While browsing some of my other favorite websites someone posted a link to this article I thought it might be an interesting read.

http://www.vnunet.com/News/1128907

But dont forget to click on the link below it
labeled "Controversy in the linux camp"

Im new to linux and to the security world but since I have a copy of win2k and linux I was wondering how do you test the security of a OS? Is there a way I can test the security of a OS on my own and come up with my own conclusions and numbers. What type of programs do people run to see how secure an OS is?

"Testing" IMO could be either auditing of code , or auditing of products. Both have in common you'll not be looking for *security* but for the *absence* of security loopholes. After all security isn't a static thing.

Auditing code is sposed to be hard work (I'm bad at that) and needs a lotta eyes and knowledge. As an admin you can try to read the code or actively screen to be compiled code for possible loopholes with Flawfinder.
Get passive protection by compiling with/using Libsafe or Stackguard against memory leaks, buffer overflows (see also OpenWall, Lomac, RSBAC, LIDS, GRSecurity or Lcap). On Wintendo, well, on wintendo you get minesweeper :-]

Auditing products IIRC, roughly breaks in two parts: vulnerability assesment and penetration tests.
A part of a vulnerability assesment could be to get version names of possible exploitable running daemons. You'll find a lot of tools like Nessus, Vetescan or Whisker on securityfocus.com, www.insecure.org/tools.html, or the COAST archives at ftp://coast.cs.purdue.edu/pub/. If you're on the box, it could also include using for instance TCT, to strip stuff off of an HD ppl think unrecoverable, or trying to find out if apps will have race conditions or predictable /tmp files or can be killed by using large variables etc, etc.
A part of a penetration test could be to actually use an exploit, like from www.securiteam.com, to test vulnerable Sshd, Apache, Lpd/rsh/rpc etc, etc, hping/firewalker to see what a firewall will let tru, netcat to see if you're able to get a payload out to get other hosts infected without the host noticing (I mean, we watch what's coming in, but do we watch what's going out?), brute-forcing smb's, try to change registry keys/acl's, trying to strace some app (some apps won't like this), try to load adore w/o the system knowing to hide processes, tho the last few examples verge more on the access restrictions (ie misconfiguration) than trying to break an app/box by flaws in code or features.
Flaws could be like corruption of the stack due to being able to insert pointers to your executable code (I mean buffer overflows), DoSsing an app by feeding it many connections, like trying to overflow ip_conntrack's /proc table, or simply make it crash by feeding it too much data.

Except for being able to connect a W32 Nessus client to a Nessusd running on *nix, there's not a lot of free W32 tools I can think of except for Stealth vulnerability scanner, netcat or Nmap. Maybe Technotronic or Packetstorm will reveal some. (If you find some good ones, post it back, ok). So, after using l33t Minesweeper on Wintendo, you can *buy* ISS, L0phtcrack or Bindview :-]
Or go directly to the expoits section, because with IIS, terminal server, VB, Java, MIME, OLE and whatnot this shouldn't be hard...

If you're on Linux my suggestion for a minimal toolkit, next to having an inquisitive mind, knowledge of programming languages and tenacity, would be, hexedit, Perl (to feed 1K zero's as arg), netcat, Nmap, Tcpdump, Nessus, ISIC/Hunt/Rain, gdb, strace, strings, and lots of patience.

HTH somehow...

hi all,
i don't know what to make of that article. so i'm polling for opinions from you guys.

Usually I don't post my opinion on things, but IMO classification based on the *amount* of vulnerabilities shows brainrot and bogosity on their side as it doesn't show the severity or impact, just the bulk figures, which could only please stats freaks. Hell, I couldn't even call it spreading FUD.

Classification based on *severity* is more usefull because it will show if the results of that bug will affect a distribution (Suse/Slackware's login probs), affect any system's capabilities to function (Snort-1.8.3's very small ICMP packet bug), all distributions (using OpenSSH-2.9x) or is likely to have effect in only certain situations (Sudo + Postfix).

The myriad of bugs in different Linux apps shows how Linux distributions and development teams are still (apart, not a concerted effort, no std like certification) not adapting to an OpenBSD-like auditing and releasing discipline, so it would be good to know *how* much time is spend auditing *what*, and if the errors occur because of features or based on architectural choices (like Wintendo's COM/VBS/OLE/MIME/user integration, or like SSH-1 Protocol approach to authentication, or Wu-ftpd codebase).

The part about bug hunting we can only be glad about IMO. Even if it does pose some questions like about spending more time in combing tru vulnerabilities listings, choosing your distro and install types, generally be more alert (what seems safe today, maybe b0rken tomorrow) and having a more strict upgrade regime, the bug hunting effort itself does mean Linux distributions will be getting more secure in the end.

Point #1. Linux is used as an entire distribution meaning that all the applications are included in these statistics. Windows is being rated strictly as an operation system. Pretty worthless statistic gathering.

Point #2. The quoted insecurity of Linux is attributed to an aggregated total of all the Linux distributions. So, not only are we looking at holes in applications included in distributions but all the holes in every single distribution.

All advocacy aside this is bad data collection and bad use of statistics in an article. Yikes.

Bad statistics? Lies, damn lies and statistics.

However, 99.2% of statisticians are agreed that statistical measurement is significant.

but then, Vic Reeves once said "88.2% of statistics were made up on the spot." makes a lot of sense to me. especially if you know who Vic Reeves is.

I'm 24.3% sure that George Doors ("what are the scores, George Doors?") and even Colonel Mustard (cress seeds ) would never make up statistics.