| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
Test shows how vulnerable unpatched Windows is | |
|
||
| Time: 07:18 EST/12:18 GMT | News Source: TechWorld | Posted By: John Quigley | ||
|
A test has revealed that a Linux server is far less likely to be compromised. In fact, unpatched Red Hat and SuSE servers were not breached at all during a six-week trial, while the equivalent Windows systems were compromised within hours. An unpatched Windows 2000 Server was the quickest to be compromised, at an hour and 17 minutes, while unpatched Windows Server 2003 lasted slightly longer. Windows XP Professional, unpatched, lasted one hour and 12 seconds. Meanwhile, Unpatched Red Hat Enterprise Linux 3 and SuSE Linux 9 Desktop weren't compromised during the month and a half it was exposed to the Internet. | ||
|
Write Comment
Return to News |
Displaying 1 through 25 of 327 Last | Next |
The time now is
6:16:06 AM
ET.
Any comment problems? E-mail us |
| #1 By 15406 (216.191.227.68) at 3/10/2006 8:32:30 AM |
|
In other news, the Sun came up today, and people need to breathe to live.
|
| #2 By 8062 (70.181.174.185) at 3/10/2006 3:27:20 PM |
| Uhhhh...let me guess...no one gives a shit about limux. |
| #3 By 13997 (69.109.9.15) at 3/10/2006 3:46:01 PM |
|
Wow, the latest releases of two alternative OS that are pretty much updated, compared to an OS released in 1999, one release in 2001, and one in 2003.
Wow, I wonder why the newer releases of Red Hat (circa 2004/2005) and SuSE (circa 2005) were so much more resistant? This is quite the stumper... Oh, but the atricle goes on to say, "However, patching does make a difference. Patched versions of Windows fared far better, remaining untouched throughout the test, as did the Red Hat and Suse deployments. " I wonder if the clue here could be comparing OSes from last year with current updates already installed to 5 and 6 year old OSes with no updates from 2005 in their installation could have anything to do with it. Are journalists on crack or trying to push it? Do people that work in the tech world, read this article and go Wow, Windows from 1999 with no updates sucks. What do you have to be smoking to A) Find any information here or B) Write an article in this manner and expect to 'influence' people that can think? This post was edited by thenetavenger on Friday, March 10, 2006 at 15:51. |
| #4 By 32132 (142.32.208.231) at 3/10/2006 3:51:56 PM |
|
Why wouldn't they use the most recent CD's available for Windows?
Our disks have SP1 on them for Windows 2003. And the firewall gets installed automatically. And for Windows 2000, SP4 is on the disks. Did they really have to use old CD's? Totally bogus. |
| #5 By 20 (67.9.176.193) at 3/10/2006 4:25:53 PM |
|
The title of this article should be:
"Microsoft-hating journalists and 'researchers' having to dig to extreme depths and super-contrived examples to find excuses to bash Microsoft' |
| #6 By 3746 (71.19.43.237) at 3/10/2006 5:16:32 PM |
| i love open source zealots. they freak when MS makes apples to oranges comparisons and then they go and make an apple to orange comparisons. So let me get this straight you take an OS that is on hundreds of millions of computers and has been the target of hackers and virus writers because it is the big boy on the block. You install a 4 year old version unpatched and it is compromised? Who wastes their money on a study like this stating the obvious. |
| #7 By 931 (24.99.3.86) at 3/10/2006 6:42:28 PM |
|
Yeah I mean come on..
