2

I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this:

18 packages can be updated.
7 updates are security updates.

I install the updates, only to find a very similar situation the next day.

Even if I update every day, seems like the server will have multiple un-patched security issues at any given time!

Seems like a server accessible from the Internet is all but guaranteed to be hacked in short order, isn't it?

|improve this question
  • 1
    I don't think missing a security update for a few days will cause your server to be hacked 99% of time. I would assume vere few of those security updates are for some super critical RCE vulnerability. If leaving your default Ubuntu server unupdated for a few days would cause it to be hacked practically every server out there would be hacked – trallgorm Feb 15 at 19:26
  • 1
    Think carefully about what ports you have open and what services are listening on those ports. – DarkMatter Feb 15 at 19:31
  • @trallgorm If there was a security update every few months and I installed it a day or two late, intuitively it does not seem very risky, like you say. But seeing the message "7 updates are security updates" after 24 hours, leads me to believe that I can update every day and still have multiple un-patched security vulnerabilities at any given time. – George Feb 15 at 19:36
  • @DarkMatter Indeed, this is good advice. The only services I have listening are sshd (port 22) and systemd-resolve (port 53). I assume that all security updates that the system tells me about are for packages that are actually installed on the server and can be hacked in some way. This is why some updates are called security updates and other aren't. – George Feb 15 at 19:44
  • @George my point was that while you will have un-patched security vulnerabilities, you will likely not be hacked. For example just picking a random recent CVE: cvedetails.com/cve/CVE-2019-6445. All this allows the attacker to do is IF they already have access to your server, they can crash some application that may or may not actually impact anything on your system. Missing the security update patch for that would likely never affect you even if you had it for years. The vast majority of security issues are like that. – trallgorm Feb 15 at 19:57
6

The problem is less likely the security of the Ubuntu system as shipped by the distributor. It is very rare that there are critical issues which allow an remote attacker to hack the system. And while there are sometimes critical issues which allow privilege escalation by a local user they are rare too. But you can actually limit the impact further by only installing the software you really need - anything which isn't there cannot be exploited.

What you see as security updates are almost always less critical problems, like exposing address layout which might be used to bypass ASLR, security updates for software you don't even use but have installed, updates for issues which happen only in specific environments or with non-standard configuration, updates for issues which allow applications to crash (denial of service) but cannot be used to take over the system etc. See usn.ubuntu.com for the details. Anything which might help an attacker to advance is considered a security issue but in most cases the attacker needs to be local already or can only do uncritical harm.

But in no way you should feel secure just because you've applied all security updates coming with the system or feel totally insecure just because you've missed the once from the last days. It is more likely that a hack will be done be exploiting issues in your own web application you've deployed on the server or that you've used weak password to protect parts of your system. It is actually the most common way that system gets owned through thus user-generated weaknesses and not through weaknesses caused by the underlying OS.

Thus, while you should keep your system up-to-date you should not blindly rely on these updates keeping your system secure. Additionally you should make sure that your own applications and configurations are secure too. This aspect might even be more relevant in securing the system than keeping the system always up-to-date.

|improve this answer
  • Thank you, Stephen. Good points in paragraphs 2 and 3. I do not understand paragraph 1 though. If there are very few issues that allow a remote attack or an attack by a local user, what are all these "security updates" that the system is prompting me to install? – George Feb 15 at 20:04
  • @Stephen, your latest comment is the answer to the original question. Would you mind adding it to your answer so that I can accept it. – George Feb 15 at 22:31
  • @George: I've integrated it into the answer. – Steffen Ullrich Feb 16 at 7:16
1

Can it be hacked in days? Sure.

Most known vulnerabilities will never be exploited, but those that are tend to be exploited quickly. Often bad guys are doing recon within a day of an easy to exploit vulnerability going public and have an exploit within two or three days. How do you know what vulnerabilities will be exploited? You don't. That's why patching is so important. And don't ignore patching mediums and lows. While they aren't as important to patch quickly, they can be an important part of a successful breach.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.