WinInformant Says Windows More Secure Than Linux

nihilist_1137 excerpts from this WinInformant article, which reads in part: "For at least the first 8 months of 2001, open-source poster child Linux was far less secure than Windows, according to the reputable NTBugTraq, which is hosted by SecurityFocus, the leading provider of security information about the Internet. ... A look at the previous 5 years--for which the data is more complete--also shows that each year, Win2K and Windows NT had far fewer security vulnerabilities than Linux, despite the fact that Windows is deployed on a far wider basis than any version of Linux." I wonder how many sysadmins (Windows or Linux) would agree with this conclusion. Update: 02/04 16:54 GMT by T : Looks like the WinInfo site has gone down since the story was submitted, so you may have to content yourself in the meantime with the Bugtraq numbers. Update: 02/04 19:30 GMT by T :Several readers have pointed out that the conclusions WinInformant makes based on the Bugtraq data are not those of SecurityFocus; the headline has been changed accordingly.

Re:This, of course, will be ignored and ridiculed

So true =).

Open source haven't proven more secure than closed, as the theory about "given enough eyes all bugs are shallow" says.

The one thing it gives though, is choice. For instance, i dont run rsync(se recent security exploit) and i'll probably never do. Neither will mdk/rh pr. default (Allthough a lot is certainly run by default). Even though rsync comes with mdk/rh.

Frej Rasmussen.

Re:This, of course, will be ignored and ridiculed

Not only that.
This kind of study don't see what is Linux, and what is agregated software. They say Linux and Windows, but I'm sure they don't include IIS.
In any case, impact and severity must also be taken into account. Most Windows bugs are remotely exploitable, and give full control of the machine. Most linux bugs are only localy exploitable, or only leak information.
It's very easy to say that car acidents happen more often then plain crashes. Anyone cares to count the casualities ? Well, I'm not sure this is a good example, once car acidents casuality numbers are, AFAIK, higher, but I think you get what I mean.

The security of any OS lies...

The security of any OS lies in the skill of its admin. An idiot with a 2k box is no more secure than an idiot with a linux box and vice versa.

Re:This, of course, will be ignored and ridiculed

Sigh...

I can't read the original article, It's been Slashdotted to death. But I think I can make a pretty good guess as to what happened.

First off, we host Bugtraq, not NTBugtraq, which is Russ Cooper's list. (Any chance we can get that fixed in the story intro? Anyone know if the same mistake is in the original article?)

Secondly, I'm constantly amazed at how people mis-read our stats page. The Linux aggregate stats are the total of all unique bugs across all the various distributions we track. It's supposed to answer the question "How many Linux-related bugs were there that year." It's based on things like which distro ships a particular package, and when that package is found to have a hole, it also gets attached to the distro. This is so you can look up your distro, and see what bugs you might need to patch.

Take a look at the top of the page, our script hasn't been running since August, when we switched from Roxen to Apache. So, we're missing the whole last quarter of 2001 stats.

Regardless of anything else, using these number to declare that one thing is more secure than another is a mistake. Based on our numbers, why didn't they declare that everyone should run MacOS for security? Or that if you want to be more secure, run Debian instead of Win2K?

Re:Exactly (it deserves to be rediculed and ignore

The incompetence of the author writing this story, and of the Security Focus editorial staff for letting it through, is staggering. With this kind of security "expertise" is it any wonder at all that Nimda worms and the like run rampent across the net?

We didn't write the article in question, nor are we hosting, nor did we have any opportunity to see it ahead of time. (Or now... still can't see it.) Sadly, we have very little editorial control over other people's websites.

Re:This, of course, will be ignored and ridiculed

Deciding which OS is more secure just by looking at the number of bugs is not the right way to decide things. As usual, there's an easy way, and then there's the right way.

First, lets assume the numbers are honest, and not double counted, as has been done before. (One reporter in the past took the numbers for linux in general, then took the numbers for a distribution, then ADDED them together to get his final number of bugs. Too bad most were double counted.) Not all bugs are the same. First, how severe is it? A bug that allows complete takeover of your system just by connecting to the internet (Universal Plug and Play anyone!) is not the same as an exploit in some little program nobody runs and those who do run it don't run it as root and run it in a chroot environment.

Second, how quickly is the bug patched? If you can't patch the hole for months because the vendor doesn't put out a patch, that's a different level of security than if you can patch the hole the next day. Third, does the patch fix problems or create them (NT SP2 anyone!).

Finally, are we comparing apples to apples. Most linux distributions come with much more software than a Windows CD. Not all of that software gets installed. Are we comparing a linux system with just the equivalent software a Windows CD comes with? That can make a big difference in the bug numbers.

Re:This, of course, will be ignored and ridiculed

Or maybe the Slashdot regulars (not the people who hang out at 0 and -1) will look at the piece calmly and discover other very valid flaws with the study.

You mean, like this? The NTBugTraq site itself says (emphasis mine):

There is a distinct difference in the way that vulnerabilities are counted for Microsoft Windows and other operating systems. For instance, applications for Linux and BSD are often grouped in as subcomponents with the operating systems that they are shipped with. For Windows, applications and subcomponents such as Explorer often have their own packages that are considered vulnerable or not vulnerable outside of Windows and therefore may not be included in the count. This may skew numbers.

So, while there may be a stack of Outlook vulnerabilities, those won't get lumped in with Windows. But sendmail vulnerabilities might get lumped in with RedHat. They go on to say (emphasis theirs):

The numbers presented below should not be considered a metric by which an accurate comparison of the vulnerability of one operating system versus another can be made.

Further, the numbers themselves do not support the conjecture that Windows 2000/NT had fewer reported vulnerabilities reported over the 5-year period. Let's compare RedHat (the Linux distro for which the largest number of vulnerabilities was reported) vs. Windows 2000/NT from their data:

• 1997: RedHat 6, Win2K/NT 10
• 1998: RedHat 10, Win2K/NT 8
• 1999: RedHat 47, Win2K/NT 78
• 2000: RedHat 95, Win2K/NT 97
• 2001: RedHat 54, Win2K/NT 42
• Total RedHat 212, Win2K/NT 235

So even though the numbers are potentially skewed against Linux, the totals still come up less for RedHat than for Win2000/NT.

What the other article must be doing (I haven't read it yet, since I wasn't able load it) is totalling across all distributions, which is wrong. One FTPD vulnerability would get multiplied by all the vendors that ship that FTPD, which isn't quite fair.

--Joe

In Other News

In unrelated news, Microsoft yesterday announced that it had purchased an unnamed but reputable security group...

but which were more severe?

Perhaps windows has had less overall security vulnerabilities, but the ones it has had have completely ruined systems and clogged up the internet (i.e. code red, nimda etc...).

Re:but which were more severe?

If Linux had the marketshare of Windows, you can bet there would be lots and lots of scriptkiddies writing Code-Red style worms. Linux has had some pretty major security flaws in the past. Although they were fixed quickly, that doesn't mean that lazy or incompetent sysadmins will patch it right up. This leads to an opportunity for a Code-Red style worm, and if Linux had high marketshare, you can bet that it would have spread rather quickly as well.

Severity of vulnerabilities

The report doesn't seem to take into account the fact that while the number Windows holes was fewer, they were far more severe. Code Red, anyone?

Btw, I'm not a Linux cheerleader, I'm a Windows guy most of the time, and I subscribe to the "best tool for the job" philosophy.

Not only that, but...

It gets worse than that. Let's consider:

Most bugs that show up for redhat or any other linux distribution will NOT affect a well-secured machine in the first place. If you plan, for example, a standard web or database server, you're only going to permit ssh and apache or ssh and your brand of sql. How many vulnerabilities in the past year have been on those services? Practically none. Only 1 in ssh, and there was AMPLE warning to get patched before exploits were in the wild. The majority of bugs are for packages not often deployed, or not relevent to a server system where there is no user access.

Meanwhile, an enormous number of these linux bugs are irrelevent on a firewalled system, never mind the incompetency of sysadmins. A firewall will protect your X font server or your installed-by-default nfsd/statd, but Microsoft has had many high-profile, extremely-widely-abused holes in a server's primary services (IIS, MS-SQL, etc).

Anyhow, trying to say these statistics show that NT is more secure than Linux is not only irresponsible but absurd.

Its Paul Thurrot. Don't expect logic.

I'm not really surprised by this. Following the recent long Microsoft DNS outage when it was revealed that quite a few of Micrposoft's own DNS servers were running Linux (not to mention they use akamai for their downloads), Paul Thurrot came out with the classic report that although this might be true `its proves Open Source zealots wrong as Linux wasn't being used for anything mission critical'

What the fuck? According to WHAT kind of logic is DNS not mission critical? If it its not critical, let's take those DNS servers offline (both Microsoft's and WinInfo's) and see how long either MS or Thurrot last.

