Vulnerability Numerology - Defective by Design?

rdmreader writes "RDM has a point by point disassembly of the security vulnerability story phenomenon. We regularly see these, comparing various vulnerability lists for different operating systems. ZDNet's George Ou, for example, condemns Linux and Mac OS X by tallying up reported flaws and comparing them against Microsoft's. What he doesn't note is that his source, Secunia, only lists what vendors and researchers report. Results selectively include or exclude component software seemingly at random, and backhandedly claims its data is evidence of what it now tells journalists they shouldn't report. Is Secunia presenting slanted information with the expectation it will be misused?"

About Secunia

[Noryungi]

Does Secunia present slanted information?

No, it just lists vulnerabilities. But it also lists them AND presents these two important things: (a) the importance of the vulnerability, and (b) whether or not it can be triggered through the network or not (local/remote vulnerability).

Furthermore, it separates Windows vulnerabilities in system and application vulnerabilities, if memory serves well. It's not able to do that with Linux, since different Linux distros incorporate different applications.

The matrix therefore becomes a lot more complicated. You can have a 'local only' problem (meaning: no remote exploitation) which can be considered as 'critical' on some Linux/BSD systems and not on others. You can have a remotely-exploitable problem which is critical on all systems that have application XYZ installed. But if I don't install XYZ (or if it's not activated by default) on my PC, I don't have a problem. And so on and so forth.

Which is why people that point at Linux/Mac and say: "Aha! More insecure than Windows!!" are not truly honest: I have Linux and OpenBSD machines with up-to-date SSH servers, no users, a good password, and no other network service running. These machines are almost perfectly secure -- except when it comes to an OpenSSH vulnerability -- even though there are plenty of applications on them that could be considered obsolete or vulnerable... if you can gain local access in the first place. The only point of vulnerability is OpenSSH. And I update it religiously.

All in all, don't blame Secunia: blame people (especially journalists) who know nothing about security and jump on meaningless numbers pulled out of thin air to blame Linux.

Said it a thousand times.

[catwh0re]

..well maybe not a thousand times, but maybe I should. Security of software isn't just a product of how many flaws found. Rather it's an equation of how many people looking for flaws, the nature of the flaw and the reluctance of the company to report it (rather than just silently patching it, or worse just removing the evident symptoms but not the flaw at all.) We all know who I'm talking about with each argument.. Open source, where all changes are viewable, listed (and so on) is much more trustworthy than completely private software where the public discretion comes about from a marketing department. Additionally where the seriousness of a flaw can be completely downgraded by sole discretion.

Where is the MacOS X malware?

[Zott and Brock]

Windows has hundreds of thousands of known viruses and trojans, but the malware for MacOS X can be counted on your fingers. Just because Apple periodically publishes security updates doesn't mean that these vulnerabilites have ever been found outside of security labs and been exploited in the wild.

Vulnerability Counts: Humorous, Not Useful

[MattW]

Even if the information about vulnerability counts were pristine, it still wouldn't be useful, and anyone who has been involved in security knows it.

Over the years, there's nearly one flaw in the methodology for every one of these surveys ever released:

* Counting vulnerabilities in services installed by default the same as a service that is optional and not frequently enabled
* Subjective rating of impact (mild/severe)
* Treating remote code execution the same when on one system it is as uid nobody, and on the other, it is as administrator
* Ignoring the ease of use of tools that can actually verify a system's integrity (e.g., tripwire with signatures on RO media
and booted off CD)
* Ignoring what a user may have to do to trigger a vulnerability (ie, visit a web page with a malicious image, vs downloading a dmg file, running an install, and giving your password to elevate to root)
* Ignoring how an operating system enables or discourages user stupidity (ie, hordes of useless, "This program wants to do something, yes/no?" vs rare requests for a password)

And on and on and on. The average PC has over 25 different pieces of Malware installed. I know dozens of people with macs, and I don't know anyone who has had a single piece of malware, ever. I've been running linux for 12 years, desktop and server, and I've had two compromises ever, and both were via wu-ftpd.

How about George Ou sucks?

[GarfBond]

This is the same guy who (figuratively) fell in love with David Maynor and their associated AirPort exploit back when everyone else was telling them to show the goods. The guy isn't much more than an Apple troll - go through his archives (but don't actually - that gives him advertising hits) and it basically reads as "Apple sucks at this, Apple sucks at that, wah wah wah."

See here [cnet.com] for a brief recap of Ou's idiocy (not a word but still).