9 ms·

Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

29 points by 3np 6y ago

Jonnax 6y ago
Are there any anti virus for Linux that does that heuristic type scanning that you see on windows? Like monitoring for an unknown application doing esoteric things? I presume there's some sort of security software in this space for servers
- 3np 6y ago
  ClamAV is the one I keep seeing used on the server side. Can't speak to as of how effective it is for contemporary Linux malware, but here's a post boasting about heuristics from 10 years ago: https://blog.clamav.net/2011/03/top-5-misconceptions-about-clamav.html https://blog.clamav.net/2011/03/top-5-misconceptions-about-c... Would be interesting to see a benchmark/study evaluating it as a desktop antivirus - but arguably any server-side malware (which I assume is the majority for Linux today) also apply for a large part of Linux workstations.
- itvision 6y ago
  > Are there any anti virus for Linux that does that heuristic type scanning that you see on windows? Next to none.
uniformlyrandom 6y ago
That is not a crazy idea at all. I'd feel a lot safer if I could run some detection on my personal Downloads folder, and on my apt feeds. The problem is, Linux antivirus does not really exist. Granted, there is some software that will scan your files for known signatures - but those signatures are for Win/Mac malware, which solves a completely different problem.
- zokier 6y ago
  Its a bit of chicken-egg problem: "nobody" is buying Linux AV so AV companies are not building extensive databases for Linux, which leads to them being even more useless than their Windows brethren and less desirable to buy.
- itvision 6y ago
  > The problem is, Linux antivirus does not really exist. That's true unfortunately. AV vendors have server solutions (i.e. without UI) for Linux but those scan mostly for Windows/MS Office malware.
GekkePrutser 6y ago
Good point but what is a good free antivirus for Linux?
- eneville 6y ago
  Used clamav a lot in the past, it prevented a lot of Windows viruses making it past qmail on to exchange. Yes, there have been times when distros have allowed things through, but that happens far less than malware getting through in a self service ecosystem. The only benefit I see is that AV may point out that you have software that needs updating. Is running AV on linux worth the downgrade performance that you'd get from dropping your CPU one or two generations and a couple of hours of battery life?
  - GekkePrutser 6y ago
    Oh yeah I used ClamAV in the past on Mac. It wasn't great though.
- itvision 6y ago
  Free or not-free - there are none at the moment. ClamAV last time I checked missed over 30% of in the wild malware which renders it pretty much useless. AV-Comparatives and VBulletin have long stopped testing it for this reason.
  - GekkePrutser 6y ago
    Well there are some non-free ones. I know Cylance supports some linux distros, and so does McAfee. Maybe others too. The thing is I don't really want to use those. I use both in work, McAfee is ancient crufty old crap. Cylance is OK but since the takeover from Blackberry their product has gone downhill rapidly. Also, their Linux version is not available to consumers. Also, if I use one it'd have to be open source. And ideally free in money too, though I could compromise on that if it's not too expensive.
  - sliken 6y ago
    Seems like when I look at the "top 10 anti-virus" type articles that a surprising number of them fail to find relatively common viruses.
TrueDuality 6y ago
This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The truth is that the threat actors targeting Linux almost always do so by "living off the land". A lot of those files are benign or customized to the system leaving the common hash identification method of identifing known malicious binaries as a non-starter. Checking compiled libraries and binaries for sub-classes of behavior also doesn't get very far due to the wide variance of versions across different distributions and customizations done by different administrators. There are a lot of ways to detect or preventing those changes to the system that are actively deployed (none of which are an anti-virus). There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. There are also a lot of risks with an anti-virus itself. To be useful it needs to be deep in the kernel, above root permissions watching everything. Usually these are proprietary and all the major anti-virus names have had security issues in the past. Un-audited proprietary code running inside the Linux kernel is always a sketchy proposition. Which leads us back to the common conclusion that no, Linux does not need an anti-virus. They don't solve any of the security problems mentioned and will consume a large amount of system resources to accomplish nothing.
- itvision 6y ago
  > There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? Or calls exec() on some weird strings.
  - 6y ago
dmm 6y ago
> Most open-source projects accept code submissions from strangers and it's not exactly obvious that these submissions (bug fixes or new features) are what they really are and if they don't have cleverly hidden backdoors. I don't think McAfee will mitigate this scenario. In my experience antivirus programs are so painful and slow that I would accept almost any inconvenience to avoid using them, for example, doing development on air-gapped VMs or even separate physical machines for web browsing, email, and development. For example, every 'npm install foo' command creates thousands of files, in one specific case introducing a virus scan on each one turned a 10s install into a 5 minute one.
- 3np 6y ago
  Nothing says we need to mimic all the ways things are done in Windows just because. Let's say you already have regular zfs snapshots of your workstation, that get synced to one of your servers using something like syncoid or zfs-repl. Then you could have a service that runs e.g. a daily scan of the most recent snapshot. Or regular scans of newly modified files, with a less frequent full filesystem scan locally. The upside of Linux is that you can tailor it to your needs.
