Slashdot Log In
Vulnerability Numerology - Defective by Design?
Posted by
Zonk
on Fri Dec 21, 2007 11:55 AM
from the gaze-into-your-crystal-ball dept.
from the gaze-into-your-crystal-ball dept.
rdmreader writes "RDM has a point by point disassembly of the security vulnerability story phenomenon. We regularly see these, comparing various vulnerability lists for different operating systems. ZDNet's George Ou, for example, condemns Linux and Mac OS X by tallying up reported flaws and comparing them against Microsoft's. What he doesn't note is that his source, Secunia, only lists what vendors and researchers report. Results selectively include or exclude component software seemingly at random, and backhandedly claims its data is evidence of what it now tells journalists they shouldn't report. Is Secunia presenting slanted information with the expectation it will be misused?"
Related Stories
[+]
More Mac Vulnerabilities Than Windows In 2007? 329 comments
eldavojohn writes "A ZDNet blog reports stats from Secunia showing OSX averaged 20.25 vulnerabilities per month while XP & Vista combined averaged 3.67/month. Is this report card's implication accurate, or is this a symptom of one company turning a blind eye while the other concentrates on timely bugfixes? 'While Windows Vista shows fewer flaws than Windows XP and has more mitigating factors against exploitation, the addition of Windows Defender and Sidebar added 4 highly critical flaws to Vista that weren't present in Windows XP. Sidebar accounted for three of those additional vulnerabilities and it's something I am glad I don't use. The lone Defender critical vulnerability that was supposed to defend Windows Vista was ironically the first critical vulnerability for Windows Vista.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Numerology? (Score:2, Insightful)
Did the guy who titled this know what the term Numerology [wikipedia.org] means? It's usually associated with wild "magical thinking" about numbers, and is at best a rather silly form of pseudomathematics.
</Skeptical Nitpick>
Ryan Fenton
Re:Numerology? (Score:4, Insightful)
Exactly. IMHO, he's saying that Secunia vulnerability comparisons aren't any more reliable than numerology predictions.
Parent
Re: (Score:2, Funny)
No, I think he's saying if you apply numerology to trojans/virii, you can gain insight into their personalities...
Re:Numerology? (Score:5, Funny)
Look, it's really quite simple what he's trying to say: If you add the letters of "ROUGHLYDRAFTED.COM" (A=1, Z=26, . = 0), you get 195. Add those digits together and you get 15. Again, add a third time and you get 6. So after adding the digits together three times, we get 6. Six repeated three times is "666", which is specified in the Bible as being the mark of the devil.
Now, if you do the same thing with "SECUNIA", you get 72. 7+2 = 9. And 9, added to itself, is 18, and its digits also add up to 9. So nine is obviously significant.
What does this mean? It's quite simple. The Devil, as specified by the Bible, is also what tempted Adam and Eve to take an Apple from the tree of knowledge. You see where this is going? ROUGHLYDRAFTED.COM is essentially saying that Apple is the source of knowledge. Whereas SECUNIA's, like, nine, or something.
Does this help?
Parent
About Secunia (Score:4, Interesting)
No, it just lists vulnerabilities. But it also lists them AND presents these two important things: (a) the importance of the vulnerability, and (b) whether or not it can be triggered through the network or not (local/remote vulnerability).
Furthermore, it separates Windows vulnerabilities in system and application vulnerabilities, if memory serves well. It's not able to do that with Linux, since different Linux distros incorporate different applications.
The matrix therefore becomes a lot more complicated. You can have a 'local only' problem (meaning: no remote exploitation) which can be considered as 'critical' on some Linux/BSD systems and not on others. You can have a remotely-exploitable problem which is critical on all systems that have application XYZ installed. But if I don't install XYZ (or if it's not activated by default) on my PC, I don't have a problem. And so on and so forth.
Which is why people that point at Linux/Mac and say: "Aha! More insecure than Windows!!" are not truly honest: I have Linux and OpenBSD machines with up-to-date SSH servers, no users, a good password, and no other network service running. These machines are almost perfectly secure -- except when it comes to an OpenSSH vulnerability -- even though there are plenty of applications on them that could be considered obsolete or vulnerable... if you can gain local access in the first place. The only point of vulnerability is OpenSSH. And I update it religiously.
