Slashdot Log In
Breakdowns of Website Defacement by Platform
Posted by
CmdrTaco
on Sat Mar 15, 2008 08:53 AM
from the something-to-think-about dept.
from the something-to-think-about dept.
SkiifGeek writes "Zone-H have recently posted the statistical breakdown of the collected website defacements from the last few years. Surprisingly, in 2007 more Linux servers suffered a successful attack than all versions of Windows, combined. Similarly, more Apache installations were successfully attacked than all IIS versions combined. A day after posting this data, Zone-H have questioned the appropriateness of continuing to operate the archive. Despite the valuable information that can be gleaned from the service, it may soon be lost to the world. The natural successor to the now-defunct Alldas archive of defaced websites, Zone-H's archive maintains records of over 2.6 million defaced sites but may be shut down due to the continuous accusations of impropriety leveled against them any time they disclose and mirror a reported defacement."
Related Stories
[+]
IT: 2M New Websites a Year Compromised To Serve Malware 72 comments
SkiifGeek writes "Sophos claims that they are detecting 6,000 new sites daily that have been compromised to serve malware to unsuspecting site visitors, with 80% of site owners not aware that they have been compromised — though this figure is probably on the low side. With increasingly vocal arguments being put forward by security experts criticizing the performance and capability of site validation tools (though many of these experts offer their own tools and services for similar capabilities), and rising levels of blended attacks, perhaps it is time you reviewed the security of your site and what might be hiding in infrequently used directories."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Websight?? (Score:5, Funny)
Re: (Score:2)
Its because the editors looked at the archive, and got defaced. They're only now discovering that it's a great way to distribute malware - they even ARCHIVE it for you!
Re:Websight?? (Score:5, Funny)
Parent
Re: (Score:2, Funny)
Re: (Score:2, Funny)
Re:Websight?? (Score:5, Funny)
Sometimes the web surfs back.
Parent
Re:Websight?? (Score:5, Funny)
Parent
Re: (Score:3, Funny)
Hopefully not missing something... (Score:5, Funny)
Re: (Score:2)
You'd actually be doing the world a favor by defacing websight.com [websight.com] - it's another one of those "linkfest pages".
"Surprisingly"? (Score:5, Interesting)
Re:"Surprisingly"? (Score:5, Insightful)
Parent
It's worse than that.... (Score:3, Insightful)
This definitely has no relation to platform.
Re:Yeah, yeah, yeah, wrong. (Score:4, Insightful)
1. Attack against the administrator/user (password stealing/sniffing): 141.660
2. Shares misconfiguration: 67.437
3. File Inclusion: 61.011
4. SQL Injection: 35.407
5. Access credentials through Man In the Middle attack: 28.046
(Those are the 2007 numbers)
That's a total of 333,561 total intrusions, and not one of those is due to inherent insecurity in anything. They are all configuration problems or bugs in the web apps themselves. And that's about 70% of the intrusions. Plus, many of the other attack vectors were of the same class. Only 13,405 were "web server intrusions" which is about 3%. If you take "RPC Server Intrusion" and "Other server intrusion" together as platform bugs (and I'm guessing most aren't), then you still only end up with another 3%.
Therefore, all this story tells us is that the software industry has to do a lot of work to protect users from themselves. It doesn't tell us that Apache or IIS or Windows or Linux is more secure than something else. It tells us users suck at security and programmers suck at making security simple.
Parent
Re:"Surprisingly"? (Score:5, Informative)
Parent
Re: (Score:3, Insightful)
Re:"Surprisingly"? (Score:5, Insightful)
It still makes sense because the bulk of successful attacks on webservers result from attack methods that are not platform specific (Attack against the administrator/user (password stealing/sniffing), Shares misconfiguration, File Inclusion, SQL Injection etc).
The bulk of successful attacks against Windows, at least until very recently, have resulted from OS flaws.
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Hmm.. I though here in Slashdot many people deny that there are more succesful attacks in Windows just because it is the more popular platform.
