5 ms·

In a Darknet Diaries episode from a while back, I recall a three letter agency person saying something along the lines of "oh, haha they are running desktop Lin

In a Darknet Diaries episode from a while back, I recall a three letter agency person saying something along the lines of "oh, haha they are running desktop Linux, those guys never run anti-virus software, this will be easy..." Can anyone give me any more depth on this? Is a typical desktop Linux distro install more likely to be susceptible to attack by a nation-state level actor?

steve1977 3y ago
I mean there’s people installing stuff with curl | sudo bash and friends, so go figure…
throwaway09223 3y ago
Anti-virus software is utterly worthless in detecting previously-unknown rootkits. Not a factor. The typical attack vector for any system would be compromising the inbound software. This is really easy to do when people are downloading and installing random programs from websites. This used to be less common, but popular cutting edge tools have popularized it recently "distro packaging is too slow, etc, curl|bash to install" On linux, most base software comes from the distro repositories. The question there is how hard it would be to compromise these systems (including one of the mirrors). This includes ancillary packaging systems (pip, cpan, gems, conda, etc)
- consumer451 3y ago
  > Anti-virus software is utterly worthless in detecting previously-unknown rootkits. Maybe the "this will be easy" part was that without AV software, there was a greater chance that they could just spin up Metasploit, and wouldn't even have to use one their stockpiled zero-days?
  - autoexec 3y ago
    Why worry about stockpiled zero-days even for non-linux systems when they can just force MS or Apple to hand over data or inject whatever they want into an OS "update".
    - consumer451 3y ago
      If I'm beginning to recall the story correctly, it's that your suggested route would involve more time, paperwork, and this particular op might not be important enough to get the big guns authorized by the higher-ups. Hence, "oh, this will be (relatively) easy..."
  - throwaway09223 3y ago
    AV doesn't detect the exploit mechanism -- that's not how it works. It's only pattern matching existing binaries. The difficulty level is "recompile with small changes and test that it doesn't match" not "develop a new attack vector" It really is stupid and pointless against an attacker with even a bare minimum of competence (able to run a software build vs downloading binaries)
    - IIsi50MHz 3y ago
      This would fit my expectations of a classical 1990s antivirus, however I would expect modern ones to also employ heuristics against behaviours. Are you referring specific'ly to a limitation ClamAV?
    - consumer451 3y ago
      But AV (EPP) could detect a binary which was passed through a traditional vector, like phishing or gaining access to a "trusted" email account and attaching a compromised PDF, as a random example. Just a reminder that I was originally talking about desktop Linux, and all of the additionally installed attack surface which that entails. It would seem to me that it does not matter how "technical" a user is, they are still human, and some of the time anyone could fall for a well formed phishing attack. We all get tired, overworked, or click too fast, etc. Not running AV on a desktop OS and relying on one's own superhuman technical ability seems like the exact type of hubris that would be ripe for attack.
      - midasuni 3y ago
        How many genuine issues (not nonsense like “blah.con has stored a cookie” does your av pick up?
        consumer451 3y ago
        It is very likely that a modern AV (I should have been saying EPP) will pick up your average re-encoded payload, or Metasploit fun time. Certainly they will pickup most known vulnerabilities. Endpoint Protection (EPP) orgs use the same CVE DBs that adversaries use. See another user's comment: https://news.ycombinator.com/item?id=38594247 https://news.ycombinator.com/item?id=38594247 Security is an onion, perfect is the enemy of good, etc... Why make it easier for the adversaries? While annoying, running EPP on your desktop OS is not exactly neuroscience. Ideally, it's furnished by the OS provider so that there are fewer parties to trust. I hate to say it, but Microsoft is now teaching by example. MS has factually one of the best-in-class Endpoint Protection agents on the market. If resources allowed, all other desktop OS providers should follow suit, otherwise they are just shirking responsibility.
- CAP_NET_ADMIN 3y ago
  Most of the currently used AV software contains heuristic/ML components that are able to gather and analyze various indicators of compromise. Without something like that running, you're basically tied to manual review of systems running at the moment. Making malware for such scenarios is basically making a Base64-encoded script in the language of your choice and then exploiting something(either the user or some software) to get it to execute. I know, because I've been writing small malware toys and it got blasted by both Bitdefender and ESET.