Testing windows2000 is pretty lame but if you going to test it who the hell installed win2k today without SP4 (and also highly likely the rollup)? Considering the only "new" installs of win2k are largely enterprise customers the tech would have to be a crack head, I mean please. XPsp2 is fair, media center.\table .etc.. and Win2003(sp1) would be fair as all are reasonably current. All would be equivlent to a typical out of the box install at this point. Yet another flawed study.... Sad that they think people will just gobble this up. |
| #8 By 1401 (65.255.137.20) at 3/10/2006 6:58:10 PM |
| "A test has revealed that a Linux server is far less likely to be compromised." I think that line pretty much says it all. |
| #9 By 12071 (203.158.60.13) at 3/10/2006 7:53:06 PM |
|
#3 "Wow, I wonder why the newer releases of Red Hat (circa 2004/2005) and SuSE (circa 2005) were so much more resistant? "
I'm not sure, but I have a fair idea it has a lot to do with your general lack of knowledge when it comes to when OS' were released. Red Hat Enterprise Linux 3 - September 2003 (http://www.redhat.com/en_us/USA/rhel/details/enterpriselinux3/) SuSE Linux 9 Desktop - October 2003 (http://en.wikipedia.org/wiki/SUSE) Windows Server 2003 - April 2003 A difference of a whole 6 months!!! I guess it must have been a really bad 6 months patch wise which is why it was owned so quickly. June IE - http://www.microsoft.com/technet/security/Bulletin/MS03-020.mspx WMP - http://www.microsoft.com/technet/security/Bulletin/MS03-021.mspx July HTML - http://www.microsoft.com/technet/security/Bulletin/MS03-023.mspx RPC - http://www.microsoft.com/technet/security/Bulletin/MS03-026.mspx DirectX - http://www.microsoft.com/technet/security/Bulletin/MS03-030.mspx August IE - http://www.microsoft.com/technet/security/Bulletin/MS03-032.mspx September NetBIOS - http://www.microsoft.com/technet/security/Bulletin/MS03-034.mspx RPCSS - http://www.microsoft.com/technet/security/Bulletin/MS03-039.mspx The point of this story (aside from Windows being a sieve security wise - which as Latch pointed out is like stating the bleeding obvious!) it that regardless of what OS you run, you need a good SysAdmin who will keep the machine up to date with all required patches and run the minimal number of services that are required to cut down on the number of patches needed to be applies as well as the number of potential entry points into the system for exploitation. |
| #10 By 32132 (64.180.219.241) at 3/10/2006 9:49:52 PM |
|
"The desktop configurations were deployed with the default settings for each operating system with the exception of firewall software. As these systems passively wait to be compromised, appropriately configured firewalls would simply not allow any connections to the computer and comparisons between operating systems or patch levels would not be possible."
Ahh. So they deliberately turned off the firewalls in the default install of XP SP2 and Windows 2003 SP1. Good test ... for a moron. |
| #11 By 8556 (12.207.222.149) at 3/10/2006 11:18:34 PM |
| As a former writer, I recognize journalism when I read it. This was not journalism. No one would run a non-up-to-date verison of ANY OS in a viable enterprise. The timing listings are quite humerous and totally meaningless. Why was this written and how did it get circulated among intelligent people? |
| #12 By 1401 (65.255.137.20) at 3/10/2006 11:23:16 PM |
| What intelligent people? |
| #13 By 13997 (69.109.9.15) at 3/11/2006 1:05:35 AM |
|
#9...
I'm not sure, but I have a fair idea it has a lot to do with your general lack of knowledge when it comes to when OS' were released. Red Hat Enterprise Linux 3 - September 2003 (http://www.redhat.com/en_us/USA/rhel/details/enterpriselinux3/) SuSE Linux 9 Desktop - October 2003 (http://en.wikipedia.org/wiki/SUSE) Windows Server 2003 - April 2003 ------------------------- Thank you for fact checking my numbers, but maybe you shoud review your work and not call into question my knowledge. Red Hat Enterprise Linux 3 - Was Announced September 2003 - not shipped or released then though. But I did mess the date up, as it did finally ship before the end of 2003, even though they didn't meet their original October projected release dates. SuSE Linux 9 Desktop - It does say October 2003 in Wikipedia, but shame on me for not going by WikiPedia and instead going by the dates of the Installation packages, which as any person can see from ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/i586/ are 2004, not 2003. So even if there was a 2003 release, the testers from the article would have had to go back in time to obtain and download a 2003 release, as it wasn't shipped on physical media officially. However you are right about the comment on patches and administration, but your post just should of skipped trolling my post when you apparently have no idea of the facts yourself. This post was edited by thenetavenger on Saturday, March 11, 2006 at 01:08. |
| #14 By 12071 (203.158.60.13) at 3/11/2006 5:37:38 AM |
|
#14 "but your post just should of skipped trolling my post when you apparently have no idea of the facts yourself. "