Not everyone. I'm not a fan of windows, only because I find Linux more responsive and easier to use for my programming. I agree with you however that there is a double standard here. People who bash Windows (where it's not warranted) get modded insightful, However when they try to defend Windows [slashdot.org] it's flamebait or troll. I'd go on a rant but I just wanted to say not everyone screams Windows security sucks yadda yadda yadda
Re:"Surprisingly"? (Score:5, Funny)
Parent
Re:"Surprisingly"? (Score:5, Insightful)
A platform that is reasonably popular or otherwise interesting, and unsecure by design will be attacked. A more secure platform, which is also reasonably popular or otherwise interesting, will get attacked less.
Now, looking at the attack method table, it's obvious that in a case of defacement, the underlying web server platform is largely irrelevant. Web sites these days are complex arrays of application logic and databases. Rarely does a large web site consist of a web server dealing out static files. This change enables more dynamic content and easier content administration than before; then again, it adds several places where things can go wrong. What the Zone-H statistic really tells is that in a complex setup where there are components that can be compromised, the front end web server is usually running Apache. This tells nothing about its security, since it's usually not the front end web server software that is compromised.
Now, if the site included common web applications and application platforms in its reporting, the statistics would have much more value.
Parent
Re: (Score:3, Insightful)
Of course windows gets attacked more because it is more popular. Nobody is denying that. However, it's not *JUST* because it is popular. It's the ratio of successful attacks to attempted attacks that people have a problem with. Windows has historically had a high ratio, meaning it was easy to crack into. Security holes used to remain open for months, or even years,
Numbers! (Score:5, Insightful)
The article says that there were 1,485,280 Apache defacements and 815,119 IIS defacements. This implies a total of 2,300,399 samples, of which 64.6% were Linux. For comparison, other posters here have cited a Google survey reporting that 60% of webservers run Apache. That would seem to imply that, if you pick an IIS server at random or an Apache server at random, each is about as likely to be successfully attacked as the other.
Conclusion: IIS is just as good as Apache (contrary to popular Slashdot opinion). Of course, there's a flip side: Apache is just as good as IIS -- and it's free.
[Take all this modulo the fact that 370% of statistics are, if not made up on the spot, at least full of so much noise as to be meaningless. (Sometimes the Law of Large Numbers really does require large numbers!]
Parent
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
FYI The article does (Score:5, Funny)
Weighted for market share? (Score:5, Insightful)
To pick an arbitrary statistic, in June 2007 Google reported Apache with a 66% market share and IIS with a 23% share (source [blogspot.com]). Given that the TFA lists "Attack against the administrator/user" as the most common attack method by a wide margin, and it seems to me that both Apache and IIS would be equally vulnerable to dumb administrators, wouldn't it make sense that the server with the larger market share would see more attacks?
Re:Weighted for market share? (Score:5, Funny)
If this trends continues, there will be negative fourteen thousand defacements of Windows 2000 this year -- that is to say fourteen thousand anti-defacements. Fourteen thousand webmasters hosting on Windows 2000 will find their sites say what they meant to say, despite their having actually said the wrong thing.
It's like having an operating system that, instead of asking "where do you want to go today?" simply tells you where you ought to go.... Oh,wait.
Parent
Re: (Score:2)
And that's 66% overall. Now think what proportion of the sites containing homebrew or 'small scale'* open source blogs, wikis, content management systems, being managed by amateur/unpaid/hobbyist webmasters are likely to be running on the free Lunux/Apache platform rather than paying money for IIS?
...and the sa
Re: (Score:3, Interesting)
But neither of them is really measuring market share; they're measuring share by domain, not server. So if you assume that one OS has more domains on it, on average, than the other, then its "market share" is proportionally less than the numbers in the survey. Personally, based on what I know about the hosting market, I would assume that Apache servers have
Demographic breakdown (Score:5, Insightful)
I guess IIS users on average are better at maintaining a server, as they probably are employed to do so.
It would be interesting to see a "demographic" breakdown on defaced servers, how many corporate Linux servers have been defaced. I believe the numbers will be different.
!Apache, but PHP (Score:5, Insightful)
When the cure (more often than not these days) involves not having to disturb Apache at all (save for possibly changing something in httpd.conf), but instead fixing/dumping the bad script that let the baddies in, or patching PHP to plug the hole in it, then odds are good that it ain't Apache's fault, no?
To be fair, it would also be like blaming IIS for crap XML or ASP script, and MSFT would certainly waste no time in saying so.