yakubin 6y ago
The page outlines some security issues of Linux Desktop. It doesn't explain how an antivirus would mitigate them. It just ends with > As you can see, having a decent antivirus in Linux is not that a crazy idea. Well, actually, it is far from obvious. Antivirus software even on Windows is commonly the thing that makes the system more vulnerable, not less. This page however uses the word "antivirus" as "a magical piece of software that protects the computer against viruses". How does it do that? The idea that to fix a security issue you should install an additional program which "increases" security is dubious. The problems listed on the page are real and we should tackle them. However, I don't think that an "antivirus" is the right solution. Instead security should be treated in a systematic way, not something that you add to a system, after it's done. I think we should invest in, among others, sandboxing techniques, move away from Xorg, write system software in memory-safe languages. Security is not an app to be installed. It's an architectural problem. It's also ironic that most of the points listed on the page apply equally well to antivirus software. Namely, are distro maintainers qualified to verify antivirus code? What if an antivirus gets compromised? An open source antivirus could also get code submissions with cleverly hidden backdoors. And what if it's proprietary? (Most of them are.) They also commonly run with elevated privileges (the point about sudo).
- itvision 6y ago
  > The idea that to fix a security issue you should install an additional program which "increases" security is dubious. For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? > The problems listed on the page are real and we should tackle them. Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them. > Instead security should be treated in a systematic way As the article mentions even distro maintainers do not actually care about the issue that much - often because the maintainers do not get paid for their work and do it in their spare time. You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety. > Security is not an app to be installed. It's an architectural problem. Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop. > Namely, are distro maintainers qualified to verify antivirus code? AV vendors have a reputation to keep. There are not that many of them actually, and a lot fewer than software packages in an average Linux disto (to the tune of many thousands). > They also commonly run with elevated privileges (the point about sudo). That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel.
staticassertion 6y ago
Alternatively, no operating system needs a realtime antivirus, and they're actively harmful. It's fine to run a daily or weekly scan to deal with commodity malware, but otherwise they add no value. The other day we were writing an exploit and defender popped up to block it. It was literally faster to bypass defender than to figure out how to disable it in the UI. Linux is a hilarious security disaster but AV is not the solution.
ignoramous 6y ago
Linux Myths Series: Setting a password secures user data. Not when you can change passwords of any user account if you've got physical access: https://askubuntu.com/questions/24006/how-do-i-reset-a-lost-administrative-password https://askubuntu.com/questions/24006/how-do-i-reset-a-lost-...
- theamk 6y ago
  Same with windows and mac os. You want full-disk encryption or homedir encryption if you want to protect your data.
  - ignoramous 6y ago
    The Linux that's widely in use, Android, has the right default. Linux distros should default to encryption too, though it might be contentious given all the workflows that would then brake.
AzzieElbab 6y ago
I argue that an antivirus program is usually worse than a virus wrt to privacy, performance, and stability of the system, regardless of OS. One notable exception is ransomware.
Uhhrrr 6y ago
Is there a scenario where releasing an update to virus detection software is better than releasing a kernel security update? I guess maybe if the former was many days faster than the latter?
yosito 6y ago
Somewhat related question: is there any way to detect hidden web shells that may be installed on a Linux server? Something like a script that pings a webhook any time any user logs in? I suppose that would be easy to disable if a hacker knows what they're doing. But it could be another layer of security that could tip off an administrator that something is happening.
- theamk 6y ago
  In the modern web dev, you don’t want a mutable web root at all - instead, when you run your deploy command, the entire web root is removed and replaced with latest version from git. So there are few chances to have “web shells” as long as your git repository is intact, and you deploy periodically. That said, if you want extra security, you can add a process monitor which sends an alert any time there is an process running with web server‘s user.
  - yosito 6y ago
    This is a good point. Though I mostly install PHP apps like WordPress or Nextcloud that I'm not managing with git. But I should probably deploy them with something like Docker that I could re-build easily.
ExcavateGrandMa 6y ago
What you need isn't an antivirus... It's an anti distraction...
cbm-vic-20 6y ago
Thinking aloud here. How common are actual computer viruses (not just malware / ransomware, etc) these days? Meaning, an unauthorized program running on a computer that attempts to propagate itself to other computers. This was a real problem in the past when a program would be written to exploit shoddy network code, or when we still used removable media more frequently. I think all the modern OS vendors have locked their platforms down to prevent this mode of attack.

29 points by 3np 6y ago

Are there any anti virus for Linux that does that heuristic type scanning that you see on windows? Like monitoring for an unknown application doing esoteric things? I presume there's some sort of security software in this space for servers

3np 6y ago
ClamAV is the one I keep seeing used on the server side. Can't speak to as of how effective it is for contemporary Linux malware, but here's a post boasting about heuristics from 10 years ago: https://blog.clamav.net/2011/03/top-5-misconceptions-about-clamav.html https://blog.clamav.net/2011/03/top-5-misconceptions-about-c... Would be interesting to see a benchmark/study evaluating it as a desktop antivirus - but arguably any server-side malware (which I assume is the majority for Linux today) also apply for a large part of Linux workstations.
itvision 6y ago
> Are there any anti virus for Linux that does that heuristic type scanning that you see on windows? Next to none.

uniformlyrandom 6y ago

That is not a crazy idea at all. I'd feel a lot safer if I could run some detection on my personal Downloads folder, and on my apt feeds. The problem is, Linux antivirus does not really exist. Granted, there is some software that will scan your files for known signatures - but those signatures are for Win/Mac malware, which solves a completely different problem.

zokier 6y ago
Its a bit of chicken-egg problem: "nobody" is buying Linux AV so AV companies are not building extensive databases for Linux, which leads to them being even more useless than their Windows brethren and less desirable to buy.
itvision 6y ago
> The problem is, Linux antivirus does not really exist. That's true unfortunately. AV vendors have server solutions (i.e. without UI) for Linux but those scan mostly for Windows/MS Office malware.

GekkePrutser 6y ago

Good point but what is a good free antivirus for Linux?

eneville 6y ago
Used clamav a lot in the past, it prevented a lot of Windows viruses making it past qmail on to exchange. Yes, there have been times when distros have allowed things through, but that happens far less than malware getting through in a self service ecosystem. The only benefit I see is that AV may point out that you have software that needs updating. Is running AV on linux worth the downgrade performance that you'd get from dropping your CPU one or two generations and a couple of hours of battery life?
- GekkePrutser 6y ago
  Oh yeah I used ClamAV in the past on Mac. It wasn't great though.
itvision 6y ago
Free or not-free - there are none at the moment. ClamAV last time I checked missed over 30% of in the wild malware which renders it pretty much useless. AV-Comparatives and VBulletin have long stopped testing it for this reason.
- GekkePrutser 6y ago
  Well there are some non-free ones. I know Cylance supports some linux distros, and so does McAfee. Maybe others too. The thing is I don't really want to use those. I use both in work, McAfee is ancient crufty old crap. Cylance is OK but since the takeover from Blackberry their product has gone downhill rapidly. Also, their Linux version is not available to consumers. Also, if I use one it'd have to be open source. And ideally free in money too, though I could compromise on that if it's not too expensive.
- sliken 6y ago
  Seems like when I look at the "top 10 anti-virus" type articles that a surprising number of them fail to find relatively common viruses.

TrueDuality 6y ago

This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The truth is that the threat actors targeting Linux almost always do so by "living off the land". A lot of those files are benign or customized to the system leaving the common hash identification method of identifing known malicious binaries as a non-starter. Checking compiled libraries and binaries for sub-classes of behavior also doesn't get very far due to the wide variance of versions across different distributions and customizations done by different administrators. There are a lot of ways to detect or preventing those changes to the system that are actively deployed (none of which are an anti-virus). There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. There are also a lot of risks with an anti-virus itself. To be useful it needs to be deep in the kernel, above root permissions watching everything. Usually these are proprietary and all the major anti-virus names have had security issues in the past. Un-audited proprietary code running inside the Linux kernel is always a sketchy proposition. Which leads us back to the common conclusion that no, Linux does not need an anti-virus. They don't solve any of the security problems mentioned and will consume a large amount of system resources to accomplish nothing.

itvision 6y ago
> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? Or calls exec() on some weird strings.
- 6y ago

dmm 6y ago

> Most open-source projects accept code submissions from strangers and it's not exactly obvious that these submissions (bug fixes or new features) are what they really are and if they don't have cleverly hidden backdoors. I don't think McAfee will mitigate this scenario. In my experience antivirus programs are so painful and slow that I would accept almost any inconvenience to avoid using them, for example, doing development on air-gapped VMs or even separate physical machines for web browsing, email, and development. For example, every 'npm install foo' command creates thousands of files, in one specific case introducing a virus scan on each one turned a 10s install into a 5 minute one.

