Linux, Open Source have 'more security problems than Windows'

The Register, NewsForge ^ | 11.15.2002 | Robin Miller

[AdA$tra]

According to a report published November 12 by Aberdeen Group^, "Security advisories for open source and Linux software accounted for 16 out of the 29 security advisories - about one of every two advisories - published for the first 10 months of 2002 by Cert (www.cert.org^, Computer Emergency Response Team)."

Aberdeen says Microsoft products have had no new virus or trojan horse advisories in the first 10 months of 2002, while Unix, Linux, and Open Source software went from one in 2001 to two in the first 10 months of 2002, that in the same 2002 time period "networking equipment" (operating system unspecified) had six advisories, and Mac OSX had four.

In other words, all except Microsoft had increases in reported vulnerabilities this year.

"Contrary to popular misperception," the report says, "Microsoft does not have the worst track record when it comes to security vulnerabilities. Also contrary to popular wisdom, Unix- and Linux-based systems are just as vulnerable to viruses, Trojan horses, and worms. Furthermore, Apple's products are now just as vulnerable, now that it is fielding an operating system with embedded Internet protocols and Unix utilities. Lastly, the incorporation of open source software in routers, Web server software, firewalls, databases, Internet chat software, and security software is turning most Internet-aware computing devices and applications into possible infectious carriers."

The report lauds Microsoft for having overhauled its development process in an attempt to fix security problems, and says, "Perhaps it is time for some of the suppliers of open source and Linux software to take similar measures."

(You'll need to register with Aberdeen to read the rest of the report -- it's one of their free ones -- but I believe I've covered the Linux-relevant high points here.)

And yet, here I sit with my virus-free, trojan-free Linux box, receiving tons of viruses and trojans from Windows users (that don't affect me), watching news item after news item about sites run on Windows servers getting defaced and broken into.

According to what I've heard from my many sysadmin and network security specialist friends, no OS or network-connected software is secure unless it's administered properly and security patches are applied as soon as they are available.

And then, after I started writing this story, a ZDNet article with the headline Linux utility site hacked, infected^ came across my monitor, and I started wondering, "What if these Aberdeen people are right? What if this isn't just Microsoft-sponsored nonsense?"

A look at CERT's 2002 Advisories^ and Incident Notes^ pages was not overly reassuring. Yes, I saw some Microsoft vulnerabilities there that Aberdeen apparently missed, and one for Oracle.

I also think we have enough Microsoft viruses left over from last year that we don't need any new ones this year.

But the real issue is that we all need to be more security-conscious. The Aberdeen report points out that the system with the most reported vulnerabilities can change from year to year, but that the overall vulnerability and incident trend is up. Way up. In other words, whatever operating systems we use, we all need to watch out more for security flaws than we have in the past, and work harder to protect ourselves from them.

[AdA$tra]

This has all been in fun for me anyway. Truth be known, your linuxdesktop.com source is pretty much wrong anyway. I have two high powered clients in Hong Kong, one in
Japan and several in the UK. None of them use linux desktops and none of the government agencies in any of those countries that I have dealt with on import export agreements and other regulations for our software use linux either. We trade MS office documents. We are also installed in 23 of the top 100 accounting firms in the U.S. None of them use linux desktops either. So guess what...for now...neither am I. We are, however buying a linux based security appliance in the next couple of weeks. I have also looked at some IBM blade servers running Linux....very impressive.

[AdA$tra]

Technically, the UK, Germany and Spain are first-world countries. Please make a note of it.

Technically, none of them hold a candle to our American innovation and creativity. They also preach to us as if we are a third world country when it comes to global security. So screw 'em.

[chilepepper]

...we trade Office documents

Only if you upgrade operating systems in sync. Try reading Office XP documents under Office 2000....

[AdA$tra]

Only if you upgrade operating systems in sync. Try reading Office XP documents under Office 2000....

97, 2000 and XP documents are all interoperable. I have had some large Excel 97 spreadsheets take a few extra seconds to open or save in Excel XP, but that is the worst of it for me. Office 95 requires a converter. If you install all the converters, you can read Word Perfect, Word Pro, 1-2-3 and most anything else with MS Office XP.

[chilepepper]

We've been having some problems with crashes in trying to interchange excel files between the two... the net seems to indicate there may be some subtle macro incompatabilities -- any service packs that take care of these?

[AdA$tra]

I have 150 users here at my location using all three (97, 2000 and XP) and have had no complaints. I have a client down the street that has 35 users and uses all three. That is the location that has experienced slow saving and opening while converting between 97 and XP while opening and saving documents. No crashes though. This client does, however, have mostly brand new hardware throughout with the oldest PC's being Dell Dimension PIII 500's. Office XP is at service pack 2 and office 2000 is at service pack 3.

http://www.microsoft.com/office/downloads/default.asp

It is always a good idea to be current on those as well as the latest Windows Updates. Linux users should go to http://www.linuxupdates.com and make sure they are current as well.