All in all, don't blame Secunia: blame people (especially journalists) who know nothing about security and jump on meaningless numbers pulled out of thin air to blame Linux.
Re: (Score:3)
All in all, don't blame Secunia: blame people (especially journalists) who know nothing about security and jump on meaningless numbers pulled out of thin air to blame Linux.
Except the same meaningless numbers were used to push FF against IE. I recall the "More secure" slogan.
But it's been a while since the last time I heard it. Malice suggests that those numbers aren't very useful to FF lately.
Disclaimer: I'm a Linux user and I use FF regularly.
For what it's worth, I don't wish to start a flame war, but I think we should attempt to be fair.
Re: (Score:3, Insightful)
If you said that removing the user removes a significant portion of the vulnerabilities, then you w
# of Vulnerabilities!=Acknowledged Vulnerabilities (Score:5, Insightful)
And then unfortunately, their supporters like to bash Linux and Mac for actually working with security agencies and fixing their bugs as well as reporting them. This will forever be the bane of open source and it's benefit... that everyone gets to see its flaws but at the same time, everyone gets to contribute to fix them.
Re:# of Vulnerabilities!=Acknowledged Vulnerabilit (Score:2)
Re: (Score:2)
Fishing for vulnerabilities (Score:5, Informative)
Here's one even better: We use GeSHi [qbnz.com] (Generic Syntax Highlighter) in WikkaWiki [wikkawiki.org]. We often scour the so-called "security vulnerability" databases because we've found many inaccuracies. In this specific case, Secunia issued this statement:
WTF? This was a vulnerability in PHP's htmlspecialchars() function, NOT GeSHi. Yet, Secunia was planning on milking this vulnerability in order to boost its "vulnerability count" at the expense of a project that had absolutely NOTHING to do with the vulnerability.
You see, these so-called "vulnerability experts" try to wring out as many vulnerabilities as possible, because we all know that the most effective "vulnerability expert" will be the one with the most posted vulnerabilities. So they go on fishing expeditions to uncover vulnerabilities that really don't exist.
Or an even worse practice: "bottom-fishing" changelogs and bug trackers in order to discover vulnerabilities that have already been addressed. Here's another instance where Secunia was caught trying to boost its street cred through disingenuous reporting: They apparently scoured our bug tracking database and discovered an issue (already fixed!) and falsely implied in their report that the content of wiki pages marked private might be accessible via RSS. This was clearly false, as the original bug report indicated that the page name (not content) could be accessed. Secunia later corrected [secunia.com] the false report.
We've caught Secunia doing this on several occasions. My advice to anyone who is involved in an OSS project is to regularly scour the vulnerability databases and challenge each and every advisory that you believe is not accurate. You might be surprised at the amount of so-called "vulnerability intelligence" out there that is blatantly false, outdated, or inaccurate.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Again, this goes back to my argument that Secunia simply cherry-picks its reports, penalizing those projects that are most open with their changelogs and issue tracking, often listing so-called "vulnerabilities" after said vulnerabilities have already been addressed (as in this case).
Said it a thousand times. (Score:3, Interesting)
Again and again and again (Score:5, Insightful)
It's very simple, really.
You can _never_ know the relative security of two systems. There simply isn't any way to measure it fairly.
Count disclosed vulnerabilities? What about the vulnerabilities that weren't disclosed?
Have teams search for vulnerabilities and compare the results? What does that tell you? Was one team equally good at finding vulnerabilities in one system as the other was at finding them in the other system? What if one system had many easy to find vulnerabilities, and the other had a couple of severe but harder to find vulnerabilities?
Count actual break-ins? Well, was that due to the system being vulnerable the way the vendor left it, or because of the administrator? What about break-ins you don't know about?
It's always a matter of what you don't know about. You don't know the vulnerabilities that weren't reported. You don't know the vulnerabilities that weren't found. You don't know the relative skills of the teams you used. You don't know if you tested for all possible classes of vulnerability.
