I hate to derail this into an offtopic discussion, but, uhh... you started it!
😀
~Shard~ said:
Regardless, I don't think you can simply dismiss their findings - I feel that they are of significant substance (of course not absolute) but again, my opinion, and everyone else is entitled to theirs. I'm just happy to be running on OS X/BSD, the world's most secure OS. 🙂
Actually you can dismiss their findings because their evidence simply does not support the conclusions at all. Saying that Linux accounts for 65% of all successful attacks is completely different from saying that 65% of Linux machines are successfully attacked. They present their findings as if the latter is true, when it's really the former. And the former case tells you absolutely nothing - zilch - without knowing the percentages of each OS represented overall.
If you look at
Netcraft, you can get a good idea of Unix vs. Windows, and gee whiz, Apache has about 70% of all web server installations! Microsoft accounts for 20%. Although Netcraft doesn't break down by specific Unix OS, you can guess that the vast majority of that 70% is Linux given its popularity. Hmmm... 65% of attacks are Linux, ~65% of web servers are Linux. Hmmm indeed! Could it be that mi2g's "findings" have nothing to do with security, but simply reflect distribution of different systems as internet servers?
Other people seem to think so:
From
http://www.networkworld.com/newsletters/linux/2004/1122linux1.html
What observers call the fatal flaw in mi2g's logic is that fact that its analysis of the 235,907 hacked systems it studied only reflects the market share of the various operating systems running on the Internet - not the technical strength of the systems studied.
...
Research showing BSD and Mac OS X are the least-hacked operating system does not tell you if the code in those products is stronger or weaker than Windows, Linux or any other platform - it just shows how little they are used on the 'Net.
Mi2g's response to this type of argument is this (from its Web site):
"When applying the benchmark of uptime on the full sample of permanently connected 235,907 machines, the mi2g ... found that the only computing environments left standing without the need for a single reboot at the end of the 12 month period were either BSDs or Apple Mac OS Xs ...
Wait. So they're using
uptime as a measure of how often a site gets hacked? I seriously hope somebody got confused when writing that last paragraph, because otherwise this is beyond laughable. If they are really trying to claim that, then apparently rebooting constitutes being hacked. I'll give them the benefit of the doubt and assume somebody made a typo or something.
Still, what good is this report when it (a) only reflects the general distribution of server types across the internet, and (b) apparently doesn't even include automatic attacks like worms and viruses?
From
http://www.theinquirer.net/?article=19665
"In pulling apart the limited amount of information that is given by Mi2g it seems that the company did not include automated penetration attacks in its study." Mi2g also failed to factor in viruses and malware, something that open source expert Bruce Perens told Linux Pipeline, here that it was "pretty ludicrous" when even its own study said that the financial impact of viruses on Windows is tremendously greater than the penetration on Linux.
So apparently the only conclusion I can possibly come to from their report is that the OS distribution of manual attacks against servers on the internet - sit down and brace yourself - follows quite closely
the OS distribution of servers on the internet. Wow. What insight!
The fact that they try to pass this off as some groundbreaking news that Linux is insecure is totally laughable. Let's see some real statistics, like percentage of all Linux machines that are compromised
in any way, manual or automatic versus percentage of Windows, OS X, BSD, etc, machines that are compromised in any way. I guarantee Windows wins that crown without a fight.
Sorry for the huge post... it'd be great if moderators could somehow make a new thread out of the half dozen or so posts on this subtopic. Now back to your regularly scheduled thread.
😉
