Windows IT Pro is the leading independent community for IT professionals deploying Microsoft Windows server and client applications and technologies.
  
  
  Advanced Search 


November 04, 2004

Study: Linux Is Least Secure OS

RSS
Subscribe to Windows IT Pro | See More Security Articles Here | Reprints | Or get the Monthly Online Pass—only $5.95 a month!

According to a study the British security firm mi2g, Linux is the world's "most breached" OS and is exploited more frequently than Windows. The company recently analyzed more than 235,000 successful attacks against computers that were permanently connected to the Internet during the past year and concluded that Linux was responsible for most of the successful exploits.
  
"For how long can the truth remain hidden, that the great emperors of the software industry are wearing no clothes fit for the fluid environment in which computing takes place, where new threats manifest every hour of every day?" DK Matai, mi2g's executive chairman, said in a statement. "Busy professionals ... don't have the time to cope with umpteen flavors of Linux or to wait for Microsoft's Longhorn when Windows XP has proved to be a stumbling block in some well-chronicled instances."
  
According to mi2g, Linux-based computers accounted for more than 65 percent of all successful electronic attacks during the past year, whereas Windows-based systems were responsible for only 25 percent. Attacks against Berkeley Software Distribution (BSD)-based systems were successful less than 5 percent of the time. However, it's worth noting--although mi2g didn't--that BSD-based machines make up a small percentage of the installed base of permanently connected machines. In all probability, those machines weren't attacked simply because there was little incentive to do so, not because of any inherent superiority over Linux- or Windows-based systems.
   
The mi2g study also analyzed the impact of malware during the same time period and found that most malware attacks--about 60 percent--successfully targeted small businesses, whereas about 33 percent successfully targeted home users. Only 6 percent of malware attacks successfully targeted midsized businesses, whereas 2.5 percent successfully targeted enterprises, government agencies, and similar firms. According to the company, 459 successful malware attacks occurred during the past year, most of which targeted Windows-based systems. Malware rarely targeted BSD-based and Linux systems.
  
These electronic attacks are taking an economic toll. The firm says that electronic attacks such as Distributed Denial of Service (DDoS) attacks caused as much as $123 billion in damages during the past year. Malware attacks were responsible for $202 billion in damages during the same time period.

End of Article



Reader Comments
Stupid bloody Americans with no security and buggy software

Anonymous User November 04, 2004 (Article Rating: )


Nice spin, Paul.

Let's quote directly from the mi2g study:

"London, UK - 2 November 2004, 02:30 GMT - The most comprehensive study ever undertaken by the mi2g Intelligence Unit over 12 months reveals that the world's safest and most secure 24/7 online computing environment - operating system plus applications - is proving to be the Open Source platform of BSD (Berkley Software Distribution) and the Mac OS X based on Darwin."

Yeah. How about some HONEST reporting, Mr. Thurrott?

WinThose November 04, 2004 (Article Rating: )


C'mon, let's anylize this information realistically here. The majority of "permanently connected" systems are what? Web servers, right? So, Linux in this context is the largest attack surface, the frontline if you will, so they will inevitably be the hardest hit. Then you notice that medium and large businesses are the least hit. That's because they have people who know what they're doing. I can't tell you how many times I've gone to a site to see the default Apache "congratulations" page come up. I'm not a hacker, but that is basically a welcome mat that says "hey, come on in, the door's open."

So, it's not the OS that's to blame here, it's the people who don't know what they're doing.

Everybody and their mother knows that Windows is vulnerable, and, without having read the report, I'd guess that those malware attacks that caused "$202 billion in damages" were primarily directed against the Windows systems.

I too am sorry to see this spun in such a way to try and make Windows look more secure than Linux.

greglara November 04, 2004 (Article Rating: )


For a writer to seriously claim such false evidence, for the sake of face, in one word is- appalling. Good reporting is reporting the truth. It is this kind of reporting that the UNIX and UNIX-Like communities look down on Microsoft and it’s supporters.

To counter your claims: My family for the most part is largely Linux savvy. But, for school, the sisters must use Windows. IBM’s new laptops come with a OEM install of Windows XP Professional, this is fine - no work on my part. Within ONE DAY of use at school, for about four hours, the sisters’ laptops were infested with over 200 ad-ware infestations and two viruses, one of them being a “Trojan horse.”

I have a default install of Gentoo 2004.2 and have been running it completely exposed to the Internet and it has not once been “infected” or compromised. Please, for he sake of you and your already-damaged reputation, bake your findings with REAL facts and perhaps some real personal experiences.

Anonymous User November 04, 2004 (Article Rating: )


I've been running a default slackware 10 install connected 24/7 to internet without problems for months. But if you connect a windows 2k without firewall and antivirus it can last about 5-10 minutes without being attacked and infected by any worm/trojan

Anonymous User November 04, 2004 (Article Rating: )


Hey Mr slackware 10 install,
Try running a slackware install from 4 years ago and see how long it lasts.

