Linux Most Attacked Server

yeah... linux.

[digitalghost]

Microsoft Windows may be dominating the headlines for security-related breaches but the open-source Linux server operating system remains the biggest target of overt intruder attacks...

Full Story [internetnews.com]

[Marcia]

>>12,892 Linux online servers running eBusiness and information sites were successfully breached. During the same period, 4,626 Windows servers were victims of successful intrusion.

How about ratios and percentages? How many Linux servers are there out there, and how many Windows servers?

Another missing piece of data is how many attempts were made altogether against one type as opposed to the other, relative to the total number out there, so what percentage of attempts on each was successful?

There was once a similar article posted about; that one had a decidedly slanted approach in reaching there conclusions.

It's kind of hard to judge the objectivity or accuracy without having all the information for comparison, which that article doesn't provide.

[brotherhood of LAN]

>objectivity or accuracy without having all the information for comparison

It doesnt mention number of servers on the web and their OS, but this stat is interesting:

14% of attacks were aimed at linux machines / 51% percent of all successful overt digital attacks were linux.

All other things being equal doesnt that suggest that if an attack were to happen, if its linux its more likely to be successfully attacked?

[abbeyvet]

14% of attacks were aimed at linux machines / 51% percent of all successful overt digital attacks were linux.

All other things being equal doesnt that suggest that if an attack were to happen, if its linux its more likely to be successfully attacked?

Not really.

For one thing there are well more than twice as many Linux servers than there are Windows, so while the percentages may be similar that would, broadly, mean an attack on a Windows machine was 21/2 times more likely than one on a Linux machine.

Also it does not specify the spread of the attack - are 20 successful attacks on one machine counted as 1 attack or 20?

Nor does it distinguish between the nature, severity or duration of attacks.

[ShawnR]

14% of attacks were aimed at linux machines / 51% percent of all successful overt digital attacks were linux.

All other things being equal doesnt that suggest that if an attack were to happen, if its linux its more likely to be successfully attacked?

I think you are misinterpreting the data. The way I read it, the article says:

• Overall 51% of all successful overt digital attacks were against linux servers.
  
• In government environments 14% of all successful overt digital attacks were against linux servers.
  

So what does this mean?

• If its linux, its more likely to be successfully attacked? NO
  
• If its in a government environment, linux is safer? NO
  
• Government departments have more competent linux administrators? NO
  

Without knowing more detailed statistics you can't derive anything from these figures. For example, what are relative proportions of linux vs Wintel vs other servers out there? Without this you can only generate conjecture. So to add to the conjecture, here is mine: Linux was attacked more often because there are far more linux servers out there connected to the Internet. Even in environments which are completely Microsoft dominated internally, the norm is to use a linux machine as the firewall and for other functions within the demilitarized zone (e.g. mailserver, webserver, etc).

[brotherhood of LAN]

>misinterpret

Indeed, I think I skipped the line about it being within the gov. realm thanks for reading more closely I stand corrected ;-)

I suppose as linux popularity increases so does exposure and security threats increase, regardless of the OS.....I'm not the one to start the scaremongers about it tho! ;)

[plumsauce]

one readily available source of statistics for the relative proportions of O/S's employed as web servers is available
at netcraft. while these are not absolute numbers, the
survey population is large enough to be acceptable in
assessing orders of magnitude.

it stands currently at about 2.5/1 linux/windows in
non ssl sites. windows usage is higher in ssl site
usage. they do note the skewing due to the presence
of parked sites numbering in the thousands on single
servers.

the article is refreshing in that it highlights that
linux is not as impervious to attack as linux proponents
like to suggest. 12,000 sites in a single month is a
number that cannot be ignored easily.

as always, server security is dependent on the degree
of skill possessed by the particular administrator.

++++

[bird]

This topic has come up before.

[webmasterworld.com...]
[webmasterworld.com...]

Not surprisingly, it's almost impossible to get at any hard figures. "Reported attacks" is not a useful measure of security. The only thing you need to worry about is whether your own system is configured to be secure, no matter what OS it runs.

(Ok, in the times of rampant worms and distributed attacks, this isn't entirely true anymore, but let's not divert this thread from its original topic too much).

[bcc1234]

What the data means is:
There are more than enough unqualified/underpaid linux admins who spend their day bashing MS on slashdot telling everyone (including themselves) that point-and-click environments only create visibility of ease of use and a false sense of security, but the command line approach with it's flexibility and transparency combined with access to sources is the real thing - all while their own boxes are getting owned.

Well, it's nothing new really :)