Please read the NOTES.
Links to individual graphs.
Other Resources
Statistic of the Month.
Subpoena Derby.
Trends in Defacements by Webserver, August, 1999 - August, 2000:
Webserver Graphs
Total Defacement Trends, January 1999 - August, 2000:
Total Defacement Graphs
Trends in Defacements by Operating System, August, 1999 - August, 2000:
Operating System Graphs
Defacements counts by year, month, and since August 1999, Operating System:
Operating System Tables
Defacements categorized by Country and TLD (Top Level Domain), including Banks,
Churches, Police Stations (Over 70 Linked pages by Domain):
Country and TLD breakdown
Special, 1999 only run for Countries, TLD's and OS:
1999 Country and TLD Breakdown
Graph Table of Contents:
OS totals by month, August 1999 to Present
*BSD Moving Average, August 1999 to Present
Linux Moving Average, August 1999 to Present
Solaris Moving Average, August 1999 to Present
NT Moving Average, August 1999 to Present
Moving Average, All OS's Together, August 1999 to Present
Daily Cumulative Totals, All OS's Together, August 1999 to Present
Pie Chart of Overall OS Share, August 1999 to Present
1999 vs. 2000 Daily Cumulative Totals Comparison
1999 to Present Scatter Plot of Defacements per Day with Fitted Line
1999 to Present Spike Plot of Defacements per Day with Average per Day.
1999 to Present Histogram of Defacements per Day
| RANK | Group | Defacements | Days Active | Latest Defacement |
|---|---|---|---|---|
| 1. | forpaxe | 156 | 466 | 01aug00 |
| 2. | antichrist | 142 | 163 | 10dec99 |
| 3. | dhc | 116 | 310 | 08aug00 |
| 4. | gh | 115 | 268 | 07aug99 |
| 5. | gforcepakistan | 110 | 175 | 16aug00 |
| 6. | crimeboys | 102 | 166 | 10jul00 |
| 7. | mcm4nus | 100 | 138 | 07aug00 |
| 8. | pakistanhc | 99 | 272 | 01apr00 |
| 9. | acidklown | 94 | 273 | 04jun00 |
| 10. | ph33rtheb33r | 76 | 275 | 08aug00 |
(Note: 1995 to August 18, 2000; entire archive)
If you have an idea for a statistic you'd like to see from the mirror, feel free to email me your suggestions: munge@attrition.org
Subpoena Stats
One 2703d Subpoena has been delivered under seal. It requested information
on two individuals. Apparently the FBI thought it easier than delivering
two seperate subpoenas. The previously listed "pending" subpoena was never
delivered.
Notes:
It goes without saying that Attrition does not get every defacement that is reported to us, that not all defacements are reported to us, and that these statistics refer only to our archive.
All of the tallies, graphs, tables, and etc., count each "Mass Hack" as one defacement unless otherwise stated.
These statistics are prepared with a combination of Perl and a commercial statistics package, Stata. All graphics are from Stata.
Discrepancies: Yes. The easiest discrepancy to find is between total defacements and adding up the totals for each month. On one hand, a total and accurate count of the entire archive is desired, on the other, when we do date-based calculations or tallies, we kick out incomplete dates. Since we have a number of mirrors that don't have a complete date, the date-based calculations and the total count differ. Most of the incomplete dates are from or before early 1999.
Comments on the graphs:
We have gradually included more graphs, and more recently (July 2000) some of
these have been specifially designed to
clarify some of the previous graphs. In some of the claims being made about
these graphs, the moving average of percent of Operating System share
graphs have been misunderstood
to mean everything from reflecting trends in total defacements to Attrition's
advocacy of certain Operating Systems for security purposes. As an antidote,
consider the recent statistics for *BSD: A glance at the moving average graph
for the June 2000 period might lead one to
believe that the total defacements for *BSD has increased over the period
of June. But such is not the case, as a glance at the monthly
totals graphs and the Operating System
monthly tables demonstrates: *BSD defacements actually
fell between May and June from 37 to 24. That said, *BSD's relative share
did increase due to larger relative decreases in other Operating System shares,
which is reflected in the moving average graph. All said, the moving average
graphs are very useful so long as we understand what they actually reflect.
Other Resources:
The Bugtraq Vulnerability Database Statistics
http://www.securityfocus.com/vdb/stats.html
The Netcraft Web Server Survey
http://www.netcraft.com/survey/
The E-Soft Web Server Survey
http://www.securityspace.com/s_survey/data/
Last modified: Fri Aug 18 12:34:48 CDT 2000