Re:!Apache, but PHP (Score:4)
Parent
Re: (Score:3, Informative)
At my work, we see a bunch of attempts to exploit PHP every week, usually like this:
(we don't even use PHP, so this is probably coming from other hacked servers that are running php)
The "feature" they are trying to exploit there is just crazy:
If var in that case is used as a file name in a script load call, PHP will happily download the script from that website and run it instead of the local file that was ex
famous quote (Score:3, Funny)
Re: (Score:3, Funny)
And most successful attacks.... (Score:2)
Summary skewed. (Score:4, Interesting)
There are far more honda civics successfully stolen in the USA than BMW Isetta's Or Smart TwoFours This is because there are well over 5000 civics on the road for every BMW Isetta or Smart TwoFour on the road.
By the summary's mention and what it is alluding to, BeOS servers are the most secure because NONE of them have been compromised on the internet.
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:3)
Now that the shoe is on the other foot, so to speak, apparently having a larger marketshare is significant. I will find it very interesting to see who puts their hands up and admits that such exploits are mos
Re: (Score:3)
Linux X Windows?? (Score:2)
Re: (Score:3, Funny)
Re: (Score:2)
Why is it that I think this website security .... (Score:4, Insightful)
Using regular backup methods and unauthorized access alarms (access alarms that are either verified or not as a matter of access notification loops).
So when a site gets hacked there is timely notification and backup usage.
In other words, should access happen but not getting verification within a set amount of time, reverts back to the pre-unverified access state of the site.
perhaps we can write this in PHP or python?
Interesting (Score:5, Insightful)
Then a statistic that comes out that shows Linux/Apache at the top of a security vulnerability list, and it's immediately "Oh it's the users! They don't know how to implement the platform properly! It's the scripting language they used! These numbers are meaningless without marketshare values!"
What we have as facts when it comes to security vulnerabilities:
1. When more people use it, there is a tendency to have more security vulnerabilities since more eyes are scrutinizing what is or isn't possible with that platform.
2. No matter which platform, it is only as secure as the person's implementation. If they don't know how to configure the system properly, it doesn't matter in the end.
So why all the hate against Microsoft for their products if these same problems affect all platforms?
Re: (Score:3, Insightful)
Whose fault is it that Windows architecture suffers from viruses and worms. Microsoft and only Microsoft. Whose fault is it that an Apac
More apache, more linux - function brings danger (Score:3, Insightful)
When you allow larger flexibility of doing things, you open doors.
PHP allows you to do ANYthing, including remote includes and relative and absolute includes (../whatever.php or
What I am trying to say, is that I am 90 percent sure, most of the defacements came from badly written code, such as index.php?news=page.php, and the include($_GET[page] kind of ignorant coding. Did I do that unthinkingly? OH yes. Everyone does, but then you learn.
Same with linux. Many people I know have servers with ssh and FTP enabled with super safe passes:
My favourite :
Company name: Heartless Buthcers LTD
Login: Heartless
pass: Butchers
Also I write a script in 5 minutes that logs into remote systems that do this and that with scripting, but I am in trouble doing anything on a remote access login to a gui, which is hardly scriptable (OK maybe that is my lack of knowledge of Wintel systems.
Just my 2 cents: with flexibility you open doors, and I think that is where it all boils down in this case.
Netcraft confirms it (Score:4, Interesting)
Take a look at the "Webserver defaced" table. It's badly formatted in a couple of respects. Here's a copy of the interesting data with defacement numbers sorted by server platform:
nginx 729
IIS (total) 447
Apache 319
Rapidsite 244
SonataServer 178
nginx doesn't run on Windows; I'd expect most sites deploying it would be on Linux or BSD. Rapidsite runs on a customized Apache, and again while I haven't found a definitive statement here I'd expect virtual hosting using Apache is going to be Linux or BSD as well. I'd welcome corrections here if I'm wrong about that.
Combine this with the Netcraft data [netcraft.com] and the initial conclusion I would reach is that Linux+Apache is still the most secure platform. The only reason the Linux numbers are so inflated is that they include some really crappy web servers with significant vulnerabilities running something other than stock Apache.
I wish I had the raw data so I could ask some more interesting questions, like how things change you take the stupid user/admin data out. I don't care that it's possible to setup a platform up wrong and get simple vulnerabilities, I only care about how vulnerable a good installation is.