Lunduke
Comedy • Gaming • News • Science & Tech
Which Operating System has the Most Vulnerabilities?
Windows? iOS? Ubuntu? Do you know... for sure?
April 02, 2024
post photo preview

The recent, high profile software vulnerabilities have raised a number of questions about the security of our software.

Three questions which have been on my mind:

  1. Is software less secure now... than it used to be?
  2. Which has more vulnerabilities... Open Source Software or Closed Source Software?
  3. Which Operating System has the most vulnerabilities... and which has the least?

These seem like fair questions to ask.  And, considering the massive amount of data available, we should be able to arrive at some definitive answers.  Yet, when we see discussions around exactly these topics, most of the statements seem to be based on feelings and preferences... rather than hard facts.

Let's fix that.

First we need to grab details on all publicly known CVEs (aka "Common Vulnerabilities and Exposures") -- the standard way of publishing details around exploits and vulnerabilities -- and drill down into that data.  Luckily CVEdetails.com makes obtaining this data incredibly simple (the data below is obtained from there).

Is software less secure now... than it used to be?

The easiest way to begin answering this question is to track the number of CVEs reported per year... and put that data into a pretty graph.

At the current rate, 2024 will have more CVEs than any previous year.

And the results are... not exactly difficult to read.  It goes up pretty much every year -- accelerating, significantly, over the last few years.

  • 2022: 25,083
  • 2023: 29,065

That's a roughly 16% increase in the total reported CVEs... in just one year.

And, at the current rate (January through March of this year), 2024 is on track to hit 35,484 by the end of the year.  Which would be a 22% increase, year on year.

There are two likely possibilities which could explain this:

  1. We are getting much better at finding the vulnerabilities in software.
  2. We are adding more vulnerabilities to software.

And, in fact, both could absolutely be true.

Considering the ever-increasing complexity of our software systems (both in terms of total Lines of Code and number of interdependent systems), it seems reasonable that at least some portion of this dramatic increase in CVEs is thanks to us simply having more vulnerabilities in software.

This is about as close to a definitive answer as we are going to get: Based on the available data, yes.  Software is less secure now than it used to be.

Which Operating System has the most vulnerabilities... and which has the least?

Now let's pull data on all known CVEs... and sort them by Operating System (again, using data gathered from CVEdetails.com).

Behold.

Hello, Debian!

Your eyes do not deceive you.  Debian Linux has had the highest number of reported vulnerabilities, clocking in at a whopping 8,751.

  • Android is in second place, with 7,008 CVEs.
  • And Ubuntu Linux was trailing in third place, with 4,058.

Windows, iOS, and macOS all had significantly lower total numbers of reported vulnerabilities.

Note: I left a variety of BSD and UNIX systems off this list as their number of total CVEs was lower than the lowest entry on the chart.  FreeBSD: 488, OpenBSD: 188, NetBSD: 167, Solaris: 532.

But... that chart above only provides part of the picture, as it includes all CVEs ever reported.

Therefore, while it is a fascinating glimpse into past (and overall) vulnerability, it does not give us a good indicator of the current security of each given OS.

To solve that, let's look at a singular recent major version of each OS.  While the versions below are not all of the same age, each was chosen as: 1) a recent release, 2) publicly available for enough time to be somewhat well tested, and 3) with sufficient data available to be worth evaluating.

Yikes, Android!

The results clearly show Android as the Operating System with the largest number of known vulnerabilities (currently).

  • iOS (for iPhone) has roughly 10% of the reported CVEs as Android.  Or, to put another way, "1,000% more secure".
  • Both Windows and macOS clock in as measurably more secure than Ubuntu (in terms of total number of vulnerabilities found).

The old narrative that "Linux is more secure" appears to be... mostly untrue.

That said, it's entirely possible that the Open Source nature of Linux (and the software ecosystem around it) has enabled a higher percentage of vulnerabilities to be found, compared to Closed Source systems.  But that is purely speculative, and we need to go on what data we have available.

No matter which way you slice it -- modern versions of major Linux Distributions have significantly more known vulnerabilities than modern versions of Windows or macOS.

The Findings

We can safely declare, based on available data, the following:

Q: Is software less secure now... than it used to be?

A: Yes.  Demonstrably so.  And it's getting worse, year on year.

Q: Which Operating System has the most vulnerabilities... and which has the least?

A: Linux based systems contain the most reported vulnerabilities, with Android (Linux-based) leading the pack by a large margin.  Windows, macOS, iOS (and most BSD / UNIX systems) all have significantly fewer known vulnerabilities.

Q: Which has more vulnerabilities... Open Source Software or Closed Source Software?

