Kits help phishing sites proliferate

TalkBack 5 of 7:

Next »

« Previous

• Thread View
• Flat View

IIS + Windows

Most of the phishing pages (not sites-- pages on someone elses' web server) I have investigated have been on Windows servers. Why?

1) Windows + IIS is easier to hack into. Perhaps, but I don't think this is conclusive that Windows + IIS is automatically "less secure".

2) Third party addons. I think this is more likely the case. My impression has alway been that the tools used to create IIS plugins (blogs, photo sites, etc) do not emphasize security. In other words, it is quite easy to build an insecure Windows web server (easier than Unix + Apache).

3) Clueless system admins. I think this is the most likely reason. All servers have the possibility of being managed by the clueless. There just tends to be (in my experience) a lot more clueless Windows admins. Perhaps Linux admins have more experience with networking and programming in general? Perhaps a MSCE is more about passing a Microsoft sales seminar than actualy learning how to properly run a server on the internet? Perhaps.

BTW-- PHP on Apache is a dangerous thing. Of the non-windows servers that have been hacked for phishing, all have been Apache+PHP. Admins need to be wary of installing the latest n' greatest "cool" PHP app on their server. Most of the code floating around has no security whatsoever-- and cannot be made secure. This is similar to the problem with IIS plugins. As the code gets easier to write, people who should not be programmers can write code that appears to work just fine. Yes, I said it-- "people who should not be programmers".

Posted by: RestonTechAlec   Posted on: 02/27/06 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now