Honeypot Project: Unpatched Linux Systems Last Longer than Windows

The Honeypot Project has added fuel to the debate over which is more secure—Linux or Windows—with findings that unpatched Linux systems can be on the Internet for months before being successfully attacked while Windows systems have been compromised in as little as hours.

The international non-profit security organization—with members from security companies like Foundstone Inc., Counterpane Internet Security Inc. and SecurityFocus—did not set out to show that Linux is more secure than Windows. Instead, the group set out to ask the question: "Why is no one hacking Linux anymore?"

Resource Library:

To explore this question, Honeypot Project members set up 12 "honeynets" deployed in eight countries (the United States, India, the United Kingdom, Pakistan, Greece, Portugal, Brazil and Germany). Data was collected during 2004, with most collected in the past six months. Each honeynet deployed a variety of Linux systems accessible from anywhere on the Internet.

A honeynet consists of two or more "honeypots." A honeypot is a system that doesnt have any real work to do. Its sole purpose is to detect and track any interactions with it, since any such interactions can be assumed to be a probe, scan or attack.

Click here to learn more about honeypots.

Research honeynets are not advertised. Theyre housed anonymously on the Net so they wont attract would-be crackers. This is essential to maintain the integrity of the data they produce on what kind of attacks are currently prowling the Internet looking for non-updated systems.

In the case of The Honeypot Project Linux study, "A total of 24 unpatched Unix honeypots were deployed, of which 19 were Linux, primarily Red Hat." Specifically, there were nine Red Hat 9.0, five Red Hat 7.3, two Fedora Core 1 and one each of Red Hat 7.2, SuSE 7.2 and 6.3 installations. In addition, the group deployed two Solaris SPARC 8, two Solaris SPARC 9 and one Free-BSD 4.4 system.

These unpatched honeypots were set up as severs with default settings and typical services set such as HTTPS (Secure HTTP), FTP and SMB (Server Message Block) with host-based firewalls that allowed inbound connections to these services. To make these systems more like those found in the real world, insecure or easily guessed passwords were used on several of them.

In addition to not being advertised, these honeynets were deliberately set up to be not especially attractive—i.e., home or small-business networks. In addition, they were not registered in DNS or on search engines so that "the systems were found by primarily random or automated means," the report said.

Next Page: "Surprising" life expectancy.