Spare us all of your backtracking bullsh!t honestly! I gave links to all of my facts (with the exception of Windows Server 2003 which you can also get from wikipedia) which is a lot more than the guessing game you've been playing all day! You're the one who started the trolling with this wonderful number: "Wow, the latest releases of two alternative OS that are pretty much updated, compared to an OS released in 1999, one release in 2001, and one in 2003." Then you decided to inform us all of how Red Hat was released in 04/05 which you just now changed to 03. Pick a year, any year! For your information, the wikipedia page states that it was released on October 22 2003 however given that the Red Hat page specifically stated "v.3 was introduced in September 2003 and will be supported until August 2010", I assumed it to mean that it was released at that time. Taking a look at the redhat ftp site (ftp://ftp.redhat.com/pub/redhat/linux/enterprise/3/en/) we find that the directories were created on the 22nd of October 2003 (with updates since then of course) pointing to Wikipedia as being the correct source of information. In any case, a month here or there doesn't make a lot of difference as I included a whole 6 months of difference between the releases of Windows Server 2003 and Red Hat/SUSE. There definetely wasn't a gap of 1 or 2 years like you wanted everyone to believe! Then you informed us of how SUSE 9 was released in 05 which you just now changed to 04 using the dates of the updates to the 64bit x86 edition as your "proof". You must take everyone here for an idiot that can't see through your FUD! Why didn't you give everyone the following link which quite clearly shows that the files for 9.0 were available in October 2003 with updates from then on?: ftp://ftp.suse.com/pub/suse/i386/9.0/ Feel free to look at the ChangeLog which lists every single change made since the October 2003 release. Oh that's right, becuase if you gave out that link then you'd have to admit that you were lying about being 2 years off! I guess a year or two is irrelevant when you're main goal is to spread FUD. Try learning what facts are before you start accusing others of being even remotely close to as clueless as you. |
| #15 By 32132 (64.180.219.241) at 3/11/2006 9:21:19 AM |
|
The study is completely bogus.
"Symantec determined the time to system compromise by utilizing data derived from Symantec’s honeypot system during the period spanning November 16 – December 31, 2005. Specifically, the average time before a system becomes compromised is calculated as the amount of time between when the computer becomes available on a network until an external connection originating from a malicious application is observed." Does Symantec list the "malicious application" anywhere in the report? NO! Does Symanec list which part of the install was compromised? NO! Could the compromise have occurred because they were running non-Microsoft software? YES! "The Microsoft Windows Web server configurations were deployed with their included version of IIS, DotNetNuke content management software, and MSDE, a version of the Microsoft SQL Server was used to provide database support." Since when did DotNetNuke become part of the Microsoft OS? Does the report list which application was compromised? NO! This is a bogus report issued by a company in direct competition with Microsoft and the setup of the systems is extremely suspect and alleged compromises are not documented anywhere. |
| #16 By 26496 (67.163.251.151) at 3/11/2006 9:21:48 AM |
|
bobsireno you obviously haven't been to our enterprise... Secondly in our enterprise we have out of about 6000 pc's still running Windows 2000 and about 1000 of those are still only on SP3. I work in their IT department and could just about put anyone to shame there, but it's not my job to do the obvious and believe me I've tried. I'm just a contractor and anything said by one of us is just through one ear and out the other. We just sit back and collect a pay check (Job Security) while all the MCSE likes run around pulling their hair out. It really is a sight to see... LOL.
Just so you know I work for one of the largest East Cost Power Companies... I won't name names. I'm one of about 20 people there that actually has XP SP2 up and running and Mozilla Firefox for browser and have absolutely NO issues compared to the rest of the organization... Once Vista arrives I'm sure I'll be on that - this place is so afraid of change that it would make your head spin. I think the article was right on and I'm not a Linux buff either but I do agree with one poster who stated of course this would be the case because of the sheer numbers of people on Windows compared to Linux. I don't think many people realize how many organizations are still on Windows 98SE or even WinNT 4.0 SP6a for that matter. I think people on this site have a tendancy to think Linux fanboys just write stuff like this to get the panties in a ruffle for the Windows folks but with reading this article, IMO it was to point out the fact that PATCHED OS is the key. Most home users and I know this for a fact of constantly reblasting peoples PC's for them that they (They being 80% of those on Windows) must not even know there is a thing called Windows Update??? We (Being those who would even frequent a site like this) = the 20% of those that have a clue about Windows but you can't just throw EVERYONE into that mix and think that what they were trying to show was that most who put an OS on their system (The NOT KNOWING) even put a SP on their system unless it's included with the Installation CD by default. This post was edited by Cellar Dweller on Saturday, March 11, 2006 at 09:37. |