Define "more secure"

Does Windows have fewer security holes than Linux? Apparently so.

Are they smaller holes -- that is, exposing less control of the system and less potential for damage? Probably not.

The question becomes, then: would you rather be shot by a dozen BB pellets or a single shotgun blast?

Re:Define "more secure"

You apparently didn't check out NTBugTraq. They simply added up vulnerabilities from different linux distros to come up with a high aggregate number. This is plain wrong because

1) If a package has a security issue, usually all distros announce the security bug. Thus, the bug gets counted multiple times.

2) Windows security bugs are all remote compromises, either email attachments, or remote roots. Over 90% of the linux security problems are local security issues.

As another poster noted, this is a very poorly researched article.

Worse still

Windows security holes typically have exploits in the field, whereas linux vulnerabilities are commonly realeased from code review- hence having no preexisting exploits (that are known and demonstrated). Some are in fact purely theoretical, and may have to use to a malicious user.

So even if you keep on top of your windows updates religiously, keep in mind that they are generally reactive. So there is always that window of vulnerability...

Re:Define "more secure"

Another note from bugtraq that will really push the numbers in favor of Windows. I quote: "* There is a distinct difference in the way that vulnerabilities are counted for Microsoft Windows and other operating systems. For instance, applications for Linux and BSD are often grouped in as subcomponents with the operating systems that they are shipped with. For Windows, applications and subcomponents such as Explorer often have their own packages that are considered vulnerable or not vulnerable outside of Windows and therefore may not be included in the count. This may skew numbers." MAY?!?!? More likely WILL.

So let's see. IE vulnerabilities aren't counted. There goes the fairness in the numbers right there. Was IIS counted?

Less because MS doesnt tell

Look, the obvious point about this should be that the reason Linux has more known vulnerabilities is that linux has always been very open about what is wrong with linux.

As for MS, I only have to point to the the major bug, that they knew about for weeks, but didn't let anybody know about!

Now Im not saying that linux is more secure (as much as i would like to) but the data and report based from it, just makes no sense, if you think about how vulnerabilties are and are not reported

Thanks for reading!

From a technical standpoint.

Well, that may be all well and good from a purely technical (or counting reported bugs) standpoint.

But when you consider Microsoft's installed user base, there's just no comparison to how widespread MS is.
It's a damn good thing there were less bugs reported for Windows, as with each one, the repercussions are far far greater.

~sigh~

Simply put,

Simply put, the reason Windows systems seem more vulnerable is because SO MANY MORE people use them, and don't keep them patched. As a rule of thumb, someone running Linux at home knows what the term "security vulnerability" means and keeps his system up to date, where someone running Windows whatever doesn't.

Of course, that's not the case in the server market. If you want to talk about worms, remember one thing - the ONLY reason Code Red and other such worms exist is because of the popularity if the windows platform, on desktops and servers. Don't kid yourself for a second into thinking that the reason there aren't any widespread worms for *nix systems is because it's more secure.
br -Berj

Re:Simply put,

Its funny how people back security focus when it talks about MS vulnerabilities, but once it mentions Linux, they are "Uniformed" or a variety of other things

In a word: Bullsh*t.

Securityfocus presented the numbers without bias, without commentary even. It is the MS shills that try to draw conclusions from these numbers, and one by one they take the aggregate Linux number, because it suits their agenda.

However, that aggregate number is worthless to draw conlusions from. At most one could use the distro numbers to draw the conlcusion that the average Linux distro ships with more (potential) vulnerabilities than Windows 2000. Of course, since the average Linux distro

1. ships with more server software than Windows (multiple mail servers for example),
2. has a habit of reporting all vulnerabilities, from local DoS to remote root,

of course it will show more vulnerabilities.

So, the numbers tell us nothing new, except that the MS apologists will grasp at any straw to discredit what little competition they have.

Mart

Re:Simply put,

Actually, there aren't SO MANY MORE windows servers on the internet than *nix boxes.

Please see this fine article http://slashdot.org/article.pl?sid=01/07/13/124025 7&mode=thread [slashdot.org] which tries to compare the number of windows systems vs unix systems on the internet.

Here are a couple of their conclusions:

1. GNU/Linux is the #2 web serving operating system on the public Internet (counting by IP address), according to a study surveying March and June 2001
2. GNU/Linux is the #1 server operating system on the public Internet (counting by domain name), according to a 1999 survey of primarily European and educational sites.
3. GNU/Linux is the #2 server operating system sold in 1999 and 2000, and is the fastest-growing.

Even taking the statistics most favorable to Microsoft, they had almost twice as many IPs on the public internet than Linux did in 1999. However, during that same period, there were many more than twice as many expoits, viruses, etc. that attacked windows vs unix.

Linux has far too many installations on the public internet to be dismissed as too rare to interest hackers.

Re:Simply put,

l10n and ramen were two recent worms that attacked a bug in some versions of BIND on almost all unices. This would appear to be evidence against your theory that "no-one writes worms for *nix because of lack of market share".

Find another excuse.

Simply put youre dead wrong

Of course, that's not the case in the server market. If you want to talk about worms, remember one thing - the ONLY reason Code Red and other such worms exist is because of the popularity if the windows platform, on desktops and servers. Don't kid yourself for a second into thinking that the reason there aren't any widespread worms for *nix systems is because it's more secure.

Dont kid yourself. The various free o/s's are simply a harder target. They are more diverse, both across O/S's and distributions, and even within a distribution there are different configurations. On top of all that any individual box can be a totally custom system built from the source pool.

There are countless email readers, multiple web browsers, all types of competing server daemons. When you take the windows monoculture you simply dont find such diversity. The competing software are simply wiped out.

Its a well known and intuitive fact that monocultures are far more vulnerable to disease and parasites than a healthy diverse population.

Re:Statistics....

Let's keep in mind that Linux users who find bugs or issues are far more likely to report them, document them, publicize them, and share them.

Good point, but it would be better if you took it out of the context of the "users" and put it in the context of the developers. It works out more like this:

Open Source Project X Developer (who may well be on someone's payroll) finds a previously unknown security bug. He patches the bug and informs RedHat and other distro vendors, who then issue a security bulletin. One strike against Linux in the security count.

Meanwhile Microsoft Product Y Developer finds 100 unknown security security bugs in his big Feburary cleanup period. They are all rolled in to service pack 3. Microsoft issues a bulletin recommending all customers upgrade immediately. Zero strikes against Microsoft.

So you are counting ALL security bugs on the Linux side verus only publically reported security bugs on the Windows/Solaris/whoever side.

(Furthermore, it seems nobody considers local root exploits on Windows to be that big of a deal. I remember when RedHat put out multiple advisories for vi, joe, ed, and a bunch of other editors for a temp file vulnerability. [You'd think that "ed" would be rock solid by now...] Would that sort of thing even be considered a bug on the Windows side?)

Lousy research

His mathematics is pretty bad. To get the security problems for Linux, he adds all security announcements from each of the major distributions - completely ignoring that most of those announcements are for the same bug. The Linux number is thus about a factor 4 too high.

Also, the Windows announcements are for the OS itself only, while the Linux announcements cover programs that do not count as OS stuff under Windows.

Badly researched piece.

/Janne

Not True

[...] To get the security problems for Linux, he adds all security announcements from each of the major distributions - completely ignoring that most of those announcements are for the same bug. [...]

I can't connect to WinInformant, but if you look at the numbers available at SecurityFocus, you'll see that they did not simply add up the numbers. Linux is listet with 96 aggregated vulnerabilities for 2001, while e.g. Red Hat has 54, Debian got 28, and Mandrake got 36. There are more Linux distributions listed, but these numbers allone show that your claim is wrong (unless WinInformant has different numbers).

You'll also see that Red Hat had 54 vulnerabilities while Windows 2000 had only 42.

However, I'd still agree that the WinInformant article is badly researched (but please note that, as stated above, I've not read it, I only know the part that Slashdot quoted). The article claims that Windows is more secure "according to the reputable NTBugTraq," however, SecurityFocus does not make any claim concerning the security of either Windows or Linux, they just make the numbers available as a statistic. In other words, WinInformant doesn't have any source for their claims, they just found some more or less interesting numbers and made up a story.

Number of bugs is the wrong metric!

What matters is not how many bugs there have been, but the total window of vulnerability per bug -- the time elapsed from bug's discovery to bug'a closing. One really bad bug that remained open for a year is much worse than 10 bugs each remaining open for a week, you see.

