Need the Most Unsecure Linux Ever? Just Get Damn Vulnerable Linux!

When choosing which OS to run, or when updating to the latest version of your preferred OS, chances are that you are thinking about the improved security you’re about to equip yourself with. Well, at least I hope you do. What you probably don’t think about, or stress over, is just how unsecure the OS is. It’s even more unlikely that you go and seek out the most vulnerable OS out there.

But if you were looking for such a thing, then you wouldn’t have to look too far. Believe it or not, a Linux distribution exists with the sole purpose of being as vulnerable as possible, and it’s named rather appropriately, “Damn Vulnerable Linux”. This distro isn’t meant to be proof that Linux is vulnerable, because it includes unpatched versions of many bugs that have been patched long ago in current distros, such as Ubuntu, openSUSE and so forth.

The goal of DVL is of course not to make people even more vulnerable, but to act as a platform for those who need a vulnerable PC for research purposes, whether it be a hacker honing his skills (for good, hopefully), or students, looking to improve security as a whole. It seems silly as a whole that such an OS exists, but in reality this will act as a very important and accessible tool for those who set out to improve our PC’s security.

I think it goes without saying, that this is an OS not to be installed on a home PC. And if you needed any proof of that, perhaps the ISO filename of, “DVL_1.5_Infectious_Disease.iso” can act as a big enough tip-off!

(Image courtesy of DistroWatch)

Damn Vulnerable Linux (DVL) is everything a good Linux distribution isn’t. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn’t built to run on your desktop – it’s a learning tool for security students. The main idea behind DVL was to build up a training system that I could use for my university lectures. My goal was to design a Linux system that was as vulnerable as possible, to teach topics such as reverse code engineering, buffer overflows, shellcode development, Web exploitation, and SQL injection.