5 ms·

This is one of those tricks you don't want to publicize if your goal is to increase your own security. Linux being less of an attack vector than Windows has lit

This is one of those tricks you don't want to publicize if your goal is to increase your own security. Linux being less of an attack vector than Windows has little to do with its inherent security (I wouldn't be surprised if Windows has Linux solidly beat in this department nowadays) than it does with how many and what kinds of computers run Linux. If a company's Linux boxes mostly run production servers that are generally stateless and/or covered by a comprehensive disaster recovery policy, then there's a good chance that their response to your ransomware attack will be to laugh in your face and push the "recover" button. On the other hand, there's a decent chance that at least some of the company's Windows computers contain some critical spreadsheet that holds together some essential business process and isn't being regularly backed up. The thing is, that balance only works as long as there aren't a whole lot of organizations running all Linux. Because, if there were, then you'd start to see more of those critical irreplaceable files living on people's Linux desktops.

yjftsjthsd-h 5y ago
It is not obvious to me how to compare the fundamental security of NT and Linux, although I give some credence to the traditional answer that >90% of servers are on Linux (i.e. there's no shortage of valuable targets) so if it were really that easy to attack people would do it. However, even assuming comparable inherent security of the OS, it is trivially true that more malware exists for NT than Linux, so for non-targeted attacks Linux is probably safer. And, of course, if you're worrying about targeted attacks (such that people knowing what you run is a problem), then OS is almost irrelevant because you need to do some serious hardening regardless.
- mumblemumble 5y ago
  I would actually argue that Linux primarily being a server OS is a big reason why there seem to be so few attacks against the OS itself. It's about the attack vectors. On Windows, there's typically a human interacting with it. That's a big part of your attack vector; you're trying to get them to download and run a file. Once they do that, it's able to interact directly with the OS. And you've got a lot more incentive to stick around once you get in, because typical users aren't going to notice if the computer's chugging a bit harder due to running a botnet or encrypting the whole hard drive. On a server, though, everything's probably pretty closed down. And there's generally no human to let you in. So instead of attacking the OS itself, you attack the services running on it. And if you do get into one, there's likely no need to go after the OS from there, because you're already in the memory space of the app, which is where all the goodies lie. And you're also not likely to stick around and waste CPU resources on running a botnet or encrypting the drive, because any halfway competent ops team is going to have monitoring in place, and will notice and investigate the anomalous spike in activity. Which takes us back to my point: correlation is not causation. Relative compromise rates for the two OSes may well have nothing at all to do with the actual OS. The real thing that's being attacked is the class of computer: viruses want to go after user workstations, not servers.

yjftsjthsd-h 5y ago

It is not obvious to me how to compare the fundamental security of NT and Linux, although I give some credence to the traditional answer that >90% of servers are on Linux (i.e. there's no shortage of valuable targets) so if it were really that easy to attack people would do it. However, even assuming comparable inherent security of the OS, it is trivially true that more malware exists for NT than Linux, so for non-targeted attacks Linux is probably safer. And, of course, if you're worrying about targeted attacks (such that people knowing what you run is a problem), then OS is almost irrelevant because you need to do some serious hardening regardless.

mumblemumble 5y ago
I would actually argue that Linux primarily being a server OS is a big reason why there seem to be so few attacks against the OS itself. It's about the attack vectors. On Windows, there's typically a human interacting with it. That's a big part of your attack vector; you're trying to get them to download and run a file. Once they do that, it's able to interact directly with the OS. And you've got a lot more incentive to stick around once you get in, because typical users aren't going to notice if the computer's chugging a bit harder due to running a botnet or encrypting the whole hard drive. On a server, though, everything's probably pretty closed down. And there's generally no human to let you in. So instead of attacking the OS itself, you attack the services running on it. And if you do get into one, there's likely no need to go after the OS from there, because you're already in the memory space of the app, which is where all the goodies lie. And you're also not likely to stick around and waste CPU resources on running a botnet or encrypting the drive, because any halfway competent ops team is going to have monitoring in place, and will notice and investigate the anomalous spike in activity. Which takes us back to my point: correlation is not causation. Relative compromise rates for the two OSes may well have nothing at all to do with the actual OS. The real thing that's being attacked is the class of computer: viruses want to go after user workstations, not servers.