4 ms·

This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Ma

This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The truth is that the threat actors targeting Linux almost always do so by "living off the land". A lot of those files are benign or customized to the system leaving the common hash identification method of identifing known malicious binaries as a non-starter. Checking compiled libraries and binaries for sub-classes of behavior also doesn't get very far due to the wide variance of versions across different distributions and customizations done by different administrators. There are a lot of ways to detect or preventing those changes to the system that are actively deployed (none of which are an anti-virus). There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. There are also a lot of risks with an anti-virus itself. To be useful it needs to be deep in the kernel, above root permissions watching everything. Usually these are proprietary and all the major anti-virus names have had security issues in the past. Un-audited proprietary code running inside the Linux kernel is always a sketchy proposition. Which leads us back to the common conclusion that no, Linux does not need an anti-virus. They don't solve any of the security problems mentioned and will consume a large amount of system resources to accomplish nothing.

itvision 6y ago
> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? Or calls exec() on some weird strings.
- eMSF 6y ago
  How could an AV possibly know that a program is supposed to be a “simplistic image viewer”? Besides, there are several legitimate reasons for even simple apps to fetch data from the net (including simply checking for updates). I'm beyond convinced that any available “advanced behavioral analysis solutions” are way, way more trouble than anything but.
- TrueDuality 6y ago
  Yup, aware of those. Should probably clarify that I'm specifically trying to say that AFAIK there isn't any "anti-virus" that runs on Linux and is performing any level of behavioral analysis. There are a lot of _auditing_ tools that can allow detection of bad behavior like this, and you can alert / remediate based on that behavior though.
- staticassertion 6y ago
  That they of detection in AV is really rare, because AV (rightfully) optimizes to an extreme for low false positives. Instead you just have slightly more complex signatures that look at syscall ordering or whatever. It's not nearly as powerful as it sounds.
- kitsunesoba 6y ago
  > For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? It's interesting that this specific example would've also been caught with a sandbox and permission system. The surface covered between antimalware and sandbox/permssions aren't entirely the same but there's a lot that is shared. Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default. We've grown accustomed to desktop apps implicitly having access to everything, but if you think about it it's actually a bit strange that an app can just reach out and use your network, camera, etc as it pleases.
  - itvision 6y ago
    > Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default. Very much welcomed but both Windows and Linux were not created with this idea in mind and it entails quite an overhead. Under Windows I love using SandBoxie: https://github.com/sandboxie-plus/Sandboxie/issues https://github.com/sandboxie-plus/Sandboxie/issues Under Linux I use firejail but it's 100% user unfriendly ;-)
3np 6y ago
You do raise some good points. However, what comes to mind as a relatively easy win with real gains for a large part of Linux desktops would be a global scanner for hostile npm/pip/etc packages. To catch typosquatters, takeovers etc of dependencies. A lot can be inherited or borrowed from existing implementations.
belter 6y ago
As you already mentioned, I would also argue that in general most anti-virus solutions are likely to decrease the security of your systems. Sadly, the majority of AV vendors follow practices that open attack vectors: [1] ,[2] and [3] Many well-respected security researchers do not use anti-virus at all or strongly recommend against: [4] For Linux the technical incentives around ClamAV are a bit better aligned that the horrifying realities of the Windows world but still, I am afraid the current status is not that great: [5] "It might be time to stop using antivirus" [1] https://arstechnica.com/information-technology/2017/01/antivirus-is-bad/ https://arstechnica.com/information-technology/2017/01/antiv... "How to Compromise the Enterprise Endpoint" [2] https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... "AV firms do need to stop breaking HTTPS security" [3] https://www.zdnet.com/article/google-and-mozilla-are-right-av-firms-do-need-to-stop-breaking-https-security/ https://www.zdnet.com/article/google-and-mozilla-are-right-a... "Rutkowska: Anti-Virus Software Is Ineffective" [4] https://www.eweek.com/security/rutkowska-anti-virus-software-is-ineffective/ https://www.eweek.com/security/rutkowska-anti-virus-software... "Clamav : Security Vulnerabilities" [5] https://www.cvedetails.com/vulnerability-list/vendor_id-8871/Clamav.html https://www.cvedetails.com/vulnerability-list/vendor_id-8871...
- itvision 6y ago
  While all these issues have taken place, AV vendors have solved them and nowadays it's safer to have them running when you need to work with the software you download from the net. If you run nothing but e.g. Windows + some web browser and _never_ download any executables you may as well not run any AV at all. Lastly, Windows Defender has become really good recently, so you don't even need to worry about that.
  - belter 6y ago
    I do not think so. Its a structural problem: "Microsoft Defender Remote Code Execution Vulnerability" https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1647 https://msrc.microsoft.com/update-guide/en-US/vulnerability/... Patched only on a update from this late March/April. Allows remote attackers to infect targeted systems with executable code via Windows Defender.

