Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Microsoft's IIS is Twice as Likely to Host Malware?

Posted by Zonk on Fri Jun 08, 2007 01:22 PM
from the consider-the-source dept.
Security Businesses Google Microsoft Software The Internet Apache
eldavojohn writes "According to Google, Microsoft's server software is at least twice as likely to host viruses or malware. The reason why? 'Google reports that IIS is likely used to distribute malware more often than Apache because many IIS installs are on pirated Windows versions which aren't configured to automatically download patches. (Even pirated Windows versions can automatically receive security fixes, however.) Our analysis demonstrates how important it is to keep web servers patched to the latest patch level,' Google notes."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Microsoft's IIS is Twice as Likely to Host Malware? 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Help me out (Score:5, Insightful)

    by mingot (665080) on Friday June 08 2007, @01:25PM (#19441453)
    Patches? Patches for what? Has IIS had any remotely exploitable holes since version 5? Or are these machines that get owned via some other method and then just happen to have IIS so it is used to serve the malware? So really, this has more to do with unpatched windows than IIS? Or am I missing something?

    • Re: (Score:3, Insightful)

      by spellraiser (764337)

      Yes, it's probably due to unpatched Windows. They use the term web server, which is ambiguous in that it can mean both the server software and the machine it runs on. In this case they most likely mean the machine. After all, isn't it common knowledge that it's important to keep all your software updated and patched, not least the OS?

      • See! The same thing is going to happen to Macs and Linux as soon as they become popular! Because popularity means that these OSes will get pirated more. Which will lead to more infections of unpatched systems. Even though Linux is "free" (as in beer) and Mac OS X only works on legitimate Mac Hardware. Because free... and official hardware...

        Wait...

        What was I saying again?

          • Re: (Score:2, Informative)

            by Anonymous Coward
            Because many of us think BSD is truely free, while the GPL imposes restrictions on what you can do with it, so isn't 'free' in our book. Different folks have different definitions of freedom. I'm sure yours is different than mine.

            • Re: (Score:2, Insightful)

              by ericrost (1049312)
              The GPL doesn't restrict what you can DO with any piece of GPL'd code, it restricts you from restricting others from using your work in the same way you used the work of the thousands of developers who made the GNU system and the Linux kernel.

              Share and share alike. Otherwise one bad apple spoils the freedom for everyone.

                  • designed to prevent

                    from your previous:

                    free as in freedom to the core

                    You might want to ask for a dictionary for your birthday. These two statements are mutually exclusive.

                    • Whilst I could have phrased it more eloquently, you do realize there's an inherent irony in you championing how ultimate the freedom of the GPL is and every post after that explaining away and justifying all the ways in which it restricts freedom? Note though that I'm not claiming that there are good moral grounds for such restrictions, just that they are far from compatible with the statement - especially when one only needs to glance a few foot over to the BSD license to see what unrestricted freedom real
          • Because I was making a point? Specifically, that Linux is freely available to install, use, upgrade, and patch. Which would make the reason for the unpatched Windows machines (i.e. piracy) irrelevant. That's why the distinction was important in this case.

            Oh, sorry. I was supposed to give the standard Slashdot response, wasn't I? Ok...

            *WHOOOOSH!* :P

        • Re: (Score:3, Informative)

          by mhall119 (1035984)
          Actually the research shows that despite Apache being the more popular web server, IIS had more instances of hosting malware.

    • Re: (Score:3, Informative)

      by eli pabst (948845)
      Has IIS had any remotely exploitable holes since version 5?

      At least one in version 6:

      http://secunia.com/advisories/21006/ [secunia.com]

      Which is actually fairly impressive, but then again you'd really only need one remote vulnerability if you are trying to compromise completely unpatched systems.
      • This requires uploading a maliciously constructed asp file to a directory where there is script execute privilege. If I can upload script and have it run on a web server (any web server) doesn't that mean I've already pretty much got her pants down?
    • Has IIS had any remotely exploitable holes since version 5?