A: This is a mixed bag.  Open Source BSD systems have significantly less known vulnerabilities (both in total, and per version) than the Closed Source Microsoft Windows.  At the same time, Open Source Linux (and Android) led the pack in vulnerabilities.  One thing we can say for sure: The most vulnerable systems are Open Source (to one degree or another).

I don't like these numbers any more than you do.  Don't shoot the messenger.

community logo
Join the Lunduke Community
To read more articles like this, sign up and join my community today
33
What else you may like…
Videos
Podcasts
Posts
Articles
On the Z-80 Holborn Computers

Remembering the (very) funky Holborn computers of the early 1980s.

The full article: https://lunduke.locals.com/post/5588902/1950s-sci-fi-style-computers-powered-by-a-z80-built-in-holland

00:14:04
On The History of Screensavers: 1961 - 1990

From Sci-Fi novels and Atari... to old Macs and Flying Toasters.

The full article: https://lunduke.locals.com/post/5588984/the-definitive-history-of-screensavers-1961-1990

00:18:01
Mozilla: A Bully from the Very Beginning

The story of how "Firefox" was named.

Read the full article: https://lunduke.locals.com/post/5577706/why-is-firefox-called-firefox

00:19:45
November 22, 2023
The futility of Ad-Blockers

Ads are filling the entirety of the Web -- websites, podcasts, YouTube videos, etc. -- at an increasing rate. Prices for those ad placements are plummeting. Consumers are desperate to use ad-blockers to make the web palatable. Google (and others) are desperate to break and block ad-blockers. All of which results in... more ads and lower pay for creators.

It's a fascinatingly annoying cycle. And there's only one viable way out of it.

Looking for the Podcast RSS feed or other links? Check here:
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

The futility of Ad-Blockers
November 21, 2023
openSUSE says "No Lunduke allowed!"

Those in power with openSUSE make it clear they will not allow me anywhere near anything related to the openSUSE project. Ever. For any reason.

Well, that settles that, then! Guess I won't be contributing to openSUSE! 🤣

Looking for the Podcast RSS feed or other links?
https://lunduke.locals.com/post/4619051/lunduke-journal-link-central-tm

Give the gift of The Lunduke Journal:
https://lunduke.locals.com/post/4898317/give-the-gift-of-the-lunduke-journal

openSUSE says "No Lunduke allowed!"
September 13, 2023
"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

This episode is free for all to enjoy and share.

Be sure to subscribe here at Lunduke.Locals.com to get all shows & articles (including interviews with other amazing nerds).

"Andreas Kling creator of Serenity OS & Ladybird Web Browser" - Lunduke’s Big Tech Show - September 13th, 2023 - Ep 044

My BASIC Adventure With GROK.

I know, no "AI", but this was just too good to pass on. It's an entertaining series of screenshots, wherein I attempt to get GROK to give me a bog-standard bubble sort routine in BASIC, but using the slightly modified syntax of BASIC XE for the Atari. (The last two screenshots are page 118 as the PDF is structured, and page 118 of the actual page numbers, of the BASIC XE reference manual). Also, "SORTUP" and "SORTDOWN" are builtin functions that allow for simple array sorting in BASIC XE.

It just keeps getting worse, and worse... 🤣

Why would any decent programmer trust these things to tell them how to code? It's madness.

post photo preview
14 hours ago

Another look at Norton Desktop.

post photo preview
The History of Ctrl-Alt-Delete
How the "Three Fingered Salute" came to be.

Ctrl-Alt-Del — sometimes known as “The Three Fingered Salute” — is among the most recognizable keyboard commands in the entire computer world. Restarting, or logging into, countless computers since the 1980s.

But... what a peculiar combination of keys!  How, exactly, did it come to be?

Let’s take a tour through the history of this beloved / hated / mocked key combination.

Not the first multi-key reset

Control-Alt-Delete may be the most famous “reset this computer” key combination… but it wasn’t the first.

That honor goes to the Exidy Sorcerer in 1978. A Z-80 powered home computer that never saw the commercial success of its rivals.

The Exidy Sorcerer

Note the two “Reset” keys in the top right of the keyboard.

Ok, that simply is too small to make out.

ENHANCE!

RESET!  RESET!

Much better.

Here we see the two “Reset” keys.

How do you hard reset an Exidy Sorcerer? You guessed it -- press both of these keys at the same time.

In theory this was to make it harder to accidentally reset a machine... having a single "Reset" key would simply be too easy to tap without intending to.  But they put the two keys immediately next to each other.  And right next to "RETURN" -- which you would always be reaching for with a pinky.  Strange keyboard layout choice, right?