  - hulitu 3y ago
    > Most of the currently used AV software contains heuristic/ML components that are able to gather and analyze various indicators of compromise Ransomware runs just fine on corporate computers with the latest and greatest "antivirus" software. I really lost hope some 10 years ago, when i saw that i have to manually remove malware from memory sticks, because macaffe was clueless. After more than a year they released an update that will detect and remove the malware (it was a virus speading through autorun.inf with exe names which did not have any sense like jhghjjj.exe)
    - consumer451 3y ago
      I can't speak to that particular attack vector today, but it's interesting that McAfee isn't even on this Gartner chart, and that Microsoft is now a leader. Things have really changed in that space. https://www.cybereason.com/blog/cybereason-named-a-leader-in-2022-gartner-magic-quadrant-for-endpoint-protection-platforms https://www.cybereason.com/blog/cybereason-named-a-leader-in...
    - CAP_NET_ADMIN 3y ago
      Corporate Ransomware attacks typically use 0-days and social engineering to achieve goals. No system is perfect, but a system in place is better than not having anything in place. Things have changed in the last 10 years. Long gone are the days of only using signature databases. https://attackevals.mitre-engenuity.org/results/enterprise?vendor=bitdefender&vendor=microsoft&vendor=mcafee&evaluation=wizard-spider-sandworm&scenario=1 https://attackevals.mitre-engenuity.org/results/enterprise?v...
- heavyset_go 3y ago
  > On linux, most base software comes from the distro repositories. The question there is how hard it would be to compromise these systems (including one of the mirrors). This includes ancillary packaging systems (pip, cpan, gems, conda, etc) IMO if you're worried about the NSA, I assume they have access to root certificates and your package manager that uses TLS would be vulnerable. Wouldn't have to compromise any system or mirror to do so.
  - throwaway09223 3y ago
    I mean yeah, I would say that's one way to compromise those systems.
  - sp1rit 3y ago
    > your package manager that uses TLS would be vulnerable most distro package managers (dpkg, rpm, etc.) tend to use gpg which shouldn't suffer from those issues (but they could obviously still have some sort of other backdoor for gpg). Still, I feel like distro packages are really secured compared to stuff you install via pip/npm/... as I don't believe they do anything beyond protecting downloads with TLS.
    - consumer451 3y ago
      This seems like an extremely important point, which applies not just to desktop Linux (my OP,) but especially server Linux. Since I am very much a Linux & infosec muggle, please indulge me with these possibly dumb questions: What are the mitigations for the lack of provenance in pip/npm? Does properly configured SELinux do enough? Or is the fact that many of these packages use 80/443 negate that? Or is the fact that a pip/npm package could be comprised after install, during update the main problem? I always think of that left-pad NPM drama, could that single dev have comprised thousands of systems by changing his update to something much more nefarious, instead of just deleting the package? Again, sorry if these are dumb questions.
      - sp1rit 3y ago
        Well, it depends on what you consider "properly configured". But I'd say most systems used by developers aren't secured against these attacks. This mostly boils down to (like discussed elsewhere in this thread) that the developer runs his tools as his user, thus malicious software can modify his .bashrc and using that hijack a later sudo invocation to gain full access. The thing that "protects" you is package locking, where unless you explicitly update your packages, you'll stay on an uncomprimised version (this broke with leftpad, as every available version was deleted). Locking has the downside that you don't get security updates for your software, which might be even more harmful tho.
dharmab 3y ago
The default settings of many Linux distros don't enable major security features. For example, on Arch Linux, microcode updates must be configured separately and most users likely skipped that step. Also, X11 has really poor separation between processes. Any desktop application running in Xorg can keylog all user inputs. It is possible to build a secure Linux installation but it requires a lot of careful OS knowledge and the discipline to only use a small set of software with established provenance. And probably disabling Javascript.
seeknotfind 3y ago
One big example is home folder access. Linux has a variety of file access control systems (the most prominent are Linux file permissions and SELinux). However, typically any application you run will be run under your own user and have access to your home folder. In macOS/Windows, there are runtime permissions these days which allow you to control which folders can be given to which application. Linux needs to mainstream a solution like this. One of the most popular way Linux users can handle this today is by associating a user with a application and granting various permissions to that user. However this is a far cry from safe by default, and it requires deep system knowledge.
