5 ms·

As the saying goes, viruses on Linux are hard to get right because you need to make assumptions about API/ABIs, libraries, required dependencies, etc. which is

As the saying goes, viruses on Linux are hard to get right because you need to make assumptions about API/ABIs, libraries, required dependencies, etc. which is never assured across-the-board. Oh wait... Good desktop software needs all that too...

Dylan16807 6y ago
You can just have a static binary......
- throwawaygulf 6y ago
  You can't statically link a vulnerable process running with elevated privileges.
simion314 6y ago
That would be a really bad virus that tries to depend on GNOME/GTK or some other library. Maybe you are thinking at those terrible web based viruses where an Windows XP themed popup appears that tells you that you need to download and run something to fix your computer. So it is harder for those guys to detect the correct theme to use for their popup to trick the user.
danieldk 6y ago
As the saying goes, viruses on Linux are hard to get right because you need to make assumptions about API/ABIs The Linux system call interface is stable. Or if you want to go up one level of abstraction, glibc has great backwards compatibility (using versioned symbols). GNU/Linux viruses are fairly uncommon, because (virtually) no one uses Linux on the desktop. So, it is much harder to spread. (Disclaimer: not a bashing attempt, I use Linux on the desktop.)
- superkuh 6y ago
  >glibc has great backwards compatibility (using versioned symbols). As long as the virus or other software dev can restrain themselves from using the latest added features to glibc and c++??. Usually they can't so compiling something written with today's libs on a distro from 5 years is infeasible.
- pmontra 6y ago
  Ransomware for Linux servers would take down most of the servers on internet. One of them made news on November https://www.zdnet.com/article/linux-version-of-ransomexx-ransomware-discovered/ https://www.zdnet.com/article/linux-version-of-ransomexx-ran...
Blikkentrekker 6y ago
It's fairy easy to statically link everything into malicious software, as the imperative of malware is obviously neither to respect the user's wishes, nor to protect itself against vulnerabilities that might compromise the user. The problem is that the word “virus” is not of any technical significance. The way I see it there are two important classes of malicious software: 1) The class that relies on being executed normally by the user, but then does things contrary to what the user expected it to. 2) The class that actually exploits design oversights to be able to run with privileges, or run at all, when it was not intended to by the user. The latter class is obviously of a significantly larger concern. “GNU/Linux” is also a social buzzword bereft of any technical meaning. Nothing exists that deserves to be so grouped together under “GNU/Linux” for any technical reasons, and the exploitations that class 2 exploits often have nothing to do with it. There recently was such an exploit that allowed malicious code to be executed ex nihilō. More specifically, it relied on an indexing dæmon that ran in the background and indexed media files, by creating a specifically crafted malformed image file, it could trick this dæmon into executing arbitrary code, apparently even as root as the dæmon ran as root and was shared between all users as I read it. Such exploits are not a “GNU/Linux” issue; they are an issue of whatever system has this dæmon both installed and running. Apparently Fedora had, but my system does not. The majority of such escalations these days seem to have little to do with either GNU or Linux, and mostly seemed to exploit “Freedesktop”, which is known to favor copying certain design sensibilities from Windows and with it the kind of escalative holes that such design sensibilities often bring with them, such as the aforementioned.
- throwawaygulf 6y ago
  This is some great Stallman copypasta! A variation of https://stallman-copypasta.github.io/ https://stallman-copypasta.github.io/
TacticalCoder 6y ago
> Oh wait... Good desktop software needs all that too... Are you saying it's not possible to have good desktop software on Linux? Users of JetBrains' IntelliJ IDEA and users of, say, Blender, are going to disagree (for example).
- klodolph 6y ago
  Good desktop software is harder to develop for GNU/Linux, nit impossible to develop for GNU/Linux.
heavyset_go 6y ago
I can run binaries that I compiled 20 years ago on Linux. I can't do the same with, say, macOS binaries.

Dylan16807 6y ago

You can just have a static binary......

throwawaygulf 6y ago
You can't statically link a vulnerable process running with elevated privileges.

simion314 6y ago

That would be a really bad virus that tries to depend on GNOME/GTK or some other library. Maybe you are thinking at those terrible web based viruses where an Windows XP themed popup appears that tells you that you need to download and run something to fix your computer. So it is harder for those guys to detect the correct theme to use for their popup to trick the user.

danieldk 6y ago

As the saying goes, viruses on Linux are hard to get right because you need to make assumptions about API/ABIs The Linux system call interface is stable. Or if you want to go up one level of abstraction, glibc has great backwards compatibility (using versioned symbols). GNU/Linux viruses are fairly uncommon, because (virtually) no one uses Linux on the desktop. So, it is much harder to spread. (Disclaimer: not a bashing attempt, I use Linux on the desktop.)

superkuh 6y ago
>glibc has great backwards compatibility (using versioned symbols). As long as the virus or other software dev can restrain themselves from using the latest added features to glibc and c++??. Usually they can't so compiling something written with today's libs on a distro from 5 years is infeasible.
pmontra 6y ago
Ransomware for Linux servers would take down most of the servers on internet. One of them made news on November https://www.zdnet.com/article/linux-version-of-ransomexx-ransomware-discovered/ https://www.zdnet.com/article/linux-version-of-ransomexx-ran...

Blikkentrekker 6y ago

It's fairy easy to statically link everything into malicious software, as the imperative of malware is obviously neither to respect the user's wishes, nor to protect itself against vulnerabilities that might compromise the user. The problem is that the word “virus” is not of any technical significance. The way I see it there are two important classes of malicious software: 1) The class that relies on being executed normally by the user, but then does things contrary to what the user expected it to. 2) The class that actually exploits design oversights to be able to run with privileges, or run at all, when it was not intended to by the user. The latter class is obviously of a significantly larger concern. “GNU/Linux” is also a social buzzword bereft of any technical meaning. Nothing exists that deserves to be so grouped together under “GNU/Linux” for any technical reasons, and the exploitations that class 2 exploits often have nothing to do with it. There recently was such an exploit that allowed malicious code to be executed ex nihilō. More specifically, it relied on an indexing dæmon that ran in the background and indexed media files, by creating a specifically crafted malformed image file, it could trick this dæmon into executing arbitrary code, apparently even as root as the dæmon ran as root and was shared between all users as I read it. Such exploits are not a “GNU/Linux” issue; they are an issue of whatever system has this dæmon both installed and running. Apparently Fedora had, but my system does not. The majority of such escalations these days seem to have little to do with either GNU or Linux, and mostly seemed to exploit “Freedesktop”, which is known to favor copying certain design sensibilities from Windows and with it the kind of escalative holes that such design sensibilities often bring with them, such as the aforementioned.

throwawaygulf 6y ago
This is some great Stallman copypasta! A variation of https://stallman-copypasta.github.io/ https://stallman-copypasta.github.io/

TacticalCoder 6y ago

> Oh wait... Good desktop software needs all that too... Are you saying it's not possible to have good desktop software on Linux? Users of JetBrains' IntelliJ IDEA and users of, say, Blender, are going to disagree (for example).

klodolph 6y ago
Good desktop software is harder to develop for GNU/Linux, nit impossible to develop for GNU/Linux.

heavyset_go 6y ago

I can run binaries that I compiled 20 years ago on Linux. I can't do the same with, say, macOS binaries.