Install XP w SP2 and you're all set. Quit comparing yourself to old software to try to make yourself feel good.

Anonymous User November 04, 2004


Firstly people: Paul is just reporting the news, he didn't create this report. Next: Why is it impossible for this report to be true? Obviously the people releasing this knew they'd be the brunt of slashdot type venom and you would think they checked and rechecked their findings before releasing them. Lastly: Get over it.

DrestinBlack November 04, 2004 (Article Rating: )


Hey Greglara, you are obviously not a programmer but that's not important. My comments: It doesn't matter if linux has a "bigger attack surface", it's either more vulnerable or not. If it's in vulnerable than being attacked 10 times or 10 million times won't make it less vulnerable.

Your comments about Apache don't really add up to help your side either. You are indicating you believe that default installs of apache are vulnerable to everyone and his mother out of the box. Wow, I'll bet apache would be bumed to know that. (small note: It has not been recorded anywhere that IIS6 has been exploited since it's release, can any other web server make that claim). Lastly, Paul didn't "Spin" anything, he just reported the findings of another companies research. Go talk to mi2g and complain to them with proof of the flaws in their methodology - I suspect you'll need more than anecdotal evidence.

DrestinBlack November 04, 2004 (Article Rating: )


To Annonymous with the linux savy family: Good for you! TOo bad your sisters are too stupid to turn on the built-in firewall (or have SP2 with it turned on by default) and have ignore all windows reminders to do so. However, something more important to note: you provide anecdotal evidence. You, one user. mi2g tested hundreds of thousands of events; do you think your 1 report can overturn the results of thousands of reports? Think again.

DrestinBlack November 04, 2004 (Article Rating: )


There is some spin going on here, but then again, who helps this magazine pay its bills? Who will pull back the toys from the writers if they cross the line in evaluating the software? Any of us who read these articles or who subscribe to this magazine should already know that.

As for MS v. Linux, let me advance this to you all. Stop the brand-whoring, okay. The bottom line here is causality. Ask yourselves what causes these security breaches to happen on either platform in the first place? Is it a case of one type leaving vulnerabilities for the sake of ease-of-use? Is it the case of another brand being based on open-source thereby allowing shoddy and and careless programming to take place? In general, is it the fact that the PC world is so diverse that in order for all of this diverse hardware and software to work, that vulnerabilities are inherent? Are corporate intersts sacrificing security as a cost-savings measure? Finally, have corporate interests invented and perpetuated a problem so that a solution could be sold to the public; the "Make a Need to Sell a Better Mouse Trap so You Should Provide the Better Mouse" Theory.

Some of these may seem crazy, but as a whole, all of these questions are not far-fetched. In the end, it all boils down to this computer stuff being a faily new technology and minds and social habits need to catch up.

NetMangler November 04, 2004 (Article Rating: )


 See More Comments  1   2   3   4   5   6   7   8   9 

You must be a registered user or online subscriber to comment on this article. Please log on before posting a comment. Are you a new visitor? Register now




Top Viewed ArticlesView all articles
2009 Windows IT Pro Editors' Best and Community Choice Awards

Picking a favorite product from an impressive crowd of competitive offerings is never an easy task, and such was the case with our Editors' Best and Community Choice awards this year. ...

Command Prompt Tricks

One reader shares his tip for setting up the command prompt to reflect a remote path. ...

WinInfo Short Takes: Week of November 23, 2009

An often irreverent look at some of the week's other news, including some post-PDC some soul searching, a Google Chrome OS announcement and a Microsoft response, Windows 7 off to a supposedly strong start, the Jonas Brothers and Xbox 360, and so much more ...


Security Whitepapers Reducing the Costs and Risks of Branch Office Data Protection

Solving Desktop Management Challenges in Healthcare

Solving Desktop Management Challenges in Education

Related Events Introduction to Identity Lifecycle Manager "2"

SQL Server Security: How to Secure, Monitor & Audit Your Databases

Protecting Mobile Users' Data

Check out our list of Free Email Newsletters!

Security eBooks Spam Fighting and Email Security for the 21st Century

Understanding and Leveraging Code Signing Technologies

A Guide to Windows Certification and Public Keys

Related Security Resources Introducing Left-Brain.com, the online IT bookstore
Looking for books, CDs, toolkits, eBooks? Prime your mind at Left-Brain.com

Discover Windows IT Pro eLearning Series!
Clear & detailed technical information and helpful how-to's, all in our trademark no-nonsense format


Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro DevProConnections IT Job Hound
Left-Brain.com Technology Resource Directory asp.netPRO ITTV Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 © 2009 Penton Media, Inc. Terms of Use | Privacy Statement