      What about the WebDAV issue that was used to break into DoD systems just before the Iraq war?
      • I'll point to the *since version 5* part and also point out that they wouldn't have been likely to be using Windows 2003 before the Iraq war or using Windows XP for such a purpose... unless you have a link to clarify...
    • If the flesh eating virus attacks my hand and then has access to my arm as a result of the fact that my nervous system decided to give everything easy access to each other, then that arm desrves to get taken! CHOP THAT BABY OFF AND HEAD FOR THE NECK I SAY!!

      If they wanted the apps to remain separate and sandboxed, they should have done so to begin with. Slap on the hand and one in the face to Microsoft for not doing so.

      • Re: (Score:2, Insightful)

        by goldspider (445116)
        "Microsoft releases patches for both, and neither are apparently being applied by the servers in question."

        So in other words, it's the inattentive sysadmins that are at fault. Why do you blame Windows and IIS then?
      • Modded as a troll? Why? I was answering the posters question. Unless, of course, I was moderated down by a sysadmin of an IIS server. Geesh. Some people have no clue how to use mod points.

      • Re: (Score:3, Insightful)

        by Henry V .009 (518000)
        That was a hole in version 5. Please try again. The question was: "Have there been any since version 5?"

        • Re: (Score:2, Informative)

          by drinkypoo (153816)

          That was a hole in version 5. Please try again. The question was: "Have there been any since version 5?"

          Since, definition 1: "from then till now (often prec. by ever): He was elected in 1978 and has been president ever since." Dictionary.com FTW! [reference.com]

          Perhaps you should learn to speak English before you criticize mine. I answered the question asked.

          The word you people want is "after", not "since". As my friend Tom says, correct me if I'm wrong, but be damned sure I'm wrong.

          Thank you, please drive through.

        • Re: (Score:2, Informative)

          by kernelpanicked (882802)
          No actually if you had read the link the other poster gave you, it affects 5 and 6. Now that I'm on Secunia I've got another link for ya. Total security advisories for IIS6 (3) http://secunia.com/product/1438 [secunia.com]. Impressive, but not nearly as perfect as you would like to think.
      • I'm the last one to defend Microsoft, but that is an exploit for version 5. The question was since version 5 (i.e. version 6).
      • That bug was from 6 years ago. If that is the best you can find MS must be doing a pretty good job.

  • No kidding /sarc (Score:4, Insightful)

    by N3WBI3 (595976) on Friday June 08 2007, @01:27PM (#19441511) Homepage
    The problem is anyone out there who can install windows services considers themselves a knowledgeable sys-admin. Sure there are technical reasons why LAMP tends to be more secure than IIS but more often than not it comes down to poor configuration (running unneeded services, poor network security, poor hardening standards), lazy maintenance (not checking logs, updating software), and a lack of understanding threats (not keeping up with cert).

    Linus once said of Gnome that when you design assuming you're users are idiots in the end thats all the users your going to have. Find an experienced competent admin who has cut his teeth in the real world and not in a MCSE bootcamp and you should be ok.

    • Re:No kidding /sarc (Score:5, Interesting)

      by porkThreeWays (895269) on Friday June 08 2007, @02:10PM (#19442263)
      I know everyone's going to start hating on you... but it's really true. The dirty little secret MS doesn't like to talk about in their TCO studies is that they usually rely on the fact Microsoft consultants make on average the least out of almost every consulting field. One study showed 30 dollars an hour! If you are paying your "experts" next to nothing how expert can they really be?

      Your quote at the end really rings true. I have yet to meet an IIS admin whom understands the HTTP standards at all, let alone something as complex as debugging chunked encoding issues. If you can't telnet to port 80 and get usable output, you have no business being a web server administrator. However, the windows culture encourages quite the opposite. If you can't solve a problem with a wizard, does the problem actually exist?

    • It's amazing how M$ security problems are always the user's fault when you ask a M$ person. Case in point, you blame the problem on ignorant, lazy and stupid users:

      ... it comes down to poor configuration (running unneeded services, poor network security, poor hardening standards), lazy maintenance (not checking logs, updating software), and a lack of understanding threats ... Find an experienced competent admin who has cut his teeth in the real world and not in a MCSE bootcamp and you should be ok.