Unfair comparison, uninformed journalist.

After reading the whole thing, I came to the conclusion that this is an unfair comparison:

-They only count bugs for one Microsoft OS product. I mean, there's Win95, Win95osr2, Win98, Win98SE, Win2000, WinME, WinCE, WinNT4.0...

-They count one bug for each distribution. I mean, if a bug is detected on rsync, it shows as one different bug for every distribution, that is, one but for Mandrake 7.0, one for Debian, one for Mandrake 7.1 ...

So, this makes me wonder if the journalist is plainly uninformed or if has no idea of what he is talking about (a laid-off journmalist from the gardening section re-hired for a tech-writter position).

The conspiracy theories, black helicopters and Microsoft-payed journalists, from my point of view, do not apply here.

Well, who said the world was fair?

Re:Unfair comparison, uninformed journalist.

What I read was the original article before it went down by /.

So worry for the thing on Win9x/3.x + WinNT/2000.

So they are talking of Server OSes. So Win9x/3.x do not account as such.

What you say is that, of course, they do not include duplicates of the same vulnerability. But then there's no such program as rsync-2.07-3.i386.rpm on Debian 2.2 . Can you see it?

Also, why it is strangely coincidental de number of bugs for Red Hat Linux 6.2 for Alpha and Sparc? See:

For 2001, we see:
RedHat Linux 6.2 sparc - 18
RedHat Linux 6.2 alpha - 18
Debian Linux 2.2 sparc - 18
Debian Linux 2.2 arm - 18
Debian Linux 2.2 alpha - 18
Debian Linux 2.2 68k - 18

Coincidental? See it yourselves at SecurityFocus WebSite [securityfocus.com]

Maybe is a cross-architechture bug? Will this mean that, in fact, it is the same bug?

Then the numbers for Mandrake, Red Hat and Debian are waaay too similar (2001) to be just a coincidence (Mandrake 7.1, Red Hat 7.0 and Debian 2.2 can be thought as "equal distributions" by means of timeline, packets versions and such):

RedHat Linux 7.0 - 28
MandrakeSoft Linux Mandrake 7.1 - 27
Debian Linux 2.2 - 26

Then, on 2001, we can assume that Red Hat 6.2, Mandrake 6.0 and 6.1 have the same package versions :

RedHat Linux 6.2 i386 - 20
MandrakeSoft Linux Mandrake 6.1 - 20
MandrakeSoft Linux Mandrake 6.0 - 20

And those numbers are also very very close to the ones for Red Hat Linux 6.2 on different architectures.

Maybe, just maybe... they are the same bugs?

Then, on previous years, the trend is the same.

With all the respects, I am no FUDing here. I post my comments to some piece of news that was flawled.

And I tried to explain why it was flawed. And I was vry carefull to not to blame conspiracy theories.

Then, again, I'm human. And I make mistakes. Like the Win0x/3.x and Win2000/NT of my previous post.

But this does not invalidate at all my message.

The more accurate question

Pure quantity of security holes really is not the most question. To me there are two factors:

1. How severe is the hole if exploited.

Are we talking a DOS, a root compromise, the ability to take over a domain controller. The effect of a compromise needs to be taken into account.

2. How easy to exploit is the whole.

Is it a theoretical exploit, or are there tools floating around? Can it be easily mitigated by a good firewall, or can viewing an email cause the problem.

These questions seem to me more important than pure quantity and should be taken into account when building a threat assesment of a system.

Re:The more accurate question

"These questions seem to me more important than pure quantity and should be taken into account when building a threat assesment of a system."

Oh please. This is the same Slashdot that touted 30K bugs for Windows 2000 (like every other major tech publisher) regardless of the fact that the bugs were not known and many were probably "We spelled "maximize" wrong here".

Not being a Windows apologist

But it is possible to have a very secure Windows environent. No, it does not involve turning the box off ;^)

Take this example: you have a highly competent NT/2K administrator (they do exist) and a pitiful *nix administrator. Which one is going to produce a more secure box? Any objective person would have to say the NT/2K guy would, because he knows his platform well enough to shore up vulnerabilities. Nimda, I Love You, and many other worms did not hit affect my company because we took security very seriously beforehand. Malicious attachments (.EXE, .SCR, etc) were banned long before I Love You came along.

Now, having played devil's advocate for a moment, let me say that if you have a tightly controlled *nix box with a competent admin and a focus on security, you can create a damn near impregnable system. The weaknesses then lie with the applications, not the OS, and that's something ALL vendors need to work on (you listening, Larry "Unbreakable" Ellison?)

Re:Not being a Windows apologist

Microsoft certainly does little to help those of us trying to secure their systems. The knowledgebase is confusing when it comes to system hardening, and MS loves to ship their products with absolutely every feature and doo-dad turned on. It makes setting up a Win2k webserver such a pain in the ass, but over time we've compiled a checklist that makes things much easier. Much like Linux, we made the checklist with the input and experience of many others.

Contrast this with a typical RedHat install. Sure, you can elect to not install a ton of stuff, but the dependencies can and will drive you nuts if you need widget-1.12-i386.rpm, which conflicts with Perl, glibc, and about ten thousand other things you don't want to fool with. Then couple that with the overwhelmingly nonexistent or conflicting/out-of-date documentation that is (isn't?) available for some Linux modules, and you're reduced to playing Sherlock Holmes again. And what do you do when the HOWTO doesn't answer your question? Posting in a newsgroup results in about 50% of the responses being "read the HOWTO you fucking l00ser", 40% being wrong/misinformed/don't-know-either responses, and only 10% being useful and helpful.

What both Windows and Linux need is a "Secure" install option that by default has nearly everything turned OFF, and then a simple way to add/enable functionality as needed. Templates for webservers, DNS, FTP, mail servers, and such would be great, and they should keep pace with patches and updates for the OS and related applications. Why no one has bother to do this is beyond me, but I think this laziness has resulted in 90% of the exploits seen in ALL OS's on the web.

Actually, to be fair...

I can't remember hearing about many *new* security holes in win2K recently.

I can't get to the article right now, so I'm not sure exactly what their argument is, but while I can remember hearing about quite a few major security holes in the unixes (I think everyone was bitten at least once by ptrace race conditions) I can't think of any similar issues in win2k.

XP, on the other hand... but we're not talking about XP here.

Re:Actually, to be fair...

Actually, IIS hasn't had a hole since last August and IIS 5.1 hasn't had one, period. XP has only had the UPnP hole (new technology, consider it a version 1.00 bug).

There are FAR fewer holes in W2K than people would like to admit. IE may have some problems but not the base OS. Even IIS has been tighted up a great deal.

People need to understand something, we know MS almost never get's it right the first time (see version 1.00 bug) and may not the second but eventually they do. OK, they sucked at security to begin but with all those resources and the pressure from the top and from outside - did you really think they'd sit still or get worse? Nope - ask Netscape what happens when you become their focus of attention. Tux comes out and smokes IIS 5 and everyone laughs... according to the results of my beta tests with IIS6, we'll see who's laughing when it's publically benched.

Your lesson is: MS learns. It's almost never right the first time but... it learns.

Quality vs Quantity

Surely it's not the number of vulnerabilities that either OS displays that's important but rather their severity?

I mean, an exploit that requires the malicious party to have physical access to a machine and then only gives him access to one specific folder on a system is hardly as big a deal as one that gives a script kiddie sitting in his bedroom complete remote control of your corporate servers, allowing him to copy, overwrite and delete files, folders and hard drives at the click of a button?

Let's try to compare apples and oranges here. Just because McDonalds has more restaurants than Michelin-stared ones it doesn't make the Big Mac a better meal.

Re:You mean KNOWN vulnerabilities, right?

Granted, you can look at the code, but do you? I run both Linux and Windows environments at our dev company, and I must say that the "hardening" list of things you must do to secure Linux and Windows is pretty much near the same length. In some cases, Linus is harder to secure because so many things lack documentation or have not been tested properly (if at all).

While I have many bones to pick with MS, disclosure of bugs is a tentative one. On one hand, if they find a bug, don't tell anyone, fix it, then tell everyone, all in a short period of time, I'll all for it. If nobody (or very few people) knows about the exploit, the chances of me being hit by it are very small. The closed source prevents hackers from climbing all through the code and pre-emptively looking for bugs to exploit. This can be a Good Thing(tm), but it can also be a Bad Thing(tm) if MS finds an exploit, does nothing about it, and then a wily hacker exploits it.

The ability to see the Linux source does me and my dev team little or no good. We are software developers and don't have the time to run through hundreds of thousands of lines of code looking for vulnerabilities. We don't have the time to try and understand poor documentation, conflicting requirements, and other pitfalls that can strike open source. I would go out on a limb and say that the vast majority of LInux users don't climb around in the code. Who has the time?

