LinuxUNIX More Vulnerable Than Windows says CERT !! 71

In comp.os.linux.advocacy, boson wrote on 1 Jan 2006 11:43:51 -0800

What a coinkydink. I got 5,556 hits per week on port 445 of my firewall from Christmas to New Year's. There must be some connection between each and every one of those vulnerabilities and a hit on my firewall.

Hmm...a very mbuttive Linux security problem, yes. Let's see what service that is... *type type* lessetc-services *type type*445 *type*

microsoft-ds 445-tcp Microsoft-DS microsoft-ds 445-udp Microsoft-DS

Hmmm...wait. That can't be right.

*type type*

OK, lessee. Hmmm, 3463 hits on port 1026.

Unlisted?

OK, 2927 hits on 137.

netbios-ns 137-tcp # NETBIOS Name Service netbios-ns 137-udp

2835 hits on 135.

epmap 135-tcp loc-srv # DCE endpoint resolution epmap 135-udp loc-srv

2688 hits on 1027.

Unlisted.

2661 hits on 138.

netbios-dgm 138-tcp # NETBIOS Datagram Service netbios-dgm 138-udp

1186 hits on 139.

netbios-ssn 139-tcp # NETBIOS Session Service netbios-ssn 139-udp

1007 hits on 5971.

Unlisted.

798 hits on 6348.

Unlisted.

288 hits on port 28433.

Unlisted.

I could go on but apart from 132 hits on port 80 and 52 on port 22 there's not much of interest. (Webmin et al fans, watch out, though; I got 7 hits on port 10000, and 2 hits on port 1080.)

Interestingly, I got no hits at all on port 2049. None. Nada.

nfs 2049-tcp # Network File System nfs 2049-udp

I have logs for several months and still no hits on port 2049. It's possible Earthlink is filtering them out.

No hits on port 631, either. CUPS fans can relax; no malware will infect your printer.

The expanded scope query got some weird readings; port 42206 was quite popular, for instance (6th). He didn't show up on my year-end scan, though.

So...erm...what was the major security risk for Linux, again?

-- It's still legal to go .sigless.