal
    I'll get modded flamebait for this, but...

    The Linux box wasn't compromised because it was being attacked as if it were a Windows box.

    Therefore, in this case, the article is suggesting that Linux is secure because it is *obscure*. Linux can't be hacked because nobody would want to/nobody knows how to because it's so rare in comparison to Windows = Security through Obscurity.

    Microsoft also uses this practice by threatening to sue anyone who exposes a vulnerability in their OS, and by hiding their source code. Hiding source code and vulnerabilities = Security through Obscurity.

    I find it morally offensive that Linux hacks are trying to pass of Linux as secure on exactly the same grounds that Microsoft uses to try and keep their own leaky OS as private and secure as they can. Thankfully the author is sensible enough to write a few disclaimers, but as usual, the Slashdot submitter decided to omit that for the sake of sensationalism (and for a quick boot into Microsoft because we all like that).

    I bet I could put an unpatched Windows 3.11 box on the internet, too. I bet no-one would hack that. I'd suggest more people are out trying to exploit even Linux or Mac than old Win3.11/DOS. Or how about an OS/2 box? I bet that would last even longer than Linux. Perhaps we should all switch to OS/2?

    • Re:This is senseless (Score:5, Insightful)

      by Curtman ( 556920 ) on Friday December 24, 2004 @07:16AM (#11175805)
      Meanwhile my poor Linux/Apache has had 293 requests of:

      • "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\ xb1\x02"... etc

      in the last 72 hours.. Where are all these IIS servers that are being targeted? Apache outnumbers them 2 to 1. Wouldn't it make more sense to target Apache?

      • Where are all these IIS servers that are being targeted? Apache outnumbers them 2 to 1. Wouldn't it make more sense to target Apache?

        Because publicizing a fault in an open source software product like Apache -- by publishing an exploit in the form of a pushbutton script kiddie tool, for example -- results in the fault getting fixed. Meanwhile, even if Microsoft does patch a known fault in IIS, a lot of home users/amateur server admins either won't know about the patch, or do know about it but don't bothe

    • Therefore, in this case, the article is suggesting that Linux is secure because it is *obscure*.

      From a pragmatic point of view, why should I care what the reason is?

      • Because that path leads to the dark side. Once you start down that path, forever will it control your destiny.

        But seriously, that's like not filling out your TPS reports. Pragmatically it doesn't seem like fun but you need to take quality assurance and correct procedures and practices into account, or it will bite you hard down the track.

        Namely, don't *hide* your vulnerabilities, *fix* your vulnerabilities. That's why I started this whole rant. Linux shouldn't be secure because people don't know anyth
    • UH

      I RTFA, and I agree that it wasn't the greatest piece comparison in the world.

      I read you post, and I'm sick from the faux pas that you're using. EW, GROSS. Seriously, you're comparing a USELESS OS (windows 3.11) with the most useful OS (linux, I know that some things such as video editing are lacking, but all around, it is the most practical). And you're expecting me to draw a security comparison? Please. I would consider comparing OSX (quite a useful piece of OS) and maybe windows XP or 2003 (modern

      • This may be a surprise, but I was not actually serious about Windows 3.11 or using OS/2. I'm sorry you didn't pick up on my little joke there.

        What disturbed me about the article is that the same points he was applying to Linux regarding security also applied to Win3.11 and OS/2. It's obscure, therefore it's secure. This is foolish and dangerous thinking. It's exactly the same kind of justifications Microsoft uses for selling their OS.

        Linux is more secure simply because the open source nature of the so

        • Ahh now you make much more sense, and i see your gripe with the article (i will add it to my long list of gripes with the article).

          A more useful test would be to observe how quickly the box would be compromised if the assailants were specifically targetting the box and knew exactly which OS it was running, what patch level, and had the correct tools available to use it.

          Interestingly, what [macdiscussion.com] you [ftponline.com] suggest [attrition.org] has already been tried and [slashdot.org] dismissed [slashdot.org] by the infallible moderators of slashdot. Case dismissed. NEXT! :)

    • Among others, I run an OS/2 machine, protected by the built-in but undocumented AIX firewall. Nothing out there could even hope to compromise it. That doesn't mean it's impossible, of course, but I trust it more than Linux, from which I'm writing now. That machine, on eCS 1.1, (Warp 4+) handles my entire network. She has never crashed, and her best up-time, eight-plus months, was curtailed only for a hardware upgrade. If you want something reliable and rock-solid, go with OS/2. If you want to play game
  • but it seems that no other free unix was used in the test? I would have loved to see how freebsd (or any bsd) would compare.

    I left linux for bsd since I consider it more secure. linux is great, but it is a popular attack for kiddies. so far [knock disk] bsd has been spared such, uhm, 'popularity'.

    I would bet a similarly configured bsd box would last longer than any of them.

  • Why unpatched? (Score:3, Insightful)

    by Anonymous Coward on Friday December 24, 2004 @07:29AM (#11175832)
    Why do they use unpatched boxes in these types of tests? It just doesn't make a good security test, IMO. Why don't they setup a Linux box and a Windows box, and patch them both. Set up automatic updates in Windows, and a cron job on Linux to download updates nightly. Maybe install a few server processes just for fun (mail, web, ftp, and file shares / samba services for instance). Open the ports for those services, and block everything else with the vendor's firewall. I bet both boxes would stay un-hacked for years.
    • I completly agree. This article is effecivly saying the same thing as "A 1992 Ford Explorer without the recalls fixed will explode faster than a 1992 Chevy Blazer, without it's recalls fixed.

      This just isn't logical and it pains me to see that people get paid to waste thier time on somehting this moronic, or, that I am not one of the people getting paid to waste my time. It's one of those, I'm sure.

      -S

  • Unpatched Linux Lives 3 Months on Internet (Score:3, Funny)

    by SpaceLifeForm ( 228190 ) on Friday December 24, 2004 @08:23AM (#11175964)
    Imagine the nutritional value of Internet2 !

  • I've seen this (Score:4, Informative)

    by anthony_dipierro ( 543308 ) on Friday December 24, 2004 @09:09AM (#11176119) Journal

    Last time I moved I set up my laptop running Win2K on my new DSL connection without a firewall. It was just for 5-10 minutes or so, to set up the connection. Within those few minutes, I managed to pick up a worm. This was even with most of the latest patches already installed.

    Firewalls/NAT greatly cuts down on your risk. Running firefox pretty much gets rid of the rest. But if you put Windows on the internet without a firewall and you're not a security expert who has done a thorough audit of your machine, you're asking for trouble.

  • This is nice, but the implication that this is evidence that a default install of linux fares better than a default install of Windows is silly. While I'm sure that is the case, this isn't supporting evidence. I hate to continue the broken record of the if-linux-were-as-popular-as-windows-there-would-be -more-$attack-out-there mantra we're all sick of hearing, but in this case it directly applies.

Slashdot Top Deals

Real programmers don't bring brown-bag lunches. If the vending machine doesn't sell it, they don't eat it. Vending machines don't sell quiche.

Close