      I'm

      • It's amazing how M$ security problems are always the user's fault when you ask a M$ person. Case in point, you blame the problem on ignorant, lazy and stupid users:

        Firstly I am not an MS person I am a Unix admin but in a previous job I did both (and hated every minute I had to support windows). Secondly I am not blaming users I am blaming *ADMINS* how need to be held to a much higher standard.

        I'm going to leave alone how you just called most M$ customers idiots. Why would consider someone lazy because t

  • Big Surprise (Score:5, Interesting)

    by ThinkFr33ly (902481) on Friday June 08 2007, @01:32PM (#19441591)
    First, there is not nearly enough information provided by Google to come to any real conclusions.

    It could be that IIS is more likely to become infected than Apache and then be used to distribute malware, or it could be that malware purveyors are more likely to host their malware on IIS. Or it could be a combination of both.

    They also fail to mention what versions of IIS we're talking about, as that makes a huge difference. IIS 5.x had more holes than a cubic mile of swiss cheese. IIS 6, on the other hand, appears to be rock solid [secunia.com] and actually has fewer vulnerabilities than Apache.

    Second, the fact that Google is a direct competitor to Microsoft is an obvious reason to find their conclusions dubious, at best. They have plenty of reasons to bash Microsoft at every possible opportunity.
    • Actually, 5 was pretty solid. I really think you need to get back to 4 for it to turn into shit.

    • Re: (Score:3, Insightful)

      by daeg (828071)
      When you compare IIS 6 to the comparable Apache version (2.2), they both have the same number of advisories [secunia.com]. Note that Apache 2.2 has an unpatched very low risk vulnerability when run on Windows. Interestingly, Apache supports more platforms yet has less bugs considering one of the three bugs only targets one operating system.

      I don't question their results, although I'd suspect there are also a high number of Cpanel hosts slammed full of malware, too.
  • Aahr. There be unpatched pirate servers here.

  • Genuine question (Score:3, Insightful)

    by feranick (858651) on Friday June 08 2007, @01:36PM (#19441681)
    Please don't flame me for this, it's a genuine question: Does Apache download and apply patches itself automatically? Or are sys administrators more careful and quicker to apply patches as soon as they are released?

    • Re: (Score:3, Interesting)

      by Nibbler999 (1101055)
      Apache won't auto-update but the distribution (assuming linux here) will provide automatic updates if configured for it.
  • I use it on a honeypot server, leaving linux and apache as my real machine.

  • Newsflash! (Score:5, Insightful)

    by DrEldarion (114072) on Friday June 08 2007, @01:42PM (#19441799) Homepage
    Bad admins run bad servers!

    Wouldn't have expected that one.
  • Are the people who run Slashdot really this dumb? Or are they simply FUDing for ad impressions? They don't really care what the submission says, who is sending it or who initiated it, as long as it's juicy? What time is it? It's 2:00 PM?

    Notice I placed a question mark after each one of my phrases so I cannot be held responsible for them. You know, just asking questions, like Fox News and their "Hillary Clinton turns tricks?" headlines.

    Speaking of that, there's a hilarious Jon Stewart skit on YouTube abo

    • Notice I placed a question mark after each one of my phrases so I cannot be held responsible for them. You know, just asking questions, like Fox News and their "Hillary Clinton turns tricks?" headlines.

      I'm running a macro when I visit slashdot that replaces "?" with "(of course this is total bullshit and we know it)."

  • Original source link (Score:3, Informative)

    by Anonymous Coward on Friday June 08 2007, @01:45PM (#19441833)
    Posted anonymously for your enjoyment:

    http://googleonlinesecurity.blogspot.com/2007/06/w eb-server-software-and-malware.html [blogspot.com]

  • Probably XP Pro (Score:3, Insightful)

    by jafiwam (310805) on Friday June 08 2007, @01:48PM (#19441891) Homepage Journal
    This is probably XP Pro machines that get infected by means other than the webserver.

    Once someone has control, they can pretty easily start the service and stick malicious files in the default root in IIS.

    You don't need a remote hole to get numbers like this.