Linux as a whole, or just MY Linux?

The SecurityFocus charts [securityfocus.com] seem to say that in the last several years, WinNT/2K has had 2/3 to 3/4 the vulnerabilities of Linux -- all Linuxes combined, that is.

When you break it down, however, Windows has been about equal to Red Hat and well above all the othe Linuxes and Unixes in the chart.

As a willing participant in the capitalist scheme, I don't care how secure everyone else's servers are -- just the one securing my stuff. The only thing this chart tells me is that if I want a secure server OS out of the box, I should start with Mandrake or Debian instead of Red Hat or Windows.

Break it down..

1. Severity - The issues that exist on Windows platforms are demonstratably larger. There is no administrator/root containment of priveldge (generally), and most of the security issues reported are indeed system-level, remote, and widespread.

2. Activeness - The common issues reported for Windows deployments are almost universally in use and actively being exploited BEFORE the report. Most *ix vulnerabilities are not being actively exploited (and definitely at a lower level of activity), and are generally patched to resolve the issue FAR quicker.

3. Openness - "Linux" has no control over the release of bug reports. Microsoft on the other hand, does, to a degree. They can actively "persue" the matter and encourage the bug reporter to remain quiet about it until they can respond. In some cases for MONTHS even for well established bug hunters like eEye, on very large vulnerabilities like UPNP.

In closing, there are lies, damned lies, and statistics. Sure, you can put whatever spin you want on it, and I think I have in this posting.

ONE thing needs to be clear, there are alot of bugs, and having many eyes isnt preventing them from happening on Linux.

No matter where you sit, its justification to yet again work diligently to reduce the number of potential bugs by secure programming techniques.

Much harder to compare "Linux" versus Windows

Unlike Windows, there are many independent distributions of Linux that may or may not be vulnerable to a security hole. Also unlike Windows, each distribution has shorter release cycles. Futhermore, many Linux distributions come with lots of bundled software that not all sys admins install.

This means that security holes discovered against Windows could be far more devastating because of the uniformity of the installed systems. Code Red/Nimda, etc. would've been much harder to pull off against all variants/distributions of Linux. There's much more paydirt in developing good Windows exploits, since they're likely to work against ALL Windows systems, which means the exploits are likely to be very refined and well tested. Compare to Linux exploits which are usually very hard to get working the first time.

It's also harder to find security holes in Windows since it's closed source (which doesn't make them any less severe). Many security analysts won't even bother since it mostly involves using a debugger to poke at a task for hours, rather than simply grepping source trees for unsafe functions.

But yeah, it is pretty disgusting that Linux in general has this many security holes.

I have read this before...

Essentially, concluding that Windows is more secure based on that data alone is rather ridiculous. Not to say it couldn't be true, but that data is inconclusive at best.

For one, in total vulnerabilities Windows come in second only to aggregate linux, which, as far as I can tell is a compilation of vulnerabilities across the board for linux distributions and therefore includes mostly duplicates, so that figure is best thrown out the window completely. So numerically the argument doesn't hold up. Additionally, within a distribution a widespread vulnerability may impact several packages. For example, say a widespread vulnerability in FTP servers was found. In Windows, that means one vulnarability, IIS. For a linux distribution, it could be several (wu-ftpd, proftpd, etc...) So in another way Linux figures are inflated by duplicates.

Second, no matter how the numbers add up, it still proves nothing for either side. The numbers state simply that X # of vulnerabilities are known for platform. Nothing is said of severity or exploitability. Very minor or virtually non-exploitable vulnerabilities count as much as serious, wide-open delete data vulnerabilities in these stats. Also, no consideration is given for what would be considered a vulnerability on each platform. Windows tends to by design allow users to do more without Admin privs. So, a theoretical bug that allowed change of color depth in XFree86 might be considered a vulnerablity (since root privs are typically required for that operation), while in Windows it is a normal, harmless feature. This example has all sorts of problems with it, but I think it illustrates the point that some things normal in Windows would be considered vulnerabilities in a Linux environment (and vice-versa to some extent).

In short, no simple chart can show one platform to be more secure than another....

Open source nature of Linux

Is it a surprise that there were more vunerabilities DISCOVERED for Linux than for Win 2K? How many people are looking over the source code of Win 2K for bugs? Now how many have access to the couse code for Linux? It seems pretty obvious where you will find more bugs in the short term. Also, do you think that Microsoft "announces" any and all bugs that it finds internally or are these just bugs that were found outside of Microsoft? How easy is it to find these bugs in Windows without the source? How many more would be found if source code was availible?

In the long term Linux will have progressively fewer bugs/vulnerabilities due to its open source nature. Look at the numbers on the same chart for NetBSD. There were 9 vulnerabilities found in 2001, and 42 found in Win 2K. 54 for RedHat and only 2 for TurboLinux.

Obviously everyone should switch to Turbo Linux.

A Treatise on Fishing

I posted a couple years ago on this topic. My hypothesis at the time was that Open Source would show more bugs for quite some time, as people poked through the code, but would gradually settle down and become very secure. I also believed that Windows vulnerabilities would continue to be discovered at a more or less constant rate.

The jury is still out.

The SecurityFocus statistics broke in August, 2001, per their web page, so one has to extrapolate the partial 2001 total to get the projected total for the year.

In that extrapolation, one sees that the expected number of bugs (assuming the 96 reported bugs cover through the end of August) would be 144. There were 153 the year prior, which is likely well within the margin of error. In addition, many of the black hats have STOPPED REVEALING their exploits, so in fact there may be many more than what we see.

Now, it's worth pointing out that this is not necessarily a good measurement of security. We may be measuring the wrong thing.

An example of bad measurement is the one the government used to determine how many cod were left out in the ocean, to prevent overfishing. Year after year, the catches were about the same, so the government assumed that the fish stocks were constant. But suddenly there were no more fish -- the industry collapsed.

Why? Because they were measuring the wrong thing. They weren't measuring the total number of fish, they were measuring the fish that were caught. They didn't realize, as the fish stocks dwindled rapidly, that the fishers were getting newer and better technology to fish with. The total number of fish coming out of the water was constant -- but as a fraction of the total fish in the water, was going up very quickly. Eventually the fish were all but wiped out.

Measuring security by bugs reported is very similar. It may or may not reflect the number of bugs in the 'ocean'. It is an indirect measurement at best.

We need to differentiate between fish 'caught' and fish 'available'. From a security perspective, I think we are talking about TRUE security (the number of fish in the water) versus FUNCTIONAL security (the number of fish actually being caught).

Now, as security people, our goal is to reduce the fish catch as much as possible. There's two ways to do this; we can reduce the number of fish, or we can somehow control, limit, or damage the profession of fishing.

The real professonals are trying to reduce the number of fish in the water. That's the true long-term solution. But from a short-term perspective, what I care about personally is how many fish are CAUGHT. Every time they come up with a new exploit, I have to run around like a maniac patching systems.

However, the fishing analogy starts to break down, as most do eventually. Truly secure systems are still run by people, and people make mistakes. Even if the OS is perfect, the attack will often come against the weakest link, the employees. Thus, even though I would prefer to have true security, I have to argue that it isn't really necessary. The OS just has to be stronger than the other avenues of attack. ("Why are you putting on tennis shoes? You can't outrun a bear!" "I don't have to. I just have to outrun you.")

Security through obscurity, in other words, may be adequate for most uses. It slows down the rate of fish catching. If nobody discovers the bug until the next version of the OS is out, the bug is less important. The longer it takes to discover the bug, in general, the less damage it will do -- at least as long as we're on the upgrade treadmill.

But, a counter-argument to that just occurred to me: Security through obscurity may be long-term counter-productive -- making it hard to catch fish may have the effect of increasing the fish supply. Every time a fish is caught, it can't breed, and reduces the total population by that much. Likewise, in code, once a vulnerability is discovered, many related vulnerabilities may also be patched. Thus, security through obscurity may work well for a long time, but may actually be making the fundamental problem worse.

Another observation I have to add is that programmers like to create new programs. Very few of them like to audit code. New projects and programs are being added to the Open Source world at an amazing speed, and I don't think they're being stringently audited. In other words, they're adding to the fish stocks every day. There is no QA department in Open Source, and the code is getting more complex than individual people can understand anymore. I think, unless we come up with a better development method, Microsoft's ability to fund a billion dollar a year QA department is likely to reduce their fish count below that of Open Source.

