Well... wasn't that fun?!?

AsaJay · Post by **AsaJay** » Tue Dec 28, 2004 10:16 am

bio wrote: But just for giggles, let's do a test. I'll install a linux server with nothing but the install CD... no updates, no fancy tricks, nothing. You install a Windows server the same way.

Then we'll put them naked on the internet. Let's see which one melts first.

I think this would be a great Saturday afternoon activity. Kind of a like an install-fest.

Build two hardware-identical machines. Hook both machines to the internet via cat5 cabled directly to the net (first hop out of wall, no router, to gateway, etc.)

Install an XP Home edition (or Pro edition) on one machine, selecting all defaults. Install an out-of-the-box Linux distro, making default selections, on the other box.

Wait, and see how long it is before a box gets owned. Meanwhile, sit around, drink beer, set up some net sniffers to watch the packets fly, watch movies, etc.

Let both boxes go for say, four hours, then perform a forensic on both.

Sound like fun?

ironpants · Post by **ironpants** » Tue Dec 28, 2004 11:15 am

I've got a box in the corner of the office that hasn't been doing anything. Just for kicks, I think I'm gonna try it. Win2k w/ IIS and terminal services up and running sound like fun? Just for kicks, I'll give you guys TS accounts so you can check in on it from time to time.

Rocketdork · Post by **Rocketdork** » Tue Dec 28, 2004 11:33 am

So the next question is; how will you apply the patches? Online? or from a disk?

Are you just going to do the default install, no patches and open it to the net?

I guess what I am asking is are you going to install the latest version (including patches) or what M$ ships on the CD?

ironpants · Post by **ironpants** » Tue Dec 28, 2004 11:58 am

I was thinking of throwing in the cd, installing the os and IIS, then .net framework and community server fourms/blogs just so there's a big fat target on it. If I don't need it to run the apps, I'm not installing any patches.

Post by **bio** » Tue Dec 28, 2004 12:36 pm

I'll do the same with an old box.

Base OS, apache, php, a blog. No updates unless required to make an application work.

I'll set it in my dmz with a static external IP address.

However, I won't be able to do this until next week (it's a timing thing). The resuls should prove interesting.

My predictions for hackage:

Windows box: less than 1 hour (I actually expect it to go down in 30 minutes or less, but I'll be generous here)

Linux box: less than 8 hours (it could happen the second I power it up, and then again, it could be good for days).

AsaJay · Post by **AsaJay** » Tue Dec 28, 2004 12:38 pm

Just install what comes in the box. NO fancy stuff, no additional sh*t that has to be downloaded, no additional CDs, no patches, nuthin'.

The premise is, you have to pretend you are Joe-schmuck user. You just bought XP at a Costco and are going to install it on the new hard drive you also just bought at Costco. The only thing you know, is that you heard there is a service pack 2 from MS but that XP will automatically download it for you.

The test parameters must be "out of box install" with nothing additional.

That's why I said you have to build the box, THEN plug it into the network BEFORE installing the OS. Being hooked to the network during install is part of the whole test, to see how fast the machine gets compromised as soon as you finish the install, without applying any patches, BUT, allowing the OS itself (without prompting from you) to go out and fetch or alert the user to patches being available.

The "user" otherwise does nothing, unless prompted.

ironpants · Post by **ironpants** » Tue Dec 28, 2004 1:02 pm

Bio suggested "server" so I didn't even think of building an XP box. I figured Win2k would be more funner as it doesn't have the auto update stuffs that xp has. Besides, it doesn't have much of a target footprint. Add a blog and a forum to the box and I'm guessing you're asking for it. And no, I wasn't planning on downloading anything, I've got the retail disks for all of it.

The down side is that I don't have a static IP to give it, but I thought I'd grab a taunting domain name from dyndns.org and see where it goes.

Windows update who?

AsaJay · Post by **AsaJay** » Tue Dec 28, 2004 2:00 pm

ironpants wrote:Bio suggested "server" so I didn't even think of building an XP box.

Granted, we're kind of talking about two different type of tests, one being for server being hacked, the other for basic joe-user being hacked.

I would expect a person installing a server, would know quite a bit more about security and vulnerabilities. Therefore the base-line for the test is a bit more complicated to construct.

Since I've never built -any- Windoze servers, and only a couple of Linux servers, I don't consider myself qualified to know what needs to go into a base level build, but I'll take a stab at what I think the process should be.

