Yet Another Crack-This-Box Challenge 137
Sand_Man wrote to us with the latest public relations stunt
with crack-a-machine trials. This is a month long trial, pitting Linux vs. NT boxes against each other. Details are in the story, but does this whole thing strike everyone else as tired PR stunts now?
Re:Slashdot heart failure? (Score:1)
FBI sting operation (Score:1)
Next it'll be "Win $1,000,000 if you can assassinate [insert public official's name here]", Sponsored by Wal-Mart.
Bad test (Score:2)
I've read numerous comments on various Linux news sites suggesting this is an utterly meaningless test. As a consultant who has done some security work, I must say I do not agree that this test is completely valueless, but it most emphatically is not a test of the relative security of either operating system. This is much more a test of the quality of the firewall product and the completely different web applications running on each server.
Because the most common exploits revolve around poorly written web applications (vulnerable to buffer overruns and so forth), this quite simply is, while not valueless, a totally dishonest test.
You should be using the same web application on both machines, with full source code disclosed. Ideally, you would even be running the same web server with full source code (Apache? Although they really aren't the same code when compiled for the differing OSes).
As I said, I think the test might well be very interesting, but to cast it as a contest between NT and Linux is intellectually dishonest. No meaningful conclusions about OS selection can be made on the basis of this test.
Re:Lunar landing (Score:1)
Something Fishy (Score:4)
[root@kevlar
Starting nmap V. 2.2-BETA4 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
Interesting ports on securent.hackpcweek.com (208.184.64.171):
Port State Protocol Service
21 open tcp ftp
23 open tcp telnet
25 open tcp smtp
70 open tcp gopher
80 open tcp http
119 open tcp nntp
139 open tcp netbios-ssn
420 filtered tcp smpte
443 open tcp https
TCP Sequence Prediction: Class=truly random
Difficulty=9999999 (Good luck!)
No OS matches for host (see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)
[root@kevlar
Starting nmap V. 2.2-BETA4 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
Interesting ports on securelinux.hackpcweek.com (208.184.64.170):
Port State Protocol Service
21 open tcp ftp
23 open tcp telnet
25 open tcp smtp
70 open tcp gopher
80 open tcp http
119 open tcp nntp
139 open tcp netbios-ssn
420 filtered tcp smpte
443 open tcp https
TCP Sequence Prediction: Class=truly random
Difficulty=9999999 (Good luck!)
No OS matches for host (see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)
Nmap run completed -- 1 IP address (1 host up) scanned in 24 seconds
Behind Raptor firewall (Score:2)
They say that if a machine isn't behind a firewall it doesn't have anything worth securing. While this may be true this has nothing to do with testing the security of the machine behind the firewall. The firewall is what you are testing at this point. I've pretty much discarded this whole thing. Anyone can close everything but port 80 and 443. What a joke.
Re:Why We're Doing this (Score:2)
The very quote you cite,
sounds to me like this is going to be result in "with our ultra-scientific testing results, we've determined that MS Windows NT is without a doubt more stable, reliable, user-friendly, and lower in total cost of ownership than Linux." I've seen it too many times before.
Also, when they mention several sites that have been recently hacked, such as ABCnews and the Drudge Report, they say that some were running NT and some were running linux, but Netcraft results indicate that they were all running some flavor of NT and IIS. Already the facts aren't completely straight.
Finally, it all comes down to how the boxes are administered. I don't know anything about the additional software they are putting on it for serving classified ads, but it could be wide open to hackers, especially if it runs as root (don't put it past them). Furthermore, Redhat is not the most secure linux distro out of the box. When Redhat makes a corporate sale with service packages, I'm sure they tweak the post-installation for security.
Re:Something Fishy (Score:2)
It's already down... (Score:1)
Yawn (Score:1)
> strike everyone else as tired PR stunts now?
Yes.
Re:More Importantly, do we trust Ziff Davis (Score:1)
Re:Proves Nothing (Score:3)
Yep, and the converse is true too. If Linux is hacked, then MS will say, "See, trust your servers with us." But if NT is hacked, they will say "The admins weren't competent".