itvision 6y ago

> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? Or calls exec() on some weird strings.

eMSF 6y ago
How could an AV possibly know that a program is supposed to be a “simplistic image viewer”? Besides, there are several legitimate reasons for even simple apps to fetch data from the net (including simply checking for updates). I'm beyond convinced that any available “advanced behavioral analysis solutions” are way, way more trouble than anything but.
TrueDuality 6y ago
Yup, aware of those. Should probably clarify that I'm specifically trying to say that AFAIK there isn't any "anti-virus" that runs on Linux and is performing any level of behavioral analysis. There are a lot of _auditing_ tools that can allow detection of bad behavior like this, and you can alert / remediate based on that behavior though.
staticassertion 6y ago
That they of detection in AV is really rare, because AV (rightfully) optimizes to an extreme for low false positives. Instead you just have slightly more complex signatures that look at syscall ordering or whatever. It's not nearly as powerful as it sounds.
kitsunesoba 6y ago
> For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? It's interesting that this specific example would've also been caught with a sandbox and permission system. The surface covered between antimalware and sandbox/permssions aren't entirely the same but there's a lot that is shared. Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default. We've grown accustomed to desktop apps implicitly having access to everything, but if you think about it it's actually a bit strange that an app can just reach out and use your network, camera, etc as it pleases.
- itvision 6y ago
  > Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default. Very much welcomed but both Windows and Linux were not created with this idea in mind and it entails quite an overhead. Under Windows I love using SandBoxie: https://github.com/sandboxie-plus/Sandboxie/issues https://github.com/sandboxie-plus/Sandboxie/issues Under Linux I use firejail but it's 100% user unfriendly ;-)

3np 6y ago

You do raise some good points. However, what comes to mind as a relatively easy win with real gains for a large part of Linux desktops would be a global scanner for hostile npm/pip/etc packages. To catch typosquatters, takeovers etc of dependencies. A lot can be inherited or borrowed from existing implementations.

belter 6y ago

As you already mentioned, I would also argue that in general most anti-virus solutions are likely to decrease the security of your systems. Sadly, the majority of AV vendors follow practices that open attack vectors: [1] ,[2] and [3] Many well-respected security researchers do not use anti-virus at all or strongly recommend against: [4] For Linux the technical incentives around ClamAV are a bit better aligned that the horrifying realities of the Windows world but still, I am afraid the current status is not that great: [5] "It might be time to stop using antivirus" [1] https://arstechnica.com/information-technology/2017/01/antivirus-is-bad/ https://arstechnica.com/information-technology/2017/01/antiv... "How to Compromise the Enterprise Endpoint" [2] https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... "AV firms do need to stop breaking HTTPS security" [3] https://www.zdnet.com/article/google-and-mozilla-are-right-av-firms-do-need-to-stop-breaking-https-security/ https://www.zdnet.com/article/google-and-mozilla-are-right-a... "Rutkowska: Anti-Virus Software Is Ineffective" [4] https://www.eweek.com/security/rutkowska-anti-virus-software-is-ineffective/ https://www.eweek.com/security/rutkowska-anti-virus-software... "Clamav : Security Vulnerabilities" [5] https://www.cvedetails.com/vulnerability-list/vendor_id-8871/Clamav.html https://www.cvedetails.com/vulnerability-list/vendor_id-8871...

itvision 6y ago
While all these issues have taken place, AV vendors have solved them and nowadays it's safer to have them running when you need to work with the software you download from the net. If you run nothing but e.g. Windows + some web browser and _never_ download any executables you may as well not run any AV at all. Lastly, Windows Defender has become really good recently, so you don't even need to worry about that.
- belter 6y ago
  I do not think so. Its a structural problem: "Microsoft Defender Remote Code Execution Vulnerability" https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1647 https://msrc.microsoft.com/update-guide/en-US/vulnerability/... Patched only on a update from this late March/April. Allows remote attackers to infect targeted systems with executable code via Windows Defender.