So I think I will need to expand on my original hypothesis. I now believe that Open Source will probably lag behind closed source in terms of FUNCTIONAL security. In terms of TRUE security (absolute number of exploitable bugs, known or unknown) -- there's no easy way to tell. If catching fish reduces the fish supply, and if the programmers don't add too many new fish, eventually Open Source will start winning. But if Microsoft's QA department does a good job with their nets and lures, their fish supply may drop just as fast or faster. Money is definitely a good way to motivate people, and Microsoft has a lot of it.

It's also worth pointing out that even if things are getting more secure, the catch rates may be roughly constant, because presumably the crackers will get better and better, catching a higher and higher percentage of the fish. If the analogy holds, and I suspect it may, then eventually the fish stocks will be exhausted and the black hats will be very suddenly unable to crack machines anymore.

It's going to take at least five more years to know -- and twenty might be a more reaonable time frame. It took a long time to wipe out all those billions of cod. It may take just as long to wipe out the pool of security flaws.

<<RON>>

Some explanations???

Greetings,
I wonder how they decided what is "more secure", but my guess is that it's based on the number of reported exploits/bugs.
Does anyone know if they used any weighting on the types of exploits/bugs. I would consider a remotely exploitable bug to be much worse than a locally exploitable bug as you can't control people that aren't on your box as well as the people that are. I would consider a root/administrator access bug to be worse than a denial of service type bug.

So, given a weighting scheme of :-
Remote Root = 4
Remote Denial of Service = 3
Local Root = 2
Local Denial of Service = 1
How would the different OSes stack up?

My guess is that without even taking number of installations into account you would find that Microsoft was at least as bad as the various Linux/Unix versions. I'm not going to say that they were worse.

Anyone want to do some analysis on the same information given a weighting scheme and see what the differences are?

Z.

Wait a sec...

1. How many of the Linux vulnerabilities are in services that aren't linux? IE: sendmail, apache, ftp servers, and whatnot? Just because something is packaged with linux doesn't make it linux. Do the windows bugs count IE bugs and every other MS software running on the system? What about other packaged software such as AOL and whatever other links they provide?

2. Sheer number of vulnerabilities mean nothing - are they counting the severity of the vulnerabilities?

3. Are they counting the time it took before A) someone discovered the vulnerability and B) a patch was issued?

4. If there are comparable numbers of linux vs. win2k servers out there, which actually had more break-ins? (This question not valid if there is a wide gap in numbers since then the lower of the two probably benefits from that "security through obscurity").

5. I think having full source code availability leads to people actually FINDING the bugs, whereas Windows could have way more, but we don't know about them unless people are actually TRYING to crack the system (as opposed to finding them working on source or whatever).

Bogus statistics

If this is the same article mentioned on LWN (can't be sure, since it's slashdotted), this article compared the number of bugs reported against Windows against the number of bugs reported against Red Hat. And Debian. And SuSE. And another distro - forgot which one.

I'm sure it was an honest mistake that most Linux bugs were counted multiple times.

But I don't buy into the "bug count" argument anyway. It's a lot like that controversy over the "most decorated US veteran" (Hacksworth?) - a lot of people think that you can have a warehouse full of bronze stars and distinguished service medals and it's all scrap metal next to a single Congressional Medal of Honor (post.).

What was the last remote root exploit for a widely used Unix service? What about local exploit for a widely used Unix application?

Now ask the same thing about Microsoft.

Finally, "NTBugTraq" may be respected but that doesn't mean it never publishes crap -- sometimes for the purpose of shooting it down. I've seen this happen on comp.risks and elsewhere.

What about the last half of 2001?

Anyone remember Code Red? Nimda? I sure do. I still get 300+ scans a day from infected Windows boxen.

Also, most linux vendor security announcements posted to Bugtraq are for add-on software not enabled by default. They are also announced by each vendor individually, and the author of the package. Most Windows announcements are about vulnerabilities in the OS (IE) or widely deployed packages (IIS, Outlook) from the author of the exploit (after [e-mail] has ignored them).

The entire article needs to be modded -1 flamebait.

It is an interesting question - and a proposal

Which OS has more security problems is an interesting question, but I would not use ntbugtrack's data to answer it for the following reasons...

• Having one of the OSes embedded in their name immediately makes my wonder about bias.
  
• They have an aggregate data column for `all linux distributions' where they overcount the same bugs. Despite breaking windows OSes into two columns, they don't aggregate these together.
  
• They do not attempt to quantify either theoretical severity of a problem or actual real world impact of the problem. The linux community tends to have more bug reports for theoretical problems that are fixed before they are exploited.
  
• The statistics from ntbugtrack have been stale since August. This is an abandoned site. I suspect anyone doing a serious analysis would start with current data.
  
• It is possible that MS bugs are under reported. All Debian security bugs are fully reported by policy. Microsoft has a policy (recently at least) of supressing minor bug reports and quietly fixing them.
  
• Your typical linux distribution is OS, plus OS utilities, plus all of the applications. Application level bugs will show up in the linux distributions, but not in the windows columns. Consider the recent rsync bug. That should be a bug for all of the major linux distributions, but will not appear in the windows column even though rsync can be installed and run on windows. (This is an example, I have not verified that the bug affects windows. I believe it does from the description. Don't flame me over this one.)
  

So, how about we do a serious analysis? I'll put up a system that lets people rate the various bugs by severity along a couple of continuums. (Like theoretical impact and actual impact.) Then people can use this data to draw more accurate conclusions. If at least 10 people respond to this post, and two thirds of them think it is a good idea, I'll put one up and link it here.

Wow, talk about your slashdot fodder...

Again, Winformant, in a desperate attempt to seem like they aren't a bunch of toadies, has struck an "independent" blow against linux's "security myth," by proving that more holes were found in linux than in Windows.

Well, duh. Linux is full of holes. But that's not winformant's problem. You see, each of those holes was cleared up in a matter of days and a patch was freely available. There were no egos and press releases claiming there are no holes. There were no programmers waiting around while Marketing decided the best colour for the patch's installation wizard. There was no downtime as millions of machines had to get the file from a single MS server because the patch's license didn't allow redistribution. There were no hours of wringing hands as sysadmins watched hackers pick off their boxes one by one because there's no workaround while the patch was built. There was no possibility for diving into the code and fixing it yourself; and if there was there'd be no way to release the patched dll. Oh, and if a linux machine was compromised, there was little chance of it polluting the entire network...because the bug affected less than 1% of the install base of that particular OS, and not 100%.

Not to mention the reason that so many Linux patches were "found" rather than "discovered" is that bored sysadmins can sit around with sheets of source code, hoping to find a hole and make a name for themselves on BugTraq. With windows...well, you'd better be good with BlackIC and ASM, because it's the only way you're finding the hole.

There is No Science Here.

I like SecurityFocus. The people in charge of SecurityFocus are with-it and honest. I am completely confident that this work was done in good faith.

However, the conclusion being drawn here is invalid. The SecurityFocus vulnerability survey is interesting, but it is not itself a reasonable methodology to generate security metrics between operating systems.

I could pick nits at this ad hoc study for hours, but the biggest problems are also the most obvious:

First: the study associates third-party software with the operating system, and aggregates all the distributions together into a meaningless "Linux" category. This study is literally just pattern matching against advisories.

Second: there is no notion of "severity" or "impact" in the study. This is a shame, because SecurityFocus has actually put some real effort into deriving a taxonomy of vulnerabilities from their (enormous) vulnerability database. There is no way to determine whether the N Linux vulnerabilities were equivalent to the K NT vulnerabilities.

Third: the study compares a kit of open-source software, which has received extensive peer review, to a closed-source product. It should surprise nobody that Linux has more documented problems than Windows: it's actually possible to go find vulnerabilities on Linux. Finding Windows vulnerabilities requires black-box reverse engineering.

Finally, both Linux and Windows do a reasonable job of locking down server configurations out of the box. What IT people need to know is vulnerability breakdown by operating system and by deployed configuration. This study does nothing to inform us of whether a Linux web server is at more risk than a Windows web server, or whether it's safer to expose a Linux print server or a Windows print server. Organizations that deploy homogenous Apache+NFS+ssh server farms don't care about XFree vulnerabilities or Samba problems.

I don't think SecurityFocus is actually trying to make claims about the relative security of Linux and Windows. I think they've been a bit careless with this report though; it's a reasonable thing to try to generate from their database, but more thought should have gone into presentation.

SecurityFocus has the on-staff expertise to publish some real conclusions about the distribution of vulnerabilities between Linux and Windows. Before this database report is misconstrued by the trade press, it would be enormously helpful if they could publish a statement about the conclusions that can be legitimately drawn from it. It'd be good press for them, too.