It's like putting a "Nuclear Self Destruct" button right next to the "Make a Cup of Coffee" button.

Regardless, the Sorcerer still wins the title of “first computer with a multi-key reset”. So it’s got that going for it.

The IBM 5150

Flash forward to 1981, in Boca Raton, Florida. A team of engineers was about to release the IBM 5150 (aka “The IBM Personal Computer”).

(Yes. The IBM PC was crated in Florida. That random little tidbit doesn’t get talked about much.)

The IBM 5150 Personal Computer

One of the engineers working on the BIOS of the 5150, David Bradley, implemented a three-key reset for the team within IBM (and partners such as Microsoft) to use during development.

A convenience feature that was never intended to see the light of day. Three keys that would quickly reset the entire machine without needing to do a hard “Power off and Power back on”.

That three-key combination?

ControlAltEscape.

“Sorry, Lunduke. You wrote that wrong. It’s Control-Alt-Delete. Not Escape.”

Not at first. In those early days, the key combination was “Ctrl-Alt-Esc”. That’s how the IBM 5150 was originally reset.

That, right there, is a good looking keyboard.

However, all three of those keys being on the left hand side of the keyboard made it too easy to accidentally bump.  You might as well have two "RESET" keys right next to each other (how crazy would that be?).

So the lead programmer of the project, Mel Hallerman, suggested changing “Escape” to “Delete” (which was on the complete other side of the keyboard). Thus making it much harder to accidentally hit.

And, just like that, Control-Alt-Delete was born.

It was not supposed to ship

Considering how instantly recognizable the "Three Fingered Salute" is nowadays, it seems wild to think that it was never intended for the public to even know about -- it was strictly for internal development purposes.

In fact, it barely received any development time at all according to the man who developed it.

“It was five minutes, 10 minutes of activity, and then I moved on to the next of the 100 things that needed to get done.” - David Bradley

David Bradley, the father of Ctrl-Alt-Del.  Photo credit: AP

All that changed when someone included the details of “Ctrl-Alt-Del” in the technical manuals for the IBM Personal Computer.

Here you can see it documented in the “IBM 5150 Guide to Operations” (where it is detailed not once… but three times):

Source: IBM 5150 Guide

At which point… the cat was out of the bag. Ctrl-Alt-Delete was documented and publicly known (and used) by a commercially successful computer.

There was no turning back now. It was a standard. Even if it was never intended to see the light of day.

And, to think, we were this close to having Ctrl-Alt-Escape instead. (Let’s just thank heavens we didn’t get stuck with the double RESET keys…)

Read full Article
post photo preview
The creator of UNIX built a Trojan Horse which let him log in to any UNIX machine.
And nobody knew about it for years.

Back in 1984, the Association for Computing Machinery presented Ken Thompson with a “Turing Award” for his many contributions to the world of computing.

And for good reason.

Ken worked on Multics, co-created UNIX, created multiple programming languages (Bon and B — which directly led to C), co-created the Plan 9 operating system, UTF-8, and on and on.  If anyone deserves an award for advancing computing... it's Ken Thompson.

But we’re not here today to talk about those extraordinary contributions to computing.

No, sir.

We’re here to talk… about his acceptance speech.

Because that speech revealed a truly fascinatin computer virus that Thompson had created years earlier… for the C compiler.  One which gave him a backdoor into UNIX itself.

The Speech

He titled his speech “Reflections on Trusting Trust”, and the basic premise is this:

“To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software.”

To prove his point, Ken told the tale of how he had — years earlier — created what was, essentially, a computer virus that infected the C compiler (cc) and the UNIX login program.

Seriously.

This is real.

Ken could gain control of most UNIX systems

It worked, essentially, like this:

Ken modified cc (the C compiler on UNIX systems) so that — only when it was compiling UNIX’s “login” program — it would inject a small “backdoor” (into “login”) that would allow him to log in as any user on the system if he used a predefined “password”.

Which is, obviously, a pretty big security hole.

However…

That sort of "universall password" code would be likely to be found during even a rudimentary code review of the C compiler. Or, heck, even by any casual programmer who happened upon that section of the code.

What Ken did next was… devious.

Hiding his UNIX backdoor

He needed to make sure that, should anyone find his nefarious code in “cc”… that his backdoor would live on.

So he then added functionality to “cc” so that it would detect if it was compiling itself (because the C compiler was compiled… in the C compiler)… and insert code into the compiler that would add… itself.

Which means…

Even if the source code is removed from “cc” project… the code (for adding both the login backdoor and the “keep adding this to the C compiler” bits) would get “invisibly” injected into “cc” every time it got compiled by an already infected build of the compiler.