It has been said already. Crack challenges prove squat. If one OS or the other gets cracked, it won't prove that either is more secure. It'll just prove that a one point in time, one script kiddie cracked one server. And nothing more.
Also, security depends more on how the server was configured then just the OS used. Mindcraft anyone? When I first saw this I thought, "Sure MS could pay PC Week to 'misconfigure' Linux". But back to the presumption that PC Week is independent and hasn't been paid [cnet.com] by MS, how competant were the admins that configured these servers? Probably the MS admin was MCSE certified. Perhaps the Linux admin has taken the Red Hat certification, at minimun?
-Brent--
Re:Linux box??? (Score:1)
Interesting ports on securelinux.hackpcweek.com (208.184.64.170):
Port State Protocol Service
21 open tcp ftp
23 open tcp telnet
25 open tcp smtp
70 open tcp gopher
119 open tcp nntp
139 open tcp netbios-ssn
420 filtered tcp smpte
TCP Sequence Prediction: Class=truly random
Difficulty=9999999 (Good luck!)
Remote operating system guess: AXCENT Raptor Firewall running on Windows NT 4.0/SP3
Nmap run completed -- 1 IP address (1 host up) scanned in 37 seconds
I wonder (Score:1)
But seriously, i think that these don't really help anybody very well. I'm mean what can they really tell us?
-- Moondog
new contest!!!! (Score:1)
Logs! (Score:1)
WWF Testing. (Score:1)
The URL. (Score:2)
Of course, that doesn't help if it's PC Week that /.'ed :-)
Good Luck!
-Brent--
Hi (Score:2)
Errors in the Article! (Score:5)
And AP is still reporting Mindcraft surveys, so... (Score:2)
So, seriously, what's the point? PC Week is not unbiased, as any longtime reader knows, and it's pretty obvious that they'll just feature whatever positive spin they can make as to "why IIS and NT is a better choice for your average user who uses ASP" or some such comment.
I've got work to do.
This stinks of MS (Score:1)
Re:It's already down... (Score:1)
MS' Ploy to find the hole in NT (Score:2)
Re:Why We're Doing this (Score:1)
*pop* Thanks for bringing me back to reality. I was really trying hard to be positive. But I know deep down inside that you are (probably) right.
And I thought Linux was strong in all those areas. But you are right. The test results don't depend on how the OS's themselves hold up, but more on the biases of the testor's.
Well, PC Week has said there will be a series of tests, so I guess the best thing to do would be to watch the tests carefully, and be sure to point out all the problems, the best we can.
-Brent--
It's not our job to crack systems (Score:1)
This is probably where you'll see the difference between programmers who love what they do (Open-Source) and programmers who live by a punch-clock (Microsoft).
May the better OS win!
sigh- (Score:1)
Maybe this sort of thing should best be done on isolated networks, monitored by judges, like a sport.
Or maybe I'm just depressed because it's Monday.
"The number of suckers born each minute doubles every 18 months."
before it went down the log said... (Score:1)
I must say I like the test so far:
1) they're doing it over a month so they should be able to modify the test as it goes on.
2) they allow everyone to see the process of what's going on.
3) I have no knowledge of system security whatsoever. PR stunt aside, I think that this test will be very informative for myself, and others like me who are looking to learn about how this type of thing goes down. Not everything is contained in man and info pages.
As to #2: Therefore, if something bad happens to one of the servers, it'll get put up on
Sick of "crack this box" contests. (Score:5)
That's real, honest-to-God, cutthroat competition.
- A.P.
--
"One World, one Web, one Program" - Microsoft promotional ad
Slashdotted already??? (Score:1)
It's not tired (Score:1)
Dan
Worthless test (Score:1)
Somehow, though, I suspect people will put a lot more energy into cracking NT than cracking Linux. So Microsoft won't be using this "benchmark" as FUD. Good, cause that would have been annoying.
"There is no surer way to ruin a good discussion than to contaminate it with the facts."
is this even realistic? (Score:3)
if I had some exploit that was useful against these machines, and I knew that the only purpose of these machines even being there was to find out how they can be compromised, I would never, ever use my attack on them. besides, whats the prize? several hundred bucks worth of gift certificates? and instant notoriety? thanks, but no thanks.