  • 49/49 (Score:4, Informative)

    by jshriverWVU (810740) on Friday June 08 2007, @01:51PM (#19441947)
    If you look at the actual article, it shows an even split. 49% IIS 49% Apache 2% other:

    Pie Graph [blogger.com]

    • Re:49/49 (Score:5, Insightful)

      by sqlrob (173498) on Friday June 08 2007, @01:58PM (#19442057)
      The instances were evenly split, but since Apache is more common that IIS, you should see more Apache.
    • Yay, someone who actually read the article and noticed that yet another Slashdot story is deliberately misleading. No big surprise there. If anyone cares to look of the 70,000 domains distributing malware 49% were IIS and 49% were Apache. The "twice as likely" is pure spin based on overall market share and presumably designed to hide the fact that Apache is being used to push out just as much malware as IIS.
  • From what I've seen users who pirate software (like IIS) are not so interested in patching even if the option is available. It's usually not for running production-level hosting anyway. They're just happy the pirated software works and don't want to "rock the boat" so to speak in case a Microsoft patch would detect and deactivate that software.

    However when said user is frustrated because of inability to use a specific feature of the pirated IIS software then they go looking for patches, service packs and

  • I work for a company that identifies hacked sites that house phishing attacks. We have analyzed tens of thousands of sites. It was a surprise to me, but over 90% of hacked sites out there are running Linux/Apache -- not Windows/IIS as most people would suspect. The problem is that there are too many people out there install the free version of open source software, but don't have the ability to apply the patches. Since known vulnerabilities are well documented and kits exists to scan these weaknesses, Linu

    • I work for a company that identifies hacked sites that house phishing attacks. We have analyzed tens of thousands of sites. It was a surprise to me, but over 90% of hacked sites out there are running Linux/Apache -- not Windows/IIS as most people would suspect.
      Yes, but the exploit was likely not the Linux/Apache combo, but something else like say... Insecure PHP scripts.
  • Agreed with the other posts that IIS 5.x was rather shitty and was a lot more vulnerable than Apache, etc.

    With the release of IIS 6, security was significantly improved & according to various stats out there, IIS 6 is actually stronger than Apache in a lot of areas. We are running IIS & have had several intrusion attempts but our systems have been pretty solid; Humble admission, we did get hacked once but it was our negligence more than anything else.

    Having admin'ed both Apache and IIS servers, I

  • I think the research really mean is the administrators behind those softwares are the weak links, not the software. Those bad administrators use pirated windows servers and refuse to update are the most dangerous and damaging guys around.
  • So a bunch of thugs pirate Windows and start serving malware via IIS? So how do we know the discs they installed with weren't pre-infected with malware or that they didn't INTENTIONALLY put up servers for the purpose of serving malware? This story is coming from a competitor of Microsoft who has every reason to bash their products. It is probably a total crock anyway.
  • What with the lack of MS hate? Is google on the shitlist now too or something? I haven't seen so many comments bashing an article that pokes at MS ever...
  • The fact they're IIS and pirated seems to be moot, the point is many people just don't feel like "proving" to M$ that their version isn't pirated and give up trying to do security updates. I have one computer, out of about 9 or 10 I own at home, that has XP loaded on it. When I put it online and try to patch it, it does it's "Authenticity Check" and fails saying it was not a valid install. I know I bought a copy of XP specifically for this computer since it was for a businesses' use (and hence, tax deductible as an expense). Since it's never going to be on-line I said, "Screw it" and didn't bother with trying to update it. I'm sure many home owners are in the same boat...except they keep it online.

    Maybe they'll come around like they did on Win2K. They said they stopped supporting updates and I noticed no nags on my laptop for a really long time...lately I've noticed M$ is pushing security updates to it again. This is a computer I almost pulled from the "on line" array when it got infected twice by MySpace and YouTube....but I got it cleaned up through a few programs and a couple hours...
    • Actually I'd say this is great PR for Microsoft.

      Personally I thought it'd be much worse than just "twice" as bad. Maybe I've been buried under too much anti-MS FUD from reading Slashdot...

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.