Why is this automatically false?

Again, I find it disturbing how easily everyone shrugs this off as propaganda or something.

Listen, everyone: Times are changing. Linux has gotten big and complicated, and is no longer automatically secure. Long gone are the Slackware days where you'd download a minimal kernel/utilities package and then compile only the apps you need, by yourself, and understand everything. Complex software has security problems, and the linux community has done little but use the "lots of eyeballs" method to counter that. Microsoft software is also quite complex, and they have fewer eyeballs (I hope, though I am not sure), but they have publicly recognized the problem and are at least pretending to try to fix it. Microsoft also has a bunch of research into technologies for producing machine-checked code so that they don't even need lots of eyeballs. (I really wish that linux had this too; see a related rant http://slashdot.org/comments.pl?sid=26315&cid=2851 880 [slashdot.org] ).

My linux box has been rooted twice. I keep up to date on patches, I read bugtraq. My windows box, also connected to the internet all the time (and getting a lot more use), has never been compromised through 95, 98, 2000, and XP.(I have been Winnuked, that's the worst thing that's happened.)

I guess my point is: this is not something to laugh at. Some day soon, people will not think of Microsoft operating systems as crashy (already happening to an extent) and insecure (...), and then linux will have a much tougher sell to the average guy who doesn't care about Free Software. Instead of laughing smugly about an article like this, maybe we should be worrying?

Re:Why is this automatically false?

Long gone are the Slackware days where you'd download a minimal kernel/utilities package and then compile only the apps you need, by yourself, and understand everything.

Wrong. I entered those days quite recently, with Linux From Scratch [linuxfromscratch.org]. LFS isn't exactly a "security solution," but it's hard to break into a machine when there's nothing running on any port except ssh.

Case of bad statistics

Ok, here's what I noticed. The SUM of all Linux's put together had a higher bugcount than windows 2000.

Now, how many people do you know that install redhat, then add to it all the security bugs in caldera, Connectiva, Mandrake, Slackeware, Suse, and Turbo Linux?? None, that would be extremely difficult. This is akin to saying the Ford Taurus has fewer bugs than all of the Nissans put together, therefore it is a better product.

Also, we are assuming that all bugs are created equal. Guess what, not so. Windows bugs have superpowers, faster than a speeding packet, stronger than a firewall, able to leap entire networks in a single bound! Linux security bugs take down processes, sometimes servers. Windows bugs take down Networks, or internets!!!

But I'm sure they'll never get called on it, because their readership is windows users. They are preaching to the choir, and they will ignore us and our quest for accuracy.

Inexperienced Programmers?

I was thinking to myself yesterday about how the nature of open-source lends itself to a lack of "talent auditing". Meaning, there **MAY** be a greater chance of bugs being introduced into an open-source project because the programmers are often not hired professionals.

I would like to see a comparison in bugcounts (say, per line of source code) between open-source projects supported by professionals (i.e. people trying to make money off of it, i.e. mySQL) and projects supported by weekend programmers.

I just had an ironic thought. Since most open-source business plans revolve around providing support, would that make those companies want to introduce MORE bugs? :-P

This just in ...

Connectiva has been declared the safest operating system ever with combined vulnerabilities over the last 5 years equalling 0. Everyone in corporate america and those banks too should immediately through out all other operating systems and switch over to Connectiva.

Warning: Connectiva does not support vulnerabilities and all calls will be redirected to the nearest OS distributor.

Calibration of Counting

As a former quality supervisor, I have to say that the conclusions drawn from this data are badly flawed. Interpreting the results of a measurement, even something as simple as a count, without giving due attention to the measurement process itself, is a classic way to reach wrong conclusions.

For any measurement to be meaningful, a mechanism of calibration must exist. In the context of counting software defects of any type, some questions immediately arise:
1. Severity: is there a threshold for including a bug in the count. Is it the same across systems? EG: do each count "privacy bugs"?
2. Scope of measurement: are the measurements made for comparable functionality of code. EG: If "MS Backoffice" is tallied separately to WinNT is this an apples-to-apples comparison to a linux disto?
3. Timing: does each measurement count vulnerabilities at the same point in the identification process? EG: Do "theoretical" bugs with no known exploit count? Do bugs in beta versions of particular applications count?
4. Completeness: are all vulnerabilities reported? are separable vulnerabilities reported separately? EG: if MS internally ID's a bug and fixes it, does it remain secret or will it make its way into the tally? Can three separate bugs be counted as only 1 because the details are kept hidden?

I believe that linux distros include a lot more functionality, have a higher standard on what constitutes a bug, report bugs early and visibly, and fix bugs much earlier in the vulnerability lifecycle. Every one of these traits would penalize a linux distro on a defect count metric.

Reported defect counts are generally a lousy measure of quality, because they drive bad behavior: they can be decreased by lowering the quality of identification process instead of improving the quality of the product. Moreover, to draw conclusions about overall system security, I would be more interested in the aggregate lifetime-until-patch of known working exploits.

This ignores so much...

The problem here is just that there is no "aggregate Microsoft" category. Heck, there's not even a W95/98/ME category! But if you lumped together all W95/98/ME/2K/NT/XP vulnerabilities, then made sure that you dealt with apps evenhandedly, "aggregate Linux" would start looking great all of a sudden.

Now consider exploitability. Let's take Mandrake for example -- although their figures are already way lower than NT's (or, no doubt, 95/98/ME's), a default install includes 'libsafe', which means that none of the buffer overflows or format bug exploits will work. There go 3/4 of the theoretical vulnerabilities, including the ones which haven't been discovered yet. And a libsafe rpm could be installed on almost any Linux system in a matter of seconds without breaking anything, making the whole raw tally concept very questionable.

The only way to secure an MS system that broadly and quickly is to cut the Ethernet cable.

I leave my Linux box on the Internet without worry, and my investment in security has been maybe an hour and $0.00. I can and do take my time on patches because I know that almost none of the bugs have any chance of being exploited on my system. That is a realistic measure of Linux security, and I will delightedly compare it to Windows any day of the week. Securityfocus' figures, taken by themselves, don't mean anything.

More interesting statistics...

Screw securityfocus, let's look at bulletins released by manufacturers.

Microsoft security bulletins released in 2002:
MS02-001

Redhat security bulletins released in 2002:
2002-018
2002-015
2002-014
2002-012
2002-011
2002-009
2002-007
2002-004
2002-005
2002-003
2002-002
2001-171
2001-168
2001-165

And if you look at 2001 results you'll see a somewhat similar trend, although not near as pronounced. Somethink like 80 versus 60.

Are these statistics meaningful? Of course not. If you have read Paul's columns you would know he reported this tongue and cheek. It was a slow news day, he noticed this, had to make fun of it.

What makes this story interesting, and why Paul reported it is because if the numbers had been reversed you would be assured that would be the headline of the day on slashdot, and if anybody questioned it they would be called Microsoftie apologists.

And look at the responses you see here. They're almost comical. Reminds me of the responses to the Mindcraft benchmark. Fear, Uncertainty and Denial. :)

Glass half full...

They are looking at this from the wrong perspective. Instead of saying "Linux had more bugs than Windows in 2001" it should say "Linux *fixed* more bugs than Windows in 2001". Simply becuase those Windows bugs haven't been found yet does *NOT* mean tha they are not there waiting to be exploited (or are already being exploited).

A more scientific aproach

requires some methods, and since I'm too lazy today to look for the mothods they used to compile all that data, I'll create my own.

1- let's stablish what's a windows OS and what's a Linux OS (and the nots too)

1.1 Windows 3.1 is NOT an operational system. is a graphic user interface (GUI) for DOS. let's assume win 95/98/me and NT 3.5/4.0/2000/XP are OSes.

1.2 Linux is NOT an OS. Is a KERNEL. the combination between Linux and GNU OS makes the operational system we know as GNU/Linux

2 Let's determine the minimum instalation of each one that's capable of doing usefull work, including user tasks such as reading e-mail and browsing the web and server tasks such as serving web pages, sharing files, routing e-mail, et al.

2.1 Both in Windows and GNU/Linux you'll have to select all the packages neccessary to the proposed tasks using the minimum ofered by the standard install CD. If the CD doesn't ofer some of the functionalities they must be downloaded from the manufacturer's site.

