Linux holds out against attackers

The data, from a dozen networks, showed that the average Linux system lasts three months before being compromised, a significant increase from the 72 hours life span of a Linux system in 2001. Unpatched Windows systems continue to be compromised more quickly, sometimes within minutes, the Honeynet Project report stated.

The results are probably due to two trends, said Lance Spitzner, president of Honeynet, which develops software for deploying computer systems as bait for online attackers. The default installations of new Linux systems are much more secure than previous versions of the open-source operating system, he said. Secondly, attackers seem to be much more concentrated on Windows systems than on Linux systems, and on attempting to fool desktop users, of which the vast majority use Windows.

"Everybody is focused on Windows," Spitzner said. "There is more money [for an attacker] to be made on the Windows systems."

The study is the latest data on the relative security of Linux systems versus Microsoft Windows. Last week, students found dozens of flaws in software that runs on Linux systems, and a research report stated that a thorough analysis of the Linux kernel turned up hundreds of flaws. However, in relative terms, those numbers are low compared to commercial applications.

Honeynets, a term coined by the project, are networks of computers that are placed on the Internet with the expectation that they will be compromised by attackers. The networks are heavily monitored, and the data is used to research the latest tactics of online miscreants.

While some of the Windows XP systems on the honeynets used for the latest study were compromised within minutes of being placed on the Internet, newer versions of the Linux operating system from Red Hat failed to be compromised by random attacks for more than two months.

Debbie Fry Wilson, director of product management for the security response centre at Microsoft, told ZDNet UK sister site CNET News.com that the company's latest operating system is more secure than the report suggests.

"While it is not clear which version of Windows was used during the study, we feel that a Windows XP SP2 configuration with the Windows firewall enabled is the most resilient client operating system available in the market and can withstand attack much longer," Wilson said. "We are pleased that the report indicates that two Windows-based honeynets in Brazil withstood attack for several months. However, we are not certain that the report provides conclusive data based on a controlled and scientific study comparing the two operating systems."

Every Windows system compromised during the study had its security breached by a worm.

However, Spitzner stressed that the Honeynet Project does not have enough Windows systems deployed to offer meaningful data on that operating system's security. Moreover, the report does not specify what version of Windows XP had been running on the systems that had been compromised and whether any Service Pack upgrades had been installed.

The study did find that more recent versions of the Linux operating system lasted longer on the Internet without patching.

Related Articles

• Japanese Wireless Operator Invests In US Linux Vendor
  Thursday, 23 December 2004



• Matrox Parhelia Supported By Accelerated-X Linux Drivers
  Wednesday, 22 December 2004



• Azalea Software Announces Mac OS-X Linux and Unix Versions of Their Popular Bar Code
  Wednesday, 22 December 2004



• Novell Partners See Growth in Demand for Linux and Identity Services
  Wednesday, 22 December 2004



• Wal-Mart Breaks Price Barrier with 498 Dollar Linux Laptop
  Tuesday, 21 December 2004



• Sub300s 164 Million Computer Challenge- Switch to Linux
  Tuesday, 21 December 2004



• Vibrens Accelent DevkitIDP Reference Design Now Supports Embedded Linux
  Monday, 20 December 2004



• Sub300 com Announces the Worlds Lightest Linux Notebook Computer
  Sunday, 19 December 2004



• Novell Partners See Growth in Demand for Linux and Identity Services
  Sunday, 19 December 2004



• OSDL touts Linux market forecast
  Friday, 17 December 2004



• Linux Market Poised for Takeoff
  Thursday, 16 December 2004



• Mandrakelinux packages Linux for small businesses
  Thursday, 16 December 2004



• Linux Market to Exceed 35 Billion Dollars by 2008
  Thursday, 16 December 2004



• Holcim Migrates SAP Systems to Novells SUSE-R- LINUX Enterprise Server
  Wednesday, 15 December 2004



• MIPS 32-Bit Processor Core Families Supported by MontaVista Linux
  Wednesday, 15 December 2004

Recent Issues