| #17 By 32132 (64.180.219.241) at 3/11/2006 9:26:41 AM |
|
"The Redhat Enterprise Linux Web server configuration was deployed with
Apache, Mod-PHP, MySQL and PHPNuke." Which version of PHP? An up to date patched version? THEY DID NOT SAY! If not, each of those machines would have been compromised since PHP is vulnerable to numerous worms. Here is an example: http://isc.sans.org/diary.php?date=2004-12-26 A php Internet worm released on 12/25/2004 that doesn't use php bulletin boards - it attacks "ALL php scripts/pages which are vulnerable to a "File Inclusion" Flaw". K-OTik Security has issued an Alert to clarify issues relating to whether or not php worms commonly named santy.c and santy.e attack bulletin boards. They have demonstrated that a php worm released on 12/25/2004 and commonly called santy.c and santy.e has had incorrect information associated with the descriptions of it that may delude you into thinking that, since you do not use php bulletin boards, your server is not at risk. K-OTik Security has named this the PhpInclude.Worm and their alert is emphatic that "This worm attacks ALL php scripts/pages which are vulnerable to a "File Inclusion" Flaw (related to an insecure use of the Include() & Require() functions). This post was edited by NotParker on Saturday, March 11, 2006 at 09:31. |
| #18 By 23275 (68.17.42.38) at 3/11/2006 2:05:00 PM |
|
Last night I wrote a two page/thread post relative to this article and dumped it - it just didn't seem like it would help. I thought, "Sleep on it...offer something that might be more immediately useful..."
Forget all the conventional arguments. Just know a couple of things, in reality, and I do mean in ways that a user or admin cannot possibly recognize, any *nix connected to any public network, can be rooted and so deeply that all but the most skilled scientists will not be able to tell. The opposite is true of Windows - it is practically impossible to root a Windows box in a way that can be concealed from even lay persons. That is an enormous difference and advantage that does go to Microsoft. One has to forget the conventional arguments for a moment, and look deeper into how each OS type [both monolithic], is designed and operated. One thing - for God's sake, if you run any *nix, please do not put compilers on production machines - most *nix operators and devs do and when they do, they offer criminal scientists the means to quietly recompile the kernel - inclusive of their code. They will very quietly use a tiny portion of that system's resources - much like a very mild infection and its symptoms will become "normal" "chronic" and "accepted" conditions present in humans - sinus trouble for example.... people just live with it and rarely work to discover why.... Well, the real threat to all of us is far more sinister than most can imagine at all levels, so much more subtle than people can know. Please know that very serious and learned people have been expert at rooting *nix for many decades and if you do not know exactly what you are doing and how to secure it, know that someone who does will root you in usually less than 30 minutes and in ways that as a new *nix user, it is unlikely that you will notice. You can flame away if you like, but it won't change what is known by agencies [friend and foe alike], and has been for years. Do not rely upon the distro's to do the securing for you - most of their SSH packages are little more than screen doors and again, please, please, please.... DO NOT put tools on the *nix that you have facing the public networks. I am very tired of beating back attacks that come from *nix servers/clients that have been rooted to the gills and operated by people that have no clue about it. If you wish to run a Linuces, please consider the hardened versions publicly distributed by the NSA - they built it for free because they were afraid business in the US and Canada would move from commercial Unices to Linuces. If you use Next [Apple], be dern sure you are behind an ICSA Group IV approved Proxy [a firewall will not help much or for long] - better still, stay off the net, entirely. |
| #19 By 23275 (68.17.42.38) at 3/11/2006 2:05:35 PM |
|
I know many of you will be very upset about this post - I care less about what you think of me personally and a lot more about what people do that can so negatively impact all of us. A lot of extremely brilliant people have worked this problem from both sides and with trillions of dollars for longer than most people posting here have been alive. They do know the *nix so well and so many undisclosed and apparently undiscovered exploits are available that it is regarded as casual. You cannot trust packages, either. The systems that store them are just as vulnerable and nice, but very naive people suspend a strange type of disbelief about *nix and security. You must remember the definitions of two words - covert... someone did something and we know it, but do not, or cannot confirm who did it... and clandestine...someone did something and we have no idea that it was done, much less who did it.