2.2.1 for windows you'll keep only:
- networking drivers;
- the standard MS file sharing;
- Internet Explorer;
- Outlook express/MS mail;
- IIS/personal web server
- Exchange server;

2.2.1 For GNU/Linux:
- Network modules and associated tools;
- NFS or Samba;
- Mutt os pine (remember, in GNU/Linux you can read e-mail/browse from command line, so XFree is not installed);
- Lynx or Links
- Apache;
- Sendmail;

3 count the number of security holes in the test systems, including:
- vulnerabilities to e-mail virii;
- vulnerabilities to malicious web-pages;
- remote exploits that grant root/administrator access;
- local exploits that grant root/administrator access;
- holes that allows an atacker to succesfully launch a DoS atack, freezing the machine;
- unauthorized read and/or write access to files;
- any other vulnerability you can think of;

In a test like this who do you think'll win ? please post your comments.

Oh yeah.

All the servers infected with a virus hitting my web server requesting http://www/root.exe are UNIX machines, uh huh.

Why not try this.
With any of the following IPs, type 'smbclient -L 207.88.220.61'

If you're more of a cracker than I am, you might then try smbclient //WORKGROUP/C\$ -I 207.88.220.61

and just hit return when prompted for a password.

this also works with:

203.228.232.188
203.231.119.70
203.231.166.49
203.233.20.86
203.231.216.208
203.199.54.26
203.231.217.5
203.231.122.227
203.244.13.72

and countless others.

These machines (all Win2K) have their entire filesystems exposed over the internet, and are promiscuously advertising their presence because they are infected by a virus that leaves a clear trail in the logs of any web server they attempt to infect.

These machines are engaged in abuse of my web services, and I hold Microsoft at least partly responsible for this situation.

Presumably the virus itself is responsible for opening their shares with guest access, but maybe it's M$'s lame out-of-the-box security.

If your machine's IP is on this (small fragment of my) list of machines banned from accessing my web server due to virus infection, then i suggest you replace your hopelessly insecure OS with a decent one.

I was incredulous when i analysed my web-servers logfiles and found the sheer number of virus-infected hosts, all Windows NT and 2000, and most of which were sharing the entire contents of their hard-drives over the public internet.

I know Windows can be secure as the admin is competent, but the ease with which it's security is breached through Outlook/IE is breathtaking.

The idea that Windows is somehow more secure than Linux/UNIX is laughable to me.

This is a sham. Relevant snippits:

[Here's what I posted to the comments section of wininformant.com. Doubtful they'll display it.]

Excellent satire.

One only needs to look at the SecurityFocus stats referenced to find holes in most (if not all) statements made by Paul's article. An example:

"A look at the previous 5 years [there were only four previous years reported on - tsmith]--for which the data is more complete--also shows that each year, Win2K and Windows NT had far fewer security vulnerabilities than Linux..."

Lets take a look at the previous "five" years, starting with 2000. Redhat Linux 6.2 i386, listed as the most vulnerable of the linux flavors with 65 vulns, is bested outright by MS Windows NT with a whopping 71 vulnerabilities. To compare apples to apples requires adding in MS IIS 4.0, with 29 reported vulns, for a total of 100 vulns, or over %50 more vulnerabilities than the _buggiest_ distribution of linux. Even the combination of the lowly, four-years-on-the-market, mature Windows95 with IIS (if such a combination were possible - it matters not, because if not then W95 cannot honestly be compared to RHL) results in 64 vulns. Note that Win95 had the least vulns reported (at 35) of all the Wins. Also not that despite it being out a solid 3 years longer than RHL, it can only best the mark by 1 vuln. Not quite what I'd describe as "far fewer".

Paul's statement is even more humorous in light of the data from 1999. In that year, Microsoft's products fill the top of the list almost exclusively, with the exception of Solaris 7.0 having slightly more vulnerabilities than IIS and NT4.0SP5. That's right folks, IIS _alone_ had more vulns than any flavor of Linux and most of the Solari. NT4.0 without a service pack? 75 vulns.

1998 is the only year during which Paul may have a contention regarding NT besting Linux. 8 vulns vs RHL's 10. Note, however, that this is not including bugs from IIS, and is akin to comparing apples to oranges. In any case a difference of two is not what I would consider "far fewer". The comparison of RHL to Win95 is laughable in this case - what does a count of security vulnerabilities show in a system which has virtually no security?

Once again in 1997, RHL's 6 bests WinNT's 10.

Paul, how exactly are we to interpret the phrases "five", "each year", and "far fewer"? Perhaps as "four", "maybe one year", and "a little bit"? I suppose your wording was close enough though - I mean, it _is_ just your journalistic integrity on the line, right?

"Win2K had fewer vulnerabilities than RedHat Linux 7.0 or MandrakeSoft Mandrake Linux 7.2"
Note that niether BO nor IIS are reported on in the 2001 tables, thus no conclusion may be drawn.

"...despite the fact that Windows is deployed on a far wider basis than any version of Linux"
Excellent heresay. Well un-supported by reliable references. After reading the prior claims in your article, I'll be sure to give this little tidbit all the credit it deserves (incidentally, none).

Thanks again for the good laugh Paul! What's next week? "WinXP Embedded Has Smaller Footprint Than vxWork? Yepppp!" I can almost imagine you shaking your pom-poms in the air.

Lots of misinformation going on around here.

Lots of misinformation going on around here.

It seems that the site(s) are back up, I've appended the meat of both in case they go down again. The good deal of the posts I'm reading stat the stats are invalid because it is an aggregate of all linux distros in comparison to windows 2k. This is not true, the stats make a clear distinction between distro's and count them separately, for example Redhat 7.2 had 28 exploits in 2001 where Win2k had 24.

Which is what this article was attempted to exploit itself. Its very clear that the original article (as shown below) is a blatant attempted to drum of a flame war between linux and windows supporters. With a headline like 'Windows More Secure Than Linux? Yep!' it doesn't try to hide that fact either. The entire basis is of the article is a 4 "exploit" difference between Redhat linux and win2k within the last year. Of course the severity of these exploits are not detailed.
Considering that windows has dramatically improved its numbers from the previous years I think a more accurate headline would have been "Windows security much improved from previous years"
As many people has said far my eloquently them myself, these statistics do nothing to prove or disprove a superiority between linux and windows security, as there are so many problems with even trying to prove such a thing.
-Jon

below is the full text of the article and the stats from Security Focus.
------------------- WinInfo artical ------------------
Thanks to David Byrne for this tip: For at least the first 8 months of 2001, open-source poster child Linux was far less secure than Windows, according to the reputable NTBugTraq, which is hosted by SecurityFocus, the leading provider of security information about the Internet. (The company's 2001 statistics are available only through August 2001 for the time being.) According to NTBugTraq, Windows 2000 Server had less than half as many security vulnerabilities as Linux during the reported period. When you break the numbers down by Linux distribution, Win2K had fewer vulnerabilities than RedHat Linux 7.0 or MandrakeSoft Mandrake Linux 7.2, and it tied with UNIX-leader Sun Microsystems Solaris 8.0 and 7.0. A look at the previous 5 years--for which the data is more complete--also shows that each year, Win2K and Windows NT had far fewer security vulnerabilities than Linux, despite the fact that Windows is deployed on a far wider basis than any version of Linux. So once again, folks, you have to ask yourselves: Is Windows really less secure than Linux? Or is this one of those incredible perception issues? For more information and the complete stats, visit the SecurityFocus Web site. I'll check back on this story to see how all of 2001 shapes up.

-------------------SecurityFocus Stats -------------

Number of OS Vulnerabilities by Year
OS 1997 1998 1999 2000 2001
AIX 21 38 10 15 6
BSD/OS 7 5 4 1 3
BeOS 0 0 0 5 1
Caldera 4 3 14 28 27
Connectiva 0 0 0 0 0
Debian 3 2 31 55 28
FreeBSD 5 2 17 36 17
HP-UX 9 5 11 26 16
IRIX 28 15 9 14 7
MacOS 0 1 5 1 4
MacOS X Server 0 0 1 0 0
Mandrake 0 0 2 46 36
NetBSD 2 4 10 20 9
Netware 1 0 4 3 1
OpenBSD 1 2 4 17 14
RedHat 6 10 47 95 54
SCO Unix 3 3 10 2 21
Slackware 4 8 11 11 10
Solaris 24 33 34 22 33
SuSE 0 1 23 31 21
TurboLinux 0 0 2 20 2
Unixware 2 3 14 4 9
Windows 3.1x/95/98 3 1 46 40 14
Windows NT/2000 10 8 78 97 42

