The Linux botweb story that wasn't ...
Summary: Late last Friday a story appeared on my radar that seemed interesting - it was about a botweb (a botnet made up of web servers) utilizing Linux web servers. Was Linux cracked? Would Linux fans have to wind in all their security bragging? Was the Linux fortress wall breached? Was the sky falling in?
Late last Friday a story appeared on my radar that seemed interesting - it was about a botweb (a botnet made up of web servers) utilizing Linux web servers. Was Linux cracked? Would Linux fans have to wind in all their security bragging? Was the Linux fortress wall breached? Was the sky falling in?
Short answer, no.
Slightly longer answer, no, no, no and no.
If there was a way that hackers could crack Linux web servers and use them to create an huge botweb, then that would be a very big deal indeed. Botwebs, since they use web servers rather than zombie home or office PCs, make a far more effective botnet since they have a better connection to the internet. The idea of millions of compromised Linux web servers causing all sorts of mayhem isn't a pretty picture.
Which is why the story was interesting.
But alas, this story doesn't have anything to do with Linux hacks, but instead comes down to basic security, or the lack of it. It seems that the hack comes down to bad passwords. Hackers regularly sweep the web looking for vulnerable systems, which is why good passwords are vital. If your passwords are weak then the system can, and eventually will, be compromised. It doesn't matter if it's Windows-based or Linux-based.
Normal "Linux is more secure than Windows" bragging can resume ...
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
One of the things that always confused me...
That doesn't seem to secure to me...
The short answer is yes.
Just remember. If someone cracks your password, it's not your machine anymore.
Thats what I was thinking
Although, having access to source code, could be more damaging, no?
Not so much.
Once the system is compromised, whoever compromised it (probably) has complete control. Access to source code only means that instead of copying a DLL to a cracked machine, the new owner can just have the changes compiled locally.
Separately, I may have failed to completely comprehend your initial question. Having access to the source code does not make it any easier to crack the password. Having access to the source code can make it easier to compile changes into the operating system once the system password has been cracked.
Sorry
No more damaging. Just a little different.
In either case the hacker owns the machine and can do pretty much anything they want with it.
Hacking a Linux box does give a finer degree of control over the internal operations of the OS than a Windows box though. One Linux machine I saw had been compromised. Certain files were no longer deletable as the hackers had modified the OS to prevent deletion of those specific files. The same effect could be made to happen on a Windows machine by replacing the executable file responsible for deleting files.
Already Answered, but in Other Words
executable of my choosing."
Editing the source and compiling it on every successfully exploited
target machine is a lot more work than installing a kit with
precompiled modules, libraries, and programs.
Also, just because a user could have source code on a system doesn't
mean they do. It is considered good security practice to not have the
source or any compilers installed on an outward facing server.
In summary, semantically, no difference. Practically, since it takes
more work to achieve the same effect and it assumes too much, the
bad guys won't go that way.
Passwords can be guessed
Which Is Why You Should Have a GOOD Strong One
Good password (over 20 characters, upper and lower case letters and number, random sequence) = effectively impossible to crack.
Default password? VERY easy to crack....
Source code has nothing to do...
I wasn't referencing
re: I wasn't referencing...
There are a few algorithms in common use and they are used across operating systems. see "Cryptographic hash function" on wikipedia.
It is possible to steal a password, or use a password guessing scheme to try to generate the hash, but cracking the hash, while remotely possible is, not as practical as other methods, like stealing one, guessing one, or exploiting a bug to break into the system and replacing the hash with your own. But you are already in the system, and one would assume you could break again without leaving such an obvious calling card.
The answer is no unless you are storing
The exception would be if you hardcoded your database connection password into your code. However, no one is going to hardcode a user's password into the OS code. That would mean that every user would have to have the same password or it would obligate users to memorize a randomly generated password for their kernel. Which means that the password would have to be generated with every download or install and then hardwired in.
So, having access to source code does not reveal passwords on a system. Having access to the datafile that contains the passwords whether it's a plain text file or a database table would give you access. However, unless someone's security is incredibly stupid, those passwords are going to be encrypted.
Incidentally, if passwords were stored with an operating system's source code then it's irrelevant whether you have access to the code or not. You can run Windows OS in a debugger and disassemble the code. It's illegal, but if you're a black hat you're not really concerned about legality.
Telnet port are only open...
If you need access to a computer, use a vpn and then strong password on top of that. Hackers are lazy. They go after the weak stuff.
Telnet is defaultly closed on Ubuntu...
I totally agree with you statement.
A botnet was still created...
RE:A botnet was still created...
That is an assertion. I can assert that the earth is flat, or the moon is made of green cheese. Same value.
Maybe I wasn't clear..
Apache 2.0.x - 40
Apache 2.2.x - 16
IIS 6 - 8
IIS 7 - 2
If I was to look at security issues with PHP v ASP.NET I am sure it will be even more in favour to Microsoft products.
Even so they are all good products and as I said before the security issues mainly come from poorly coded websites, sql injections, poor config and poor users.
Total number of advisories ...
Not at all.