Why help M$ ? (Score:1)
If everyone is tired of reading about them... (Score:1)
Yeah, they are tired PR vehicles. And there was a great essay from an earlier "crack this machine" Slashdot thread talking about why such stunts could actually harm a company's reputation (maybe someone can find it?)
Jay (=
is this even realistic? (Score:1)
if I had some exploit that was useful against these machines, and I knew that the only purpose of these machines even being there was to find out how they can be compromised, I would never, ever use my attack on them. besides, whats the prize? several hundred bucks worth of gift certificates? and instant notoriety? thanks, but no thanks.
Re:Maybe this COULD work (Score:1)
Nope, static electricity (Score:1)
After all, noone needs a UPS, do they?
Down already! (Score:1)
The main site www.hackpcweek.com isn't responding.
Something new (Score:1)
about Redhat:
We used the latest distribution from Redhat, along with Apache. Much thanks
to the open source community for help in securing the server.
okay..sounds cool. I'm curious as to WHO helped out.
about Microsoft:
Microsoft pitched in by modifying their guestbook application to a classified ad
application. They also helped with the myriad configurations of Nt,
IIS,SQLServer, and MTS.
Look who decided to get thier hands into things. Not only did they "help" by rewriting the guestbook app, but they also did mods to NT,IIS,SQL server and Transaction Server.
-- Like many have said earlier, It's not going to look good for linux. I could be wrong, but I was only wrong once and that was becasue I *THOUGHT* i was wrong
I mentioned before the use of the firewall throws out all the real world usage issues for me. This is a test of raptor if anything.
On a funny note, notice that they were able to get MS to help with the detailed tweeking. I wonder If I could get them to do that for OUR IIS server? heheheh
Re:MS' Ploy to find the hole in NT (Score:1)
Interesting.... (Score:1)
Also - the Netcraft results for securelinux.hackpcweek.com are:
securelinux.hackpcweek.com is running Apache/1.3.6 (Unix) (Red Hat/Linux) on NT3 or Windows 95
Anybody see anything wrong?
That's my 1/50 of $1.00 US
JM
NT server won't let you post (Score:1)
Could this could be a loop hole for MS to say NT wasn't properly configured?
Could it be a problem with the firewall?
Could PC Week be trying to screw us?
Could I just be paranoid?
Dr_Funk
Linux vs NT (Score:1)
"We don't care which operating system (if any) is broken into first. We want to establish the basis for a story on the best practices for implementing security. Additionally, PC Week wants to open up our test labs to the community for these kinds of tests."
The problem with that statement is the "test" will end when the first box is broken into. If they wanted to do an article on the "best practices for implimenting security, wouldn't they fix the security leak and keep the test up?
It isn't stated whether the systems have been hardened or are just standard installs, but it'd be bunk if the NT system had all the latest service packs and the Linux box was a straight install of RedHat 6.0 with everything enabled and wide open.
It's Already Down :) (Score:1)
Tired PR Stunt (Score:1)
There's no way you can actually prove anything simply by saying "Yeah, well, I had my NT box online, asked people to crack it, and no one managed to. Yet, BillyJoeBob's Linux box got cracked! So ha!"
First off, you have to monitor how many break in attempts there are. There could easily be double on the NT box because more anti-NT people heard about it than anti-Linux people.
Second, you have no idea if the people trying to crack into the boxes are of equal skill level.
Third, Linux is *way* too customizable. Sure, you could claim to install it with default settings and such, but that's not really proving anything, since that would just make the distribution's default settings at fault if somone cracks in, not Linux.
I have a feeling that we'll be seeing more of these as time goes on.
Julian
--
Re:Errors in the Article! (Score:1)
>Nasdaq/Amex, the Drudge Report and ABC sites
>were all hacked in someway. Each of these
>three web sites runs either Windows NT with
>IIS or Linux as their front-line web servers. "
Hey that's not incorrect! Each of the three web sites does run either NT / IIS or Linux. Hell, each of the three web sites runs either NT / IIS or a webserver written in Basic on the Commodore 64 in my bathroom.
