Hacking is a Low-Hanging Fruit Exercise

khess 0 403 Views

Responses (from another site) on my recent, "Security Alert: They Should Have Used Linux" led me to explore the conclusion that hacking is really only for those seeking the low-hanging security fruit as their prey. These folks, who tout themselves as "Linux Experts" intrigued me so much with their comments that I'm compelled to write this post as an analysis of that dialog. One said that, "Hacking is a business. Windows is targeted because of the size of the target... combined still over 90%, and XP allegedly *still* 65%+." Still another asserted that, "Windows is the most attractive target for botnet crackers because of its ubiquity...." Could this be true? Could it be that hackers are simply hitting Windows because it is the biggest target?

I beg to differ.

I think Windows is an easy target because it has some pretty glaring insecurities. But it isn't the least secure out of the box OS.

One of the commenters said, "I myself recently changed from PCs running Linux to MacBooks for both work and home; though almost all of my work is via ssh to Linux or FreeBSD servers."

Want to know which OS (from Mac OS X, Windows Vista and Ubuntu Linux) was hacked first at two (that I know of) security conferences?

It wasn't Vista. It was hacked on the last day of the conference.

It wasn't Linux. It was never hacked.

Wait for it...

If you said Mac OS X, you're correct.

Some guy won a $10K prize by hacking it within two minutes of the start of the competition.

It isn't as my commenters suggest, that Windows is just so ubiquitous, that it's a target of more hacks. If hackers were simply low-hanging fruit grabbers, they'd grab Mac OS X first.

I believe that if Linux were in the Desktop use majority, it would still be the most secure and least vulnerable to hacks. Perhaps the true blackhat-wearing hackers would use their powers for good since hacking Linux would prove so unprofitable for them.

If ubiquity were truly the attraction for hackers, then Linux would be the most hacked OS because most Internet sites run on Linux with Apache.

What do you think? Is hacking just an exercise for those who seek the low-hanging fruit or is there more to it than that?

Dani AI

Generated

Brief answer: attackers are opportunistic, but "low-hanging fruit" is only part of the story. The economics of attack matter — automated scanners, exploit kits and botnets look for unpatched or misconfigured systems because that scales, while human attackers reserve effort for higher-value targets. Recent incident analyses show a big rise in exploitation of known (often internet-exposed) vulnerabilities and a pattern of automated scanning that finds misconfigurations quickly. (verizon.com)

That helps explain why large-market OSes get hit more, but it doesn't mean any OS is inherently immune. Server compromises are usually driven by vulnerable applications, outdated components, or security misconfiguration rather than kernel exploits. The OWASP Top Ten repeatedly highlights security misconfiguration and vulnerable/outdated components as top causes of web-app breaches — so running Apache on Linux doesn't magically eliminate risk if the web stack or apps are left exposed. (owasp.org)

Concrete steps make a system "not worth the squeeze." Patch and automate updates, reduce the service footprint, enforce least privilege for web processes, deploy a host firewall and intrusion-mitigation (fail2ban), add WAF/mod_security for Apache, and use mandatory access control (SELinux/AppArmor) plus monitoring and alerts. Following a vetted baseline (CIS Benchmarks) helps turn those tasks into repeatable checks. Example quick commands and ssh hardening hints:

sudo apt update && sudo apt upgrade -y
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable

# minimal sshd_config examples
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no

For Apache: disable unused modules, limit HTTP methods, enable TLS, hide server tokens, and log+monitor for web-shell indicators. Automated patching and continuous scanning move an admin from "easy target" to "inconvenient target." (cisecurity.org)

In short: many compromises are low-effort and opportunistic, but attackers also follow reward. Removing the low-effort wins (patching, removing defaults, proper configs, monitoring) is the fastest way to stop being the low-hanging fruit that warned about and to implement the sensible hardening suggested. (verizon.com)

Member Avatar for marqueue
marqueue 0 Newbie Poster

I suppose you must be right really. As a home user of Linux I feel acceptably safe using Ubuntu out of the box, but if I ran servers I might well look at Selinux or using OpenBSD. I take reasonable steps based on my assessment of how big a target I pose and I'm sure smart hackers reciprocate by weighing the likely profits against the estimated ease of the task. I guess it just isn't worth the effort of targeting a Linux home user, but it might be worth catching the odd "low hanging" badly configured XP box, even at home.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview