* Results of Linux security study by Honeynet Project
A recently released report by the Honeynet Project reveals that Linux systems with basic out-of-the-box configurations can survive on the Internet in the face of hacker attempts and worms for around three months.
The Honeynet Project is a non-profit group that conducts experiments where groups of networked machines – called Honeynet sensor grids – are set up on the Internet and then observed as hackers and curiosity seekers attempt to compromise or infiltrate the systems. Project members then study the hacking methods used and offer analysis to the security community.
In the recent Honeynet study, the group observed that unpatched Linux servers, deployed on the Internet with commonly-used configurations, can last for three months, on average, before the systems are successfully hacked. Such intrusions could include exploits in weak code, commonly-known backdoors, or brute-force password hacking.
The data was collected on 12 Honeynet sensor grids deployed in Brazil, Germany, Greece, India, Pakistan, Portugal, the U.K. and the U.S. Various Linux distributions were used, including Red Hat 7.3, Red Hat 9.0, Fedora Core 1 and SuSE 6.3 and 7.2.
By comparison, says the Honeynet Project, the three-month Linux lifespan far outshines the average time it takes for a Windows-based systems to be compromised. Citing sources such as Symantec, CERT and the Internet Storm Center, the Honeynet Project said Windows-systems can last only a few hours on a network before an intrusion. (However, on its own Windows-based Honeynet grids, some Windows machines were able to stay untouched for several months.)
The Honeynet Project attributes several factors to these findings. Many Linux distributions are now shipping with more “closed” default settings – with daemon services shut down. Also, the predominance Windows machines on the Internet, and the publicity around exploits and security bugs, also make the platform an easier and more likely target for attacks.
