Comment on Is Antivirus needed in 2024?

CountVon@sh.itjust.works ⁨9⁩ ⁨months⁩ ago

• illi@lemm.ee ⁨9⁩ ⁨months⁩ ago

  Can you please help me understand why antivirus is not needed on linux? Are there no viruses for linuxor what?

  source

  • treadful@lemmy.zip ⁨9⁩ ⁨months⁩ ago

    Generally speaking, in reverse order of strength of argument:

    • Linux is built a little more securely. There’s a ton of caveats here but it is generally harder to privilege escalate. (inb4 someone sends me a list of escalation attacks)
    • The user base is generally more security conscious (i.e. doesn’t just run random executables)
    • Doesn’t have the same attack surface (like default exploitable services)
    • The ecosystem isn’t a monoculture so it’s harder to build one-size-fits-all malware
    • The market share is so low that it’s rarely ever a target of malware

    Mostly it doesn’t make sense for attackers looking for low hanging fruit to attack Linux machines.

    source

    • uranibaba@lemmy.world ⁨9⁩ ⁨months⁩ ago

      The last point is probably biggest point today. A hacker wants your money, and you as an individual do not have that much money. A company on the other hand, they can pay up big.

      Since a lot of companies use Windows, they target that, because that is where the money is.

      source

      • ramble81@lemm.ee ⁨9⁩ ⁨months⁩ ago

        Except servers. They are very much an attack vector there.

        source
      • fine_sandy_bottom@discuss.tchncs.de ⁨9⁩ ⁨months⁩ ago

        Nonsense. Hackers get money these days by holding data to ransom.

        Not much data on personal computers.

        source

        • -> View More Comments
    • agent_flounder@lemmy.world ⁨9⁩ ⁨months⁩ ago

      I think it is more about market share than anything. Viruses targeting the end user are, I think, fairly uncommon. But I don’t think remote and local exploits are particularly rare since Linux has massive server market share. I don’t have stats handy so maybe I’m full of it, idk.

      I don’t think Windows has much in the way of default exploitable services anymore. Neither does Linux. I mean back around 2000 it was kind of a nightmare on both platforms. But default configs have gotten pretty good in 20+ years.

      I’m not aware of a whole lot preventing various local privilege escalation attacks on Linux but maybe there have been developments in the last several years that I’m not aware of?

      I know Windows 10 implements some additional memory protections for the LSA subsystem process to address Pass-The-Hash attacks.

      Linux still has setuid/setgid executables as one vector. But I would imagine various forms of kernel exploits are more or less similar to both.

      source
  • CountVon@sh.itjust.works ⁨9⁩ ⁨months⁩ ago

    There are some viruses that have targeted Linux, but they’re rare compared to other platforms and their ability to spread is relatively low. One of the main reasons is just down to how software tends to be installed on each platform. Viruses have an easier time spreading on Windows or OSX where users are more accustomed to downloading an executable and running it. Once there’s a malicious running process, it has a comparatively high chance to spread because it can attempt to escalate its privileges either by exploiting a bug or socially engineering the user to click through a privilege escalation prompt. That entire workflow is practically nonexistent on Linux, users just don’t tend to download and execute random binaries. Instead most Linux software gets delivered in one of these ways, each of which has impediments that reduce the chance a virus could spread:

    • through an OS repo; it would be difficult for a malicious actor to get a virus through the release process and into a trusted repo
    • through a public source like Github; again it would be difficult for a malicious actor to get a virus into public source code without someone noticing
    • through a container image from an image library like DockerHub; I believe a malicious container would be sandboxed, making it hard if not impossible for that container to take over the host system
    • through an application image like a snap, flatpak or appimage; again, I believe these run in their own sandbox from which they would have difficulty breaking out

    There are some exceptions, for example some companies like Hashicorp will distribute their stuff as precompiled binaries. Even in that case you’re probably fine as long as you don’t run the downloaded binary as root. Users in the habit of downloading strange binaries from sketchy places and running them as root just aren’t very common among the Linux userbase. I’m sure there are some (and they should really stop doing that), but there aren’t enough of them to allow a virus to spread unchecked.

    source
  • agent_flounder@lemmy.world ⁨9⁩ ⁨months⁩ ago

    FWIW Linux has malware too.

    See the Threats section of this article:

    en.wikipedia.org/wiki/Linux_malware#Threats

    source

    • const_void@lemmy.ml ⁨9⁩ ⁨months⁩ ago

      That’s a cute little list

      source