Re:WWF Testing. (Score:1)
Celebrity grudge match (Score:1)
Re:PR or Good Intentions? (Score:1)
Strategy (Score:1)
Re:Ugh. (Score:1)
Re: (Score:1)
here is the addy (Score:1)
Linux box??? (Score:1)
[sarc] The Ultimate "Hack This Machine" Challenge (Score:5)
Free housing for 10-30 years!
Free "food" for 10-30 years!
Free sex for 10-30 years!
Free training in a useful trade!
Who can resist!
More Importantly, do we trust Ziff Davis (Score:1)
For the truely paranoid... (Score:1)
Why We're Doing this (Score:2)
Check out their Why We're Doing this [hackpcweek.com] page.
It's nice to see tests from high visiblity labs focusing more important things then whether a "car" can do 350 miles an hour, or 195 miles an hours, when the speed limit only lets the "car" go 85 mph.Sure, the PHB's might be awed by a server the can pump out static data 4 times faster then the bandwidth of a T1, but there are more important details to look at.
When I look at buying a new car, I do more then just check how high the speedometer goes. Handling, braking, comfort, a great stereo system. Top speed in a car, unless you a racing, is largely insignificant when deciding on a car. A company that relies on the top speed of a car to selling it, will find that they have a niche market.
Microsoft relies on "optimising" it's servers to be fast on high end hardware. This is impressive to PHB's, but lacks the real important details needed in servers in production. It won't be long until the PHB's learn that speed isn't the most important thing in a server and they'll have knowledgable admins put servers in production that have real "features".
Or maybe I'm just giving PHB's too much credit. Maybe they'll never learn. But it sounds like PC Week, at least has gotten the idea. Good for them
-Brent--
Real Contests/Tests (Score:4)
Honestly, security is a nice issue and all, but there are so many other areas that both operating systems need improvement in. Security is such a function of administration that these contests show very little of the capabilities of the operating system. Try combining them with other aspects, like setup, administration, use, and scalability, and then your contest will really say something about the operating system.
Re:Errors in the Article! (Score:2)
It seems like everybody's first stop is a DNS for host lists. I found that "above.net" is hosting DNS services:
[ns.above.net]
hackpcweek.com. SOA ns.above.net dns.above.net. (1999091900 10800 3600 604800 86400)
hackpcweek.com. NS ns.above.net
hackpcweek.com. NS ns3.above.net
hackpcweek.com. A 208.184.64.168
securent A 208.184.64.171
securelinux A 208.184.64.170
forums A 208.184.64.169
www CNAME hackpcweek.com
hackpcweek.com. SOA ns.above.net dns.above.net. (1999091900 10800 3600 604800 86400)
And that "above.net" is hosting the machines on their network.
I have a web-page that polls web-server types every three days and I watched M$'s site go from IIS 4.0 to IIS5.0 and back to 4.0 in rouchly a weeks time. Hmm...wonder what happened there?
Re:what i want to see... (Score:1)
Re: (Score:1)
Re:This stinks of MS (Score:1)
Same box? WTF? (Score:1)
What an effing waste of time. I think only thing this "challenge" will prove is that nobody bothered.
Re:Errors in the Article! (Score:1)
which OS had more open standards.
Is there _really_ a question in anyones mind?
Lunar landing (Score:1)
Cute
That information is posted on the front page (Score:1)
Crack-this-firewall contest.. (Score:2)
If it is, in fact, the firewall at fault here, what is the point of having such an event, is the whole contest not pointless here? Wouldn't one have to be able to bypass this firewall first, making it a crack this firewall, and THEN crack this box contest? How do these results verify one OS more secure than the other. More importantly, how do ANY of these tests check up on OS security, since buffer overflows occur across almost all os's, and in fact its usually daemons that are exploited.
-mike
Errors in the WEBSITE! (Score:3)
The "Site Diary" link at the top of the page is broken.
The "We'll be updating..." (/schedule) link on the front page is also broken.
