Windows Server 2008 is not secure. Who is right? | The Coffeehouse

turrican
Condemnation without investigation is the height of ignorance! - Albert Einstein

Is this really how people think of Windows Servers? Shouldn't Microsoft do something to change this? I mean, the guy ( gladier ) thinks Windows Server 2008 is not secure even with the windows firewall closing all ports but WWW / FTP / RDP. It almost seems like he is claiming it's a bad idéa to have ASP.NET/IIS running *lol*

...Who is right? I would love to hear your opinion on this issue.

[07:46] <AloneInTheDark> My PC is connected directly to the Internet. Win2k8, in the "Network and Sharing Center", I can "Customize" the network "Public" / "Private" , which one should I choose ?
[07:53] <gladier> do you have an external ip address?
[07:53] <AloneInTheDark> yes
[07:53] <gladier> ie: you have exposed windows to an external up?
[07:54] <AloneInTheDark> the Internet comes from my "wall" and I connect this PC directly to it, no router inbetween
[07:55] <AloneInTheDark> My router can't get IP from the ISP somewhy so I attached the PC "directly" to the Internet.
[07:55] <AloneInTheDark> Now, I think I should choose "Public", right?
[07:55] <gladier> yea
[07:55] <gladier> but two things
[07:55] <gladier> a) this isn't the windows vista support room
[07:56] <AloneInTheDark> No, I said win2k8
[07:56] <AloneInTheDark> it's a server
[07:56] <gladier> oh
[07:56] <gladier> lol
[07:56] <AloneInTheDark> Big Smile

[07:56] <gladier> my mistake
[07:56] <gladier> second ... so you are supplied ethernet?
[07:56] <AloneInTheDark> yes
[07:56] <gladier> wth ... is this in a datacentre?
[07:56] <AloneInTheDark> a "hole in the wall"
[07:56] <AloneInTheDark> no, my home
[07:56] <AloneInTheDark> 100/100
[07:56] <AloneInTheDark> :o
[07:57] <gladier> ah k
[07:57] <gladier> my head is in another place lol
[07:57] <gladier> either way
[07:57] <gladier> windows server on public ip address = soon to become owned
[07:58] <AloneInTheDark> no
[07:58] <AloneInTheDark> why?
[07:58] <AloneInTheDark> that's a weird thing to say
[07:58] <gladier> experience
[07:59] <AloneInTheDark> I have had my win2k3 server since, well 2k3 on the internet, no problems.
[07:59] <AloneInTheDark> It has a firewall Wink

[07:59] <gladier> it has a windows firewall?
[07:59] <AloneInTheDark> yepp
[07:59] <gladier> fail
[07:59] <AloneInTheDark> Explain
[08:00] <AloneInTheDark> want my IP? lets have a go at it, see if u can break in Wink

[08:00] <gladier> seriously ... every windows server that i have seen - no matter how patched or whatever, that is on a public ip gets owned
[08:01] <AloneInTheDark> well, that's a lot of bs imho =)
[08:01] <AloneInTheDark> but that's me.
[08:01] <gladier> meh
[08:01] <gladier> my experience differs from yours Smiley

[08:01] <AloneInTheDark> 1.1.1.1
[08:01] <AloneInTheDark> come'on in =)
[08:02] <AloneInTheDark> u r talking crap I'm afraid if u mean u can break in.
[08:02] <AloneInTheDark> DDoS on the other hand, that's another matter.
[08:02] <gladier> lol i never said i could break in
[08:02] <AloneInTheDark> or whoever
[08:02] <AloneInTheDark> windows firewall closes all ports but those which I choose to open.
[08:02] <gladier> i said that all windows servers that i have seen on a public ip with no firewall other than the windows one - gets rootkitted or whatever else
[08:03] <AloneInTheDark> Now, unless u can show me some hard facts how this machine could be owned, I call ur bs Smiley

[08:03] <AloneInTheDark> How?
[08:03] <AloneInTheDark> that isn't possible.
[08:03] <AloneInTheDark> rootkit is not magic from god, it's an application.
[08:03] <gladier> lol
[08:03] <AloneInTheDark> I got RDP, WWW, FTP opened.
[08:04] <AloneInTheDark> and u r full of crap
[08:04] <AloneInTheDark> give me hard, technical facts... or forever hold your ... Wink

[08:05] <AloneInTheDark> heck, I can even give u an FTP account and u won't be able to break this thing.
[08:05] <AloneInTheDark> lol
[08:05] <AloneInTheDark> win2k getting owned, I can undrestand.
[08:07] <gladier> dude ... you're running IIS with asp.net enabled
[08:08] <AloneInTheDark> oh noes
[08:08] <AloneInTheDark> yes, SO?
[08:08] <AloneInTheDark> IT'S A SERVER.

blowdart
Peek-a-boo

*shrug* It's hard to argue facts with someone that instead substitutes belief.

However yes, IIS *is* a risk; but then so is Apache. Every service you expose to the internet has a risk; but these days it's usually the applications that are exposed that constitute the bigger risk, not the hosting environment.

turrican
Condemnation without investigation is the height of ignorance! - Albert Einstein

In reply to blowdart

#Jul 2nd, 2008 @ 11:16 PM

Yeah, that's what I was thinking. I mean, sure there can be a weakness in an application/site. But the OS itself can not just "get rootkit and owned" by just "serving"... I don't think he knows much about anything when talking down win2k8 like that. Although, my point was also that this seems to be the perception people have about Windows Servers. How could this change, By marketing or reputation in time?

blowdart
Peek-a-boo

In reply to turrican

#Jul 2nd, 2008 @ 11:20 PM

Well the OS itself doesn't do a lot; it's the services that make it useful, be it the GUI, file sharing or whatever. An OS core is minimal, process scheduling and so on.