Fe-pants, takes the Windows path
Bio, takes the Linux path

- Build the box, using fairly stock components, try to get cpu, ram and swap space to be comparable between the win and Lin boxes, that part is up to you guys.

- Hook the box to the internet prior to doing the software (OS and apps) install. This way the auto-detection of the install can do it's thing, and provid the fastest vulnerability to both systems.

- Install OS. Use original media (out of the box). In the case of Linux, the install -must- be made from ISO imaged CDs (unless using a "boxed" copy). No ftp or NFS installs allowed. (ftp or NFS installs -could- have patched files already in the struture)

- OS updates. Configure the system to fetch OS updates automagically, and allow the system to do it's thing. Do -not- install updates manually that you "know" about, let the OS try to update itself. In the case of the win server, if it doesn't have an auto-update, use the online windows update feature -only-, again, no manual installs of what you "know" needs to be done.

- Install Apache. Apache can run on both OS's, Agree on the version number between you both, and install that version on both machines. If updates are available, you must -both- agree on the update and -then- install it.

- Install basic blog. Agree which blog to use. Wordpress is currently considered the top freely available blog. (from what I've read). Agree on the version and install it. If updates are available, you must -both- agree on the update and -then- install it. NOTE: You must also both agree on specific settings for the blog (comments on/off, that kind of thing)

- Install basic phpBB. Agree on version and install it on both. phpBB is not the -only- BB out there, but it does appear to be one of the more popular, and was the target of most recent cracks. If updates are available, you must -both- agree on the update and -then- install it. NOTE: You both must agree on the configuration, subscription parameters, uploads allowed or not, etc.

- Log the following events separately:
- When the box was first "turned on" (power applied)
- Start of OS installation
- End of OS installation (prior to updates)
- Time any update started, and finished
- Time started and finished Apache install (note, this might be hard if the OS install can -include- the Apache install.
- Time started and finished Wordpress install
- Time started and finished phpBB install
- Time any particular threat was noticed to have invaded, and how you found out (short description, i.e. all of a sudden the machine stopped responding.
- Number of times the box had to be rebooted during the setup, until "hands-off".

How does that sound for a first stab at it? Massage it a bit, and agree on the parameters. This is a non-scientific test, just a fun activity, but we still want to make it as equal as possible.

And before you can start, you both must agree to the final plan and upload it here for forum approval. Once approved, you start in on building the server.

Does this sound reasonable?

AsaJay · Post by **AsaJay** » Mon Jan 17, 2005 8:24 pm

ironpants wrote:you knew this was comming, so here it is...

how secure to you feel about linux now?

I still feel pretty darn good

Eve · Post by **Eve** » Tue Jan 18, 2005 3:56 pm

I am guessing the windows box will be compromised before the first update is installed

Are we taking bets? lol

ironpants · Post by **ironpants** » Tue Jan 18, 2005 4:01 pm

As a non scientific test (just screwing around wasting a little time) I brought SQL Server up yesterday without any prodection, no SP's to find out if Slammer was still out there.

18 seconds!

Eve · Post by **Eve** » Tue Jan 18, 2005 4:01 pm

Eve wrote:Well at this point, let's have the facts.

Did anyone actually read this report?

ironpants · Post by **ironpants** » Tue Jan 18, 2005 4:18 pm

Eve wrote:
Eve wrote:Well at this point, let's have the facts.

Did anyone actually read this report?

I glossed through it quickly and dismissed it as the standard trade filth that clogs up this industry.

But after you just mentioned it, I did a search for the writer looking for any kind of computer science background. I figured a writer with his career would have at least some mention in a bio on the web somewhere. Sadly, I found what I was looking for. Not to say his points aren't valid, but they're probably at least suspect.

AsaJay · Post by **AsaJay** » Tue Jan 18, 2005 5:41 pm

Eve wrote:
Eve wrote:Well at this point, let's have the facts.

Did anyone actually read this report?

Um, yea. In fact, I have a copy of the pdf version on my desktop. Have had, since you first posted the story.

ironpants · Post by **ironpants** » Mon Feb 28, 2005 8:09 pm

Surprised even me: http://seattletimes.nwsource.com/html/b ... ity17.html

Any bets on who's paying the people who did the study? Probably not the same people who paid for the last study mentioned in this thread