Security in GNU / Linux systems, does it depend on the system or the administrator?

In days gone by they ran through the net reports of attacks They exploit a vulnerability in PHP, which allows some legitimate sites to serve fraudulent web pages and advertisements, exposing visitors to the installation of malware on their computers. These attacks take advantage of a extremely critical PHP vulnerability publicly exposed 22 months ago and for which the corresponding updates have been released.

Some have begun to insistently point out that a good part of the servers compromised in these attacks are running versions of GNU / Linux, pretending to question the security of this Operating System, but without going into details about the nature of the vulnerability or the reasons why which has happened this.

Systems with infected GNU / Linux, in all cases, they are running the Linux kernel version 2.6, released in 2007 or earlier. In no case is it mentioned the infection of systems running superior kernels or that have been duly updated; But of course, there are still administrators who think "... if it is not broken, it does not need fixing" and then these things happen.

Moreover, a recent study by security firm ESET, exposes the call in detail "Operation Windigo", in which through various attack kits, including one called Cdorked specially designed for Apache and other popular open source web servers, as well as another called SSH, have been more than 26,000 GNU / Linux systems compromised since May of last year, does this mean that GNU / Linux is no longer secure?

First of all, putting things in context, if we compare the previous numbers with the almost 2 million Windows computers compromised by the bootnet ZeroAccess Before being closed in December 2013, it is easy to conclude that, in terms of security, GNU / Linux systems are still more secure than those that use the Microsoft Operating System, but is it GNU / Linux's fault that 26,000 systems with that OS have been compromised?

As in the case of the critical PHP vulnerability discussed above, which affects systems without kernel updates, these other attacks involve systems in which the default username and / or password was not changed and which kept the ports 23 and 80 unnecessarily open; So is it really GNU / Linux's fault?

Obviously, the answer is NO, the problem is not the OS that is used, but the irresponsibility and neglect of the administrators of those systems who do not quite understand the maximum stated by the security expert Bruce Schneier that should be burned into our brains: Safety IS a process NOT a product.

It is useless if we install a proven safe system if we then leave it abandoned and do not install the corresponding updates as soon as they are released. Similarly, it is useless to keep our system updated if the authentication credentials that appear by default during installation continue to be used. In both cases, it is elementary security procedures, which are not due to repetition, are properly applied.

If you have under your care a GNU / Linux system with Apache or another open source web server and you want to check if it has been compromised, the procedure is simple. In the case of Ebury, you must open a terminal and type the following command:

ssh -G

If the answer is different from:

ssh: illegal option – G

and then the list of correct options for that command, then your system is compromised.

In the case of Cdorked, the procedure is a little more complicated. You must open a terminal and write:

curl -i http://myserver/favicon.iso | grep "Location:"

If your system was compromised, then Cdorked it will redirect the request and give you the following output:

Location: http://google.com

Otherwise, it will not return anything or a different location.

The form of disinfection may seem crude, but it is the only one proven effective: full system wipe, reinstallation from scratch and reset all credentials user and administrator from an uncommitted terminal. If it seems hard to you, consider that, had you changed the credentials promptly, you would not have compromised the system.

For a much more detailed analysis of the ways these infections operate, as well as the specific ways used to spread them and the corresponding measures to take, we suggest downloading and reading the full analysis of the "Operation Windigo" available at the following link:

Operation Windigo

Finally, a fundamental conclusion: There is no operating system guaranteed against irresponsible or careless administrators; As for security, there is always something to do, because the first and most serious mistake is to think that we have already achieved it, or do you not think so?