Phishing - Linux boxes are vulnerable

[Jacques B.]

On 10/4/07, Claude Jones <cjones at levitjames.com> wrote:
> "More interesting is that most of the compromised machines were not Windows
> machines. "The vast majority of [the phishing sites] we saw were on
> rootkit-ed Linux boxes, which was rather startling. We expected a
> predominance of Microsoft boxes and that wasn't the case.""
>
> http://tinyurl.com/36nfsm
>
> The above comments were made at a MS sponsored conference. MicroSoft has a
> history of sponsoring stuff like this. Even if it was an exaggeration - I've
> never heard of a big problem with Linux boxes getting root-kitted - is it
> something happenning under the radar? I've read over and over that Linux is
> much more secure than it's big counterpart - what sorts of vulnerabilities
> are people opening up to allow Linux machines to be root-kitted? I am aware
> of the ssh problem, and have followed the discussions on locking down ssh for
> years, including the other thread that's running currently. What other sorts
> of things must people do to open themselves up to being rootkitted? This is
> the first time I've seen such a claim, and it took me by surprise...so, I'm
> asking.
> --
> Claude Jones
> Brunswick, MD, USA

I'm no expert on this topic. But I do know a case where the
application that was running on the web server was exploited due to a
vulnerability in that application, not in Apache or the Linux box.  I
suspect that is the case more often than not.  Someone compromises a
web site that is running a vulnerable application.  That site happens
to be hosted on a Linux box (because let's face it, a lot of web
servers out there run on *nix).

So it's a matter of making the study say what they wanted it to say.
Or say something that is controversial, eye opening, or otherwise
worthy of capturing people's attention.

Personally I don't think it's a reflection on the vulnerability of the
Linux platform or Apache in many cases.  I say this with no real data
to back this up so take it as such.

Jacques B.