But you're right, it is perception. IIS6 was pretty darned secure out of the box (heck it was ASP.NET that had the authentication/authorisation bug) and it's an uphill struggle. If you don't pragmatically look at what you want, and what is best for a task then you're limiting yourself; that applies to security as well as functionality.

Maddus Mattus
Do, or do not. There is no try. - Yoda

In reply to blowdart

#Jul 3rd, 2008 @ 12:31 AM

AloneInTheDark for teh win!

Hack my box, come on! Hack it! Put your money where your mouth is,...

He really owned that gladier dude in a professional way. Even though gladier's beliefs are entirely baised, he manages to debunk his statements and persuade him to shut up Smiley

turrican
Condemnation without investigation is the height of ignorance! - Albert Einstein

In reply to Maddus Mattus

#Jul 3rd, 2008 @ 1:28 AM

hehhe, thanks. AloneInTheDark = *me*

ps. I gave him my real IP there, just removed it in the log here.

Edit : He actually never said any more word beyond the last line. I guess he just ran for cover.

Maddus Mattus
Do, or do not. There is no try. - Yoda

In reply to turrican

#Jul 3rd, 2008 @ 1:39 AM

kudos to you then!

I really hate that dialog, you speak of in the first few lines, by the way. You are asked to make a choice without knowing the consequenses. I've spent hours trying to figure out why two Vista PC's on my WiFi couldnt connect to one another. We turned the firewalls off and everything. Turns out that one of the two had identified the network as "public" and everything gets locked down.

As I am typing this I am looking at the dialog I am ranting about;

I really really really need to read better, because it actually gives all the neccecairy information.

Buuuuuuutttt,.. I made that choice two months ago, how could I have know the impact back then? Why cant I have a pop-up saying; "U a$$hat, your program has been blocked because you made this and this choice two months ago! U wish to reconsider?".

Nevermind the rant, lessons learned;

1. Read better
2. Analyse problems top down, dont start at the bottom

cheong

In theory, every software firewall is possible to leak if there are bugs unknown to the maintainers (I say in this way because it's true to other firewalls such as iptables). But I have to add that a firewall that simply drops every connection attempt from outside is not quite "hackable"...

Gladier

In reply to turrican

#Jul 3rd, 2008 @ 1:39 AM

Or perhaps i had to run off because we had a phone call from a new client who wanted viruses off their server.

Either way, my point is valid - no software/security is 100% foolproof/secure.

Look up at BlowDart's comment "Every service you expose to the internet has a risk".

Are you telling me that there will be no new vulnerabilities to the services that you have exposed to the net? Not to mention you are using RDP which can be brute forced/MITM attacked.

Sven Groot
My name has 9 letters. Coincidence? I think not...

In reply to Gladier

#Jul 3rd, 2008 @ 2:35 AM

That is absolutely true. But that doesn't make the statement "windows server on public ip address = soon to become owned" true.

Unless you have some numbers (rather than just anecdotal evidence) to back that up, you have no argument.

turrican
Condemnation without investigation is the height of ignorance! - Albert Einstein

In reply to Gladier

#Jul 3rd, 2008 @ 2:35 AM

You are still full of crap. With your definition, NO PCs with ANY OS EVER should be on the Internet. I don't know what the hell you are ranting about to be honest. You are just uninformed. End of this discussion, I don't have time to educate you.

Sven Groot
My name has 9 letters. Coincidence? I think not...

In reply to turrican

#Jul 3rd, 2008 @ 2:42 AM

The only way to truly make a PC secure is to turn it off, unplug it, and encase it in concrete. Tongue Out

turrican
Condemnation without investigation is the height of ignorance! - Albert Einstein

In reply to Sven Groot

#Jul 3rd, 2008 @ 2:44 AM

Yes, BUT he claims a Windows Server can NOT EVER be directly put out into the Internet since "It gets owned" ...I mean, wtf?

Edit : Any machine is as secure as its admin's knowledge about security. God knows how many Linux and BSD servers a friend of mine owned and infested them with rootkits.

AndyC

In reply to turrican

#Jul 3rd, 2008 @ 2:45 AM

Windows Server 2008 is very, very hard to break in to*. I've not yet seen a successful attack, despite some pretty good efforts by some very knowledgeable people (yes these were authorised attempts!) There is a far greater likelyhood of a vulnerability being exposed via a web application bug than directly via IIS in my experience (and no amount of firewalling/proxying is going to help there).

Is it a risk? Yes. Bigger than getting out of bed in the morning? Probably not.

*The Itanium version even more so. Wink

Pace
In The Mix...

In reply to AndyC

#Jul 3rd, 2008 @ 4:07 AM

exactly.

If you could earn a hell of a lot more money with little risk*, what would you do?

* providing your set it up right.

fknight

In reply to Gladier

#Jul 3rd, 2008 @ 2:35 AM

How do you brute force a login screen that's going to lock you out the fifth time you misguess the password?

Honest question, I really don't know, unless I'm missing some fatal flaw in the Windows logon process as it relates to RDP.