Exploits against Windows come in the first form - exploits of the *nix are of the second type and they always have been. One cannot begin to think they can know a *nix - even those building variants use tools that they do not fully understand. Be certain that "the bad guys" do - they built the tools themselves! I fought these guys for years - winning once in a while but also getting my ass handed to me most of the time - they're many more of them than most people can imagine and they don't have a favorite OS - they just want money - yours, mine - all of it. Oh, and they do hate Windows...they can't root it in ways that can be concealed for long and they lose the "asset" [that's what they call a rooted box], soon after. On a *Nix - they "sip" a name they use to describe what they do in practice - they sip resources like hot tea. Oh, "good guys" were so bent when the *nix gained increased use that many had nervous breakdowns - many just retired [myself included]. It wasn't politics - it wasn't business. It was resignation. Those of us that voted for controlled release [of net technologies], lost for the most part. Bad guys rejoiced and almost by mistake, Windows was and will likely always be, the most secure OS - not because of what is known, but because how what is not known becomes apparent. One last note - if you run a *nix and do get rooted, buy new drives. A rooted HPA will re-root the system the second you rebuild it and the sipping will continue. Save the links and rebuttal - there are none that are valid and on the net - that is controlled and scrubbed, too. This is one case where what we want to be so, just isn't so and no amount of affection for any OS is going to change that - and that is why Bill Gates' advocacy of advanced trust ID's is so relevant and correct - you think he does not benefit from the best in our business - that the US Govt. doesn't help??? Think again and for a moment, accept just how naive so many people are. |
| #20 By 8556 (12.207.222.149) at 3/11/2006 2:19:20 PM |
|
Celler D: I believe what you wrote even though its hard to accept that IT managers can be oblivious to the land mines that unpatched OS's are. You paint a scary picture of what may be a snapshot of the sad state of large corporate US management in general.
|
| #21 By 12071 (203.185.215.149) at 3/11/2006 5:51:28 PM |
| #21 Unfortunately the problem of running unpatched, unmonitored/unaudited OS isn't just limited to the US - the same thing is done everywhere, which makes it all the more scary. People don't realise that you can't just throw a computer onto the internet and be done with it (the only OS that comes close in that department is OpenBSD) and you haven't been able to that.... well ever! But a certain company we all know and love and market forces in general have sold computers as being so easy to use... just install the OS and you have yourself a server... until you put said server on the internet and have it broken into not more than 2 hours later! So the answer is quite simple... education! Stop telling people that it's easy and actually teach them how to secure their servers, ensure the default install comes with as little running services as possible etc etc. And that goes for every single OS. |
| #22 By 18227 (68.98.159.151) at 3/12/2006 3:17:55 AM |
| Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. Blah! Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. Blah! Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. Blah! Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. Blah! Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. Blah! Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. Blah! Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. Blah! Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. Blah! Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. Blah! Blah blahblah blah blahblah blah blah. Blah blah? Blahblah blah. Blah. Blah blah blah blah. |
| #23 By 8556 (12.207.222.149) at 3/12/2006 11:15:30 AM |
| #23: a bit limited in scope, but well said. |
| #24 By 26496 (67.163.251.151) at 3/12/2006 11:34:53 AM |
|
bobsireno - I wish it were all made up... LOL.
I'm sorry to say this but if you are talking about those idiots that sit above our IT department with Basket Weaving 101 Masters and or Bachelor Degrees, I can say this and it's fact about most Corporate IT Managers that I've ever worked for, is they are TOTALLY OBLIVIOUS of IT in general let alone a Windows or Enterprise environment. I also have friends working in other LARGE Corp environments and I hear the same exact things coming from them. It's very scary to think that these guys are making 6 figures or more to just keep the natives from getting restless and to keep order within the departments but as far as keeping the Infrastructure from collapsing? I'm not sure where they got their skills but they are driving IT departments to extinction and back to the BIG BANG!!! Our IT department is months away from a complete and total collapse and it's all due to those who sit in those nice cozy seats above those that have a minute clue. I just hope yours is faring much better than ours??? Yes they don't even know what Patch means unless it has to do with their basket weaving skills. They know how to wave their sticks (Laser Pens) upon the board and state this is the way things are to be done but yet they don't even know what they are saying has absolutely nothing to do with IT. Just a look at what I see on a daily basis - hope you've all enjoyed... LOL. This post was edited by Cellar Dweller on Sunday, March 12, 2006 at 11:42. |
|
Write Comment
Return to News |
Displaying 1 through 25 of 327 Last | Next |
The time now is
6:16:06 AM
ET.
Any comment problems? E-mail us |