3np 6y ago
Nothing says we need to mimic all the ways things are done in Windows just because. Let's say you already have regular zfs snapshots of your workstation, that get synced to one of your servers using something like syncoid or zfs-repl. Then you could have a service that runs e.g. a daily scan of the most recent snapshot. Or regular scans of newly modified files, with a less frequent full filesystem scan locally. The upside of Linux is that you can tailor it to your needs.

yakubin 6y ago

The page outlines some security issues of Linux Desktop. It doesn't explain how an antivirus would mitigate them. It just ends with > As you can see, having a decent antivirus in Linux is not that a crazy idea. Well, actually, it is far from obvious. Antivirus software even on Windows is commonly the thing that makes the system more vulnerable, not less. This page however uses the word "antivirus" as "a magical piece of software that protects the computer against viruses". How does it do that? The idea that to fix a security issue you should install an additional program which "increases" security is dubious. The problems listed on the page are real and we should tackle them. However, I don't think that an "antivirus" is the right solution. Instead security should be treated in a systematic way, not something that you add to a system, after it's done. I think we should invest in, among others, sandboxing techniques, move away from Xorg, write system software in memory-safe languages. Security is not an app to be installed. It's an architectural problem. It's also ironic that most of the points listed on the page apply equally well to antivirus software. Namely, are distro maintainers qualified to verify antivirus code? What if an antivirus gets compromised? An open source antivirus could also get code submissions with cleverly hidden backdoors. And what if it's proprietary? (Most of them are.) They also commonly run with elevated privileges (the point about sudo).

itvision 6y ago
> The idea that to fix a security issue you should install an additional program which "increases" security is dubious. For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? > The problems listed on the page are real and we should tackle them. Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them. > Instead security should be treated in a systematic way As the article mentions even distro maintainers do not actually care about the issue that much - often because the maintainers do not get paid for their work and do it in their spare time. You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety. > Security is not an app to be installed. It's an architectural problem. Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop. > Namely, are distro maintainers qualified to verify antivirus code? AV vendors have a reputation to keep. There are not that many of them actually, and a lot fewer than software packages in an average Linux disto (to the tune of many thousands). > They also commonly run with elevated privileges (the point about sudo). That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel.

staticassertion 6y ago

Alternatively, no operating system needs a realtime antivirus, and they're actively harmful. It's fine to run a daily or weekly scan to deal with commodity malware, but otherwise they add no value. The other day we were writing an exploit and defender popped up to block it. It was literally faster to bypass defender than to figure out how to disable it in the UI. Linux is a hilarious security disaster but AV is not the solution.

ignoramous 6y ago

Linux Myths Series: Setting a password secures user data. Not when you can change passwords of any user account if you've got physical access: https://askubuntu.com/questions/24006/how-do-i-reset-a-lost-administrative-password https://askubuntu.com/questions/24006/how-do-i-reset-a-lost-...

theamk 6y ago
Same with windows and mac os. You want full-disk encryption or homedir encryption if you want to protect your data.
- ignoramous 6y ago
  The Linux that's widely in use, Android, has the right default. Linux distros should default to encryption too, though it might be contentious given all the workflows that would then brake.

AzzieElbab 6y ago

I argue that an antivirus program is usually worse than a virus wrt to privacy, performance, and stability of the system, regardless of OS. One notable exception is ransomware.

Uhhrrr 6y ago

Is there a scenario where releasing an update to virus detection software is better than releasing a kernel security update? I guess maybe if the former was many days faster than the latter?

yosito 6y ago

Somewhat related question: is there any way to detect hidden web shells that may be installed on a Linux server? Something like a script that pings a webhook any time any user logs in? I suppose that would be easy to disable if a hacker knows what they're doing. But it could be another layer of security that could tip off an administrator that something is happening.

theamk 6y ago
In the modern web dev, you don’t want a mutable web root at all - instead, when you run your deploy command, the entire web root is removed and replaced with latest version from git. So there are few chances to have “web shells” as long as your git repository is intact, and you deploy periodically. That said, if you want extra security, you can add a process monitor which sends an alert any time there is an process running with web server‘s user.
- yosito 6y ago
  This is a good point. Though I mostly install PHP apps like WordPress or Nextcloud that I'm not managing with git. But I should probably deploy them with something like Docker that I could re-build easily.

ExcavateGrandMa 6y ago

What you need isn't an antivirus... It's an anti distraction...

cbm-vic-20 6y ago

Thinking aloud here. How common are actual computer viruses (not just malware / ransomware, etc) these days? Meaning, an unauthorized program running on a computer that attempts to propagate itself to other computers. This was a real problem in the past when a program would be written to exploit shoddy network code, or when we still used removable media more frequently. I think all the modern OS vendors have locked their platforms down to prevent this mode of attack.