So… as long as there was an unbroken chain of using the C compiler from that point onward, the UNIX login backdoor was unlikely to be effectively removed.

Brutal.

According to Thompson:

“The actual bug I planted in the compiler would match code in the UNIX "login" command. The replacement code would miscompile the login command so that it would accept either the intended encrypted password or a particular known password. Thus if this code were installed in binary and the binary were used to compile the login command, I could log into that system as any user.”

The Moral of the story

As Ken Thompson put it…

“The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect.”

Did this make it out into the wild?

I know what you're thinking.  "Is this code still out there?  How many systems were impacted by this?"

What we know: This bit of naughty code was released to at least one machine (used by a UNIX support group). This has been confirmed by Ken, himself.

However, it is believed that the code went no further than that machine.

But... do we know for sure?

Do we actually have a high level of confidence that the modified “cc” and “login” went no further than that support group UNIX box?

No. No, we do not.

In fact, according to Eric S. Raymond

“[I have] heard two separate reports that suggest that the crocked login did make it out of Bell Labs, notably to BBN, and that it enabled at least one late-night login across the network by someone using the login name “kt”.”

BBN.  That's Raytheon.  A critical DARPA researcher -- one which was instrumental in the early days of ARPANET.  A huge amount of software came out of BBN.  Heck, even the first Text Adventure game came from there.

If UNIX machines at Raytheon BBN were infected... the possibility of infected versions of those files making it to other sites is incredibly high.

Truly wild

Which leads to a (rather amusing, and mildly terrifying) bit of historical trivia:

Ken Thompson — one of the co-creators of UNIX — intentionally created a trojan horse that infected both the C compiler and the “login” program of UNIX systems.

What’s more… it went undetected for years.  We wouldn't even have known about it, if he hadn't told us he created it.

And we truly have no clue how widespread that trojan became.

Read full Article
post photo preview
The Definitive History of Screensavers: 1961 - 1990
Sci-Fi Novels, CRT Screens, & Flying Toasters

Screensaver’s were all the rage in the 1990s. From Flying Toasters to 3D Mazes, screensavers were found on every major operating system across the land.

Screensavers are a fun, and loved, part of the 1990s (and onward) computing experience. But what was the very first one created? What is the story behind the early screensavers? Inquiring minds want to know!

Let’s dive into the glorious early history of… the Screensaver.

The Dreaded Screen Burn-in

Leave any CRT screen (be it a standard television , computer monitor, or even an oscilloscope) on for too long — with the same, non-moving image — and you’ll eventually give your CRT something known as “Burn-in”.

PLEASE WAIT

Burn-in is caused by the way CRT’s work: The phosphors which produce the light on the screen tend to lose their luminance over time. Over-use of specific areas will, eventually, cause a dramatic enough change that ghost images can appear.

Screensavers were created to reduce this problem. By making sure that no single portion of the screen could sit, displaying the exact same image, for too long of a period.

1961

The first known reference to something akin to a screensaver is in Robert Heinlein’s Sci-Fi novel, “Stranger in a Strange Land”.

“They went to the living room; Jill sat at his feet and they applied themselves to martinis. Opposite his chair was a stereovision tank disguised as an aquarium; he switched it on, guppies and tetras gave way to the face of the well-known Winchell Augustus Greaves.”

A fish aquarium screensaver (or something very close to it), talked about all the way back in 1961. Pretty cool.

This was, of course, merely a casual reference in a work of fiction. Still… fun to note where Sci-Fi predicts reality.

Many years passed without any actual screensaver being produced. Until…

1977

In 1977, a handful of games for the new Atari Video Computer System (later named the Atari 2600), included simple color cycling effects in order to prevent screen burn-in.

The Atari VCS 2600

Were these full fledged “screensavers” as we know them nowadays? Not exactly. But they did serve to “save the screen”.

1979

Then, in 1979, Atari released two computer systems: The Atari 400 and 800. Much like the Atari 2600, these Atari computers used a color cycling effect in order to limit screen burn-in. In this case, the effect kicked in after the computer sat idle for a number of minutes.

The Atari 800

Not exactly a "Screensaver" -- at least not as we know them today.  But it's the early steps in that direction.

1983

A few years later, in January of 1983, the Apple Lisa (the precursor to the Macintosh) was released. Within it was a system wide Preferences application that allowed the user to set the Lisa to “dim” the display after a definable amount of time.

Apple Lisa Preferences

Note the non-specific amount of time to wait before the screen dims. “I would like the screen to dim between, say, 15 and 30 minutes after I stop using it.”

I find the large time windows highly amusing.  Could the Apple Lisa not handle specific amounts of time?  Fascinating.

Just the same, this is notable as it is the first time an easily configurable “screensaver” like utility is provided on a computer.

Later that same year — in the December, 1983 issue of Softalk Magazine, a young programmer named John Socha published the source code for a small piece of software he dubbed “SCRNSAVE.COM”.

Save Your Monitor Screen!

That first PC screensaver was pretty darn simple — it made the screen go blank after an amount of time set in the source code. And, because this was the early 1980’s, you typed the whole thing in by hand from the pages of a magazine.

Want to change how long your computer would wait until the screen went blank? Modify the source code and re-compile.

Side note: Many claim that John Socha’s SCRNSAVE.COM was the first screen saver. Clearly the Apple Lisa shipped first (as did the Atari 400/800). But it very well may be the first screensaver for the IBM PC, which is already a very cool badge of honor. Also worth noting that its author, John Socha (who is also the creator of Norton Commander), would go on to significant things in the screensaver world.

1988

Every attempt at "saving screens", up until now, had been pretty... dull.  Black screens.  Color cycling.  Just enough to pevent screen burn.  That was about to change.

The first publicly released screensaver package which contained distinct, configurable displays… was the “Magic ScreenSaver” for Windows 2.0, first released in 1988 by Bill Stewart and Ian Macdonald as a piece of shareware.

Passwords!  Sleep area!  All the basics of screensavers are here!

The early versions of Windows did not contain any built-in screensaver functionality. Magic ScreenSaver added that. And it looked like this:

Oooooooh.  So many lines.

This was it.  Magic ScreenSaver in 1988.  This was the turning point when "Screensavers" became "Screensavers" as we know them today.

1989

Remember how the Apple Lisa had a built-in screen dimming functionality? Strangely, just like early Windows, the Macintosh did not have anything like that.

Enter: After Dark.

Originally developed by James Eastman, After Dark was a screen saver package for the Macintosh. It was initially an un-named hobby project which, after it was shared with a friend at Berkeley Systems, was acquired and renamed “After Dark”.

The first version of After Dark.

The first release of After Dark used no bitmap artwork (relying entirely on programmatically generated graphics) and was not anticipated to be a big hit. But it was. And the crew at Berkeley then scrambled to polish it up and release a new version.

1990

Berkeley Systems pushed ahead on adding a new artistic flair to After Dark as they worked on the 2.0 release for Macintosh.

To bring a Windows version to market, they contacted the makers of Magic ScreenSaver to modify and enhance their shareware software… thus morphing it into “After Dark for Windows”.

The 2.0 release brought with it a small pile of new screen saver animations…

Welcome to Windows, After Dark.

But the real breakout hit was “Flying Toasters”.

Fly!  Fly you toasters!

In a 2007 interview with LowEndMac, the creator of After Dark (James Eastman) recalls the birth of those flying toasters:

“For 2.0 we needed to build more personality into it – really engage. We thought this over in the abstract for quite a while. My wife’s a doctor – she was doing her residency then and was frequently gone overnight. So I’d sit up late programming. Very late.

 

I had a Mac II with a color screen – $5,000 computer in those days.

One of those late nights I was thinking about the artistry problem – how to do something really fun for 2.0.

 

I was wandering around the house. I drifted into the kitchen, and the toaster caught my eye. My sleep-deprived brain put wings on it.

 

I went upstairs and drew some animation frames – I used the development system’s icon editor. Little white outline toasters on a black background with little stubby plucked-chicken wings speed lines and a flapping electrical cord. I coded up the animation that night and brought it to Berkeley Systems the next day.

 

Everybody thought it was hilarious and everybody agreed it needed to be redrawn.

Wes brought in an artist to re-render the toasters, and Patrick re-coded the module in C. The modules all had a little control panel – I insisted on having a slider that controlled the doneness of the toast.”

The result was an instant hit — and an enduring classic.

The "doneness" of the toast was, indeed, a nice touch.

Which brings us to the end of 1990… the popularity of the screensaver was about to explode.

And, wouldn't you know it, the release of After Dark 2.0 brough with it a Screensaver module named "Aquatic Realm".  A virtual fish tank.

Just like Robert Heinlein wrote about way back in 1961.

After Dark's "Aquatic Realm"

From Sci-Fi novel to reality.  Only took us 29 years to get there.

Not too darn shabby.

Read full Article
See More
Available on mobile and TV devices
google store google store app store app store
google store google store app tv store app tv store amazon store amazon store roku store roku store
Powered by Locals