On 10/4/07, Claude Jones <cjones@xxxxxxxxxxxxxx> wrote: > "More interesting is that most of the compromised machines were not Windows > machines. "The vast majority of [the phishing sites] we saw were on > rootkit-ed Linux boxes, which was rather startling. We expected a > predominance of Microsoft boxes and that wasn't the case."" > > http://tinyurl.com/36nfsm > > The above comments were made at a MS sponsored conference. MicroSoft has a > history of sponsoring stuff like this. Even if it was an exaggeration - I've > never heard of a big problem with Linux boxes getting root-kitted - is it > something happenning under the radar? I've read over and over that Linux is > much more secure than it's big counterpart - what sorts of vulnerabilities > are people opening up to allow Linux machines to be root-kitted? I am aware > of the ssh problem, and have followed the discussions on locking down ssh for > years, including the other thread that's running currently. What other sorts > of things must people do to open themselves up to being rootkitted? This is > the first time I've seen such a claim, and it took me by surprise...so, I'm > asking. > -- > Claude Jones > Brunswick, MD, USA I'm no expert on this topic. But I do know a case where the application that was running on the web server was exploited due to a vulnerability in that application, not in Apache or the Linux box. I suspect that is the case more often than not. Someone compromises a web site that is running a vulnerable application. That site happens to be hosted on a Linux box (because let's face it, a lot of web servers out there run on *nix). So it's a matter of making the study say what they wanted it to say. Or say something that is controversial, eye opening, or otherwise worthy of capturing people's attention. Personally I don't think it's a reflection on the vulnerability of the Linux platform or Apache in many cases. I say this with no real data to back this up so take it as such. Jacques B.