The "Home Office-Online" link in the sidebar under "Equipment Used" gives you the write-up for the H/P server.
The "IIS on NT vs. Apache on Linux..." (/backgrounder.html) link has bogus characters in it (a target for the "Demoroniser" Perl script).
This is supposed to make us believe the server admins know what they are doing? Please. Why not just have some high school students setup the site? I have a feeling that would be about as valid.
Re:Lunar landing (Score:1)
Score: 0, not funny, off-topic, blasphemous
Andy
See which of our admins we should fire! NT (Score:1)
---
It's all pointless... (Score:1)
But just because a system hasn't been cracked, doesn't guarantee it is secure.
In fact, if I were a malicious cracker, and found a hole in the security of either of these systems, I wouldn't tell a soul how I did it. I'd keep the knowledge to myself, and wait for some juicy targets running (insert least favorite OS here). Say, the next potential amazon.com.
How are those servers administered ? (Score:2)
nt vs. linux (Score:1)
mainly it is pr , and free pr is good some times as long as us the ppl in the community have a say and can set the records strait now and then and not let linux promise something it cant deliver (at the moment) . but this kinda tries when done right can get the message out that yes linux is a great os and an oss . to dispell myths that certian oses are the only way to go . mainly there is going to have to be some ethical discustions set down
the fact that we can read the logs is pritty cool if it isnt always / and
free speach as long as you dont lie is the way to go. lets back up our arguments
PC Week servers crawling (Score:1)
Wonder if it's because /. effect, DoS attacks or both.
Re:Slashdot heart failure? (Score:1)
Personally I didn't like the article at all... or the comments.
Umm.. What's with this? (Score:1)
Shows.
www.hackpcweek.com is running Microsoft-IIS/4.0 on NT3 or Windows 95
NT3 or Windows 95????
Re:windows2000test (Score:2)
Good grief! We've got real issues to work with other then spending the next three months playing with Microsoft's beta OS.
When Microsoft announced the challenge we did our duty and "checked out" the server. And guess what? It failed miserably. Having proved that we went back to playing with our toys.
Perhaps if MS wants any more testing they can go out and pay a real security company to test their OS. We're just tired of knocking their poor server down, enough is enough.
Its ran for a month without reboot? If so, good for them. Goes to show that MS can develop a server that runs great - when no one uses it.
-Brent--
Enough, already (Score:1)
Re:how does this work? (Score:1)
securent.hackpcweek.com
and
securelinux.hackpcweek.com
I predict NT gets hit more because it has less to type for the lazy script kiddies out there.
PC Week Lab director is a liar! (Score:1)
http://linuxtoday.com/talkback/38904.html
In the discussion, I challenged him to defend his position about why he implied that Linux had been cracked. He responded by saying that Matt Drudge's main page (www.drudge.com) runs Linux. Of course, the page that was cracked was www.drudgereport.com which runs IIS on NT.
In short, John Taschek is a liar who has no credibility WRT Linux, and the purpose of this test, it is clear, is to either damage Linux's reputation or try to repair NT's.
Of course, I think we all knew that already!
Aaron
Interesting (Score:1)
NT host misconfig'd! (Score:1)
By my estimates, this means you have to access by 5:00am to test this route for hacking in. The Linux server was correctly configured to allow more posting access and to time-out ads based on user-selected options.
D. Keith Higgs
CWRU. Kelvin Smith Library
what i want to see... (Score:1)
Who cares? (Score:1)
So why bother with them?
Re:Linux box??? (Score:2)
>$ telnet securelinux.hackpcweek.com
>Trying 208.184.64.170...
>Connected to securelinux.hackpcweek.com.
>Escape character is '^]'.
>HTTP/1.1 200 OK
>Date: Mon, 20 Sep 1999 18:39:01 GMT
>Server: Apache/1.3.6 (Unix) (Red Hat/Linux)
But even stranger... queso reports it as neither!
>$ queso securelinux.hackpcweek.com
>208.184.64.170:80 * HP/JETdirect Printer (old model)
So this begs the question... are they running behind some kind of firewall/load balancing proxy?