And I haven't even mentioned the severity of vulnerabilities, the availability of exploit code, the way vulnerabilities are dealt with by the vendor, and a host of other issues.
The take home message is that you just _can't_ know. It's a hard pill to swallow, but you will just never know which system is more secure. All you have is flawed metrics and your gut feeling.
Where is the MacOS X malware? (Score:2, Interesting)
Nothing to see there, move along (Score:5, Insightful)
Long story short:
ZDnet published an article comparing Secunia vulnerability counts in Mac OS X and Windows Vista/XP. They spun it the Microsoft way, so Mac OS X loses big time. A mac fanboy wrote a reply spinning it the Apple way.
TFA starts with a long-winded attack against the author of the ZDnet article without ever getting to the point. Let's just say that it talks about Zunes, XBoxes, train wrecks, ballet dancing and many more things.
Then it explains what Secunia does (in about two pages): they track software vulnerabilities which are - among others - reported by the vendors. So "honest" vendors get higher vulnerability counts. Who would have thought.
On it goes by saying that the "border" of an operating system is nowadays blurry; should the vulnerabilities in bundled applications be counted? Even if they are by another vendor?
Then he babbles about how most of the cited vulnerabilites in Mac OS X are related to what he calls "external software" - things such as python, java, perl, samba, tcpdump etc and that those same programs have the the same (or a similar) amount of vulnerabilities on other platforms. What he fails to point out is that Mac OS X *consists* of such "external software" for a big part, and that they are *part* of Mac OS X and cannot be removed easily.
Conclusion: a pointless (and extremely long-winded) article full of Microsoft bashing, as reply to an equally pointless article full of Apple bashing.
the only way to legitimately test this... (Score:2)
...is to construct a real-world test and repeat it fairly often, then tally up how each OS performs. Create a monthly or bimonthly hacking "tourney" with a money purse to properly motivate the contestants. Get "normal" IT staff (i.e. not experts hand-picked by MS or the OSS community) to "secure" the competing operating systems, then let the hackers loose.
Unfortunately this only gauges vulnerability to remote exploits, which probably aren't the most common means of penetration and which both systems prob
Vulnerability Counts: Humorous, Not Useful (Score:3, Interesting)
Over the years, there's nearly one flaw in the methodology for every one of these surveys ever released:
* Counting vulnerabilities in services installed by default the same as a service that is optional and not frequently enabled
* Subjective rating of impact (mild/severe)
* Treating remote code execution the same when on one system it is as uid nobody, and on the other, it is as administrator
* Ignoring the ease of use of tools that can actually verify a system's integrity (e.g., tripwire with signatures on RO media
and booted off CD)
* Ignoring what a user may have to do to trigger a vulnerability (ie, visit a web page with a malicious image, vs downloading a dmg file, running an install, and giving your password to elevate to root)
* Ignoring how an operating system enables or discourages user stupidity (ie, hordes of useless, "This program wants to do something, yes/no?" vs rare requests for a password)
And on and on and on. The average PC has over 25 different pieces of Malware installed. I know dozens of people with macs, and I don't know anyone who has had a single piece of malware, ever. I've been running linux for 12 years, desktop and server, and I've had two compromises ever, and both were via wu-ftpd.
Re: (Score:3, Insightful)
Everyone wants to validate their own prejudices (and some are paid to support other folks interests).
Security is a process, the goal of which is to protect something (usually your data - maybe your hardware - maybe availability or even user sanity!) and (usually at least) to minimize the resources it takes to do it. Y
How about George Ou sucks? (Score:3, Interesting)
See here [cnet.com] for a brief recap of Ou's idiocy (not a word but still).
My experience with Secunia (Score:5, Informative)
I've never read that site before (Score:2)
Riiight. Mac OS doesn't have libraries. There are no possible library mismatch issues on Mac OS. Okay, buddy, whatever.
Re: (Score:2)
his original post [roughlydrafted.com]
Look, have you ever used a Mac? Shared Libraries are versioned.
A
Re: (Score:2)