Top Vulnerable Packages 2001
Packages # Vulns
MandrakeSoft Linux Mandrake 7.2 33
RedHat Linux 7.0 28
MandrakeSoft Linux Mandrake 7.1 27
Debian Linux 2.2 26
Sun Solaris 8.0 24
Sun Solaris 7.0 24
Microsoft Windows 2000 24
MandrakeSoft Linux Mandrake 7.0 22
SCO Open Server 5.0.6 21
RedHat Linux 6.2 i386 20
MandrakeSoft Linux Mandrake 6.1 20
MandrakeSoft Linux Mandrake 6.0 20
Wirex Immunix OS 7.0-Beta 19
Sun Solaris 2.6 19
RedHat Linux 6.2 sparc 18
RedHat Linux 6.2 alpha 18
Debian Linux 2.2 sparc 18
Debian Linux 2.2 arm 18
Debian Linux 2.2 alpha 18
Debian Linux 2.2 68k 18

Top Vulnerable Packages 2000
Packages # Vulns
Microsoft Windows NT 4.0 71
RedHat Linux 6.2 i386 65
RedHat Linux 6.2 sparc 53
RedHat Linux 6.2 alpha 53
Microsoft Windows 2000 52
Debian Linux 2.2 48
RedHat Linux 6.1 i386 47
Microsoft Windows 98 40
RedHat Linux 6.1 sparc 39
RedHat Linux 6.1 alpha 39
MandrakeSoft Linux Mandrake 7.0 37
Microsoft Windows 95 35
RedHat Linux 6.0 i386 33
Microsoft IIS 4.0 29
Microsoft BackOffice 4.5 29
Microsoft BackOffice 4.0 29
RedHat Linux 7.0 28
MandrakeSoft Linux Mandrake 7.1 26
RedHat Linux 6.0 alpha 25
Conectiva Linux 5.1 25

Top Vulnerable Packages 1999
Packages # Vulns
Microsoft Windows NT 4.0 75
Microsoft Windows 98 44
Microsoft Windows 95 40
Microsoft Windows NT 4.0SP3 33
Microsoft Windows NT 4.0SP1 32
Microsoft Windows NT 4.0SP2 31
Microsoft Windows NT 4.0SP4 30
Microsoft Internet Explorer 5.0 for Windows 98 29
Microsoft Internet Explorer 5.0 for Windows NT 4.0 28
Microsoft Internet Explorer 5.0 for Windows 95 28
Microsoft BackOffice 4.0 28
Microsoft BackOffice 4.5 27
Sun Solaris 7.0 26
Microsoft IIS 4.0 25
Microsoft Windows NT 4.0SP5 23
RedHat Linux 5.2 i386 22
Sun Solaris 7.0_x86 21
Sun Solaris 2.6_x86 21
Sun Solaris 2.6 21
RedHat Linux 6.0 i386 21

Top Vulnerable Packages 1998
Packages # Vulns
IBM AIX 4.3 36
IBM AIX 4.2.1 29
IBM AIX 4.2 29
Sun Solaris 2.6 28
Sun Solaris 2.6_x86 25
IBM AIX 4.1 25
IBM AIX 4.1.5 24
IBM AIX 4.1.4 24
IBM AIX 4.1.3 24
IBM AIX 4.1.2 24
IBM AIX 4.1.1 24
Sun Solaris 2.5.1_x86 23
Sun Solaris 2.5.1 23
Sun Solaris 2.5_x86 22
Sun Solaris 2.5 21
Sun Solaris 2.4 18
Sun Solaris 2.4_x86 17
Sun Solaris 2.3 13
Sun Solaris 2.5.1_ppc 10
SGI IRIX 6.4 10

Top Vulnerable Packages 1997
Packages # Vulns
SGI IRIX 6.2 25
Sun Solaris 2.5.1 23
Sun Solaris 2.5 23
SGI IRIX 5.3 23
Sun Solaris 2.5_x86 22
Sun Solaris 2.5.1_x86 22
Sun Solaris 2.4 22
Sun Solaris 2.4_x86 21
SGI IRIX 6.3 20
IBM AIX 4.1 19
Sun Solaris 2.3 18
SGI IRIX 6.1 18
IBM AIX 4.2 17
SGI IRIX 5.2 15
SGI IRIX 6.4 14
IBM AIX 4.1.5 14
IBM AIX 4.1.4 14
IBM AIX 4.1.3 14
IBM AIX 4.1.1 14
Sun Solaris 2.5.1_ppc 13

Privacy Statement
Copyright © 1999-2001 SecurityFocus

Apples anyone, or how about some tasty Oranges?

How about some different numbers...everyone loves statistics. "The following numbers were obtained by counting web site defacements as listed at Attrition.org from June 2000 through May 2001:" Breakin Stats [geodsoft.com]

The trouble with comparing Linux distros to Windows lies in the fact that Linux distros include so many different applications. I just did a count of installed packages on a RedHat box I am using, and I got 780 installed packages. I'd like to see a comparison of the number of exploits between the RedHat distro and Windows installed with 700 of the most common applications for it. That might be a more useful comparison. Also, I will readily acknowledge the weakness and lack of true usefulness of the numbers below, so no need to flame me for the lack of usability...I'm only posting the info I found, so no need to stone the messenger.

Windows
4336 Windows NT
1070 Windows 2000
2 Windows 95
5408 Windows total

All UNIX and Like
1185 Linux Red Hat
999 Linux unknown distributions
36 Linux Connectiva
23 Linux Debian
17 Linux Cobalt
17 Linux SuSE
13 Linux ALZZA
12 Linux Mandrake
1 Linux Slackware
2304 Linux total

485 Solaris & Sun OS (1)
267 IRIX
163 FreeBSD
121 BSDI
44 SCO
28 Generic UNIX
18 Compaq Tru64 UNIX
9 AIX
7 HPUX HP
4 Digital UNIX DG
3 OpenBSD
2 NetBSD
1 PowerBSD
1 Digital OSF1
1153 UNIX & Like total

3457 UNIXs & Linux

8865 Total Windows and all UNIX

Other
2 Mac OS
1 Netware

63 unidentified

My experience matched that :-(

I had a DSL line in my lab, and several machines on it, including out-of-the-box Redhat 6.2 and somewhat-modified Win95 or Win98 (running an out-of-date virus scanner, but not running a MS mail client). Nobody appears to have bothered the Windoze machine, probably because there's not much useful you can do with it. Meanwhile, I named the Linux box "Kenny" because every week it was killed brutally and senselessly :-) Some weeks it was just installing DDOS clients, but at one point they wiped the machine after I'd thrown them off a couple of times in a row.

Later I upgraded Kenny to a recent Redhat release, either 7.1 or maybe 7.2, running in a medium-security configuration. I didn't notice any problems after that - whatever the popular security holes were had been patched or they were in services I hadn't turned on. I had some other serious problems with those distributions - basically they're not made to be installed on small machines unless you do one big partition or a lot of hand-tuning, and you can't netinstall from a single CDROM drive any more, so you'd better have at least one machine with a lot of disk space. But the security was much improved.

By the way, a couple of the intrusion detection techniques I used were:

• Keep a machine on the lan running tcpdump and look at it occasionally. That's how I noticed all the ping-responses to a university in Sweden during the first DDOS round.
• Don't trust ls or ps to tell you about all of your files or processes. Crackers with rootkits will install friendly replacements - but somehow they didn't think to change /proc, so there were processes that /proc showed that weren't in ps, and there were files that "find" found that ls didn't list. I don't remember if they replaced "top", but the hidden processes were using some hidden files as well as CPU time.
• If a given network or tcp/udp port keeps bothering you, it's easy to set a router to filter it out.

Zealotry

Just to cut throught the FUD on both sides here:

Paul: Fuck You. You don't know shit. How's the page views today? That's what I thought.

CmdTaco: Stop feeding the trolls. This guy just made $x money because you decided to link to his crappy site. Now everyone is here literally frothing at the mouth. If this was real life someone would've been stoned to death by now or branded a witch. Is /. a tabloid now?

Everyone:
Lies and statistics. August 2001 huh? So the stats were last compiled just after Code Red, but not since Code Red II, not since the UPnP fiasco, not since the most secure Windows OS ever? Nice to see "journalists" grouping distros together on the basis of which *kernel* they use. If you want to assess the security of *linux* then only focus on expoits that compromise the kernel. If it's just another BIND or wuFTP vulnerability, count it just once for "OSes that use that GPL'd kernel*" *note: packages included with each distro are not uniform across platforms. Not all Linux distros are alike.

But that is rational and fair, and we can't have that can we? No. We need to increase page views and banner hits, we need to convince so-and-so in management that *OS-not-right-for-the-job* is the right tool for the job.

Windows on the desktop and *nix in the server room; the Buddha smiled and farted. And God said "It is Good".

Re:What?!?

Do the names "Nimda", "Code Red" and "I Love You" ring a bell?

The fact that you can cite flaws in Windows security proves that Windows security is imperfect, not that Windows is less secure than Linux.