- foobiekr 3y ago
  Once you own the home folder you can drop aliases for anything you want in the bashrc with almost no one noticing. At that moment point you are essentially done in almost all cases even in the absence of a local root exploit which Linux continues to be rife with. You will eventually catch a sudo password (using a trivial sudo wrapper alias) and all the ssh keys and jump host or password manager config.
  - medstrom 3y ago
    Moreover, even if the user manages to deny you root access through excellent hygiene, that just means you can't include this machine in your botnet. You still have full view of the home folder! Upload to a data broker, get $.
  - Jenda_ 3y ago
    Of course - the point is not to get the home folder owned. There is no reason why Evince/Okular or mpv (to name a few apps which handle files with complex formats from untrusted sources) should have the right to access anything beside their ~/.config/<application_name> and the file they are currently viewing/playing, or maybe read-only ~/Music. If you want to do a "Save as", you will do this through a OS-controlled file dialog, or save it to /tmp and copy it. This can be achieved with AppArmor, with a caveat that in X, applications can steal each other's windows, but unfortunately this is not the default and easy configuration on most distros.
marcosdumay 3y ago
Yeah, that's bullshit. None of the mainstream OSes will help you protect you from a nation-state actor.
- consumer451 3y ago
  As I wrote in another comment: > Maybe the "this will be easy" part was that without AV software, there was a greater chance that they could just spin up Metasploit, and wouldn't even have to use one their stockpiled zero-days?
- tsujamin 3y ago
  There’s a lot more footguns for attackers on modern windows than other operating systems. Most can be bypassed (EDR, AV, AMSI, ETW, UAC, controlled folders, App Control, block at first site etc), but it definitely raises the bar if your end goal is very low likelihoods of detection. Put differently: the gauntlet you have to run on Windows (and to a lesser extent macOS I imagine) is much longer
  - marcosdumay 3y ago
    Hum... Did Microsoft ever isolate their development infrastructure from the one that was compromised by Solar Winds? They never even tried to claim they did something about it. Anyway, half of those acronyms have more vulnerabilities than Windows on a normal computer.
akira2501 3y ago
In order for AV to work, it has to have the highest level of permissions on the system, high enough to analyze all actions and potentially deny or alert on them. I don't trust that an AV vendor can _add_ security to a system with a _new_ and obscure binary looking over the kernels shoulder. I don't think the properties of the universe allow for this to ever be true.
- consumer451 3y ago
  This is why.. shudder.. Microsoft appears to be the leader in AV (EPP). I also don't want an extra party involved, so ideally, the OS provider should also provide the EPP. I do see how other OSes address this problem differently, such as everything going through a package manager. But, see my question here regarding how often some is going to run apt update && apt upgrade && apt dist-upgrade, vs. the more automated update systems on MacOS and Windows. https://news.ycombinator.com/item?id=38596966 https://news.ycombinator.com/item?id=38596966
akyuu 3y ago
The Linux desktop technology stack lags behind Windows and macOS when it comes to security. The causes are both technical (see this comment [1] for an overview) and non-technical, often stemming from a fragmented development model where there are no clearly defined security boundaries. For example: - There is no real concept of base system because distros are usually a patchwork of software from diverse sources. This means stuff like proper secure boot is not really feasible on any distro (although AFAIK the systemd/Fedora people are working on it with signed UKIs and immutable OS images). - Some features that could live in userland for improved security are instead implemented in the kernel, while both Windows and macOS generally keep moving exploitable features like font rendering to userland. - Distros often disable or disregard security features such as SELinux or mitigations like CFI. Here [2] is a more detailed article examining the lack of security of Linux desktops in case you're interested. [1] https://news.ycombinator.com/item?id=37502088 https://news.ycombinator.com/item?id=37502088 [2] https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html
enasterosophes 3y ago
Malware requires propagation vectors. Computers don't work by magic, instead when thinking about security you should think about your threat model. What are you protecting and from whom, and what is the attack surface you are exposing which would allow them to get prize? On Linux, the attack surface may not be non-existent, but by default it is smaller than some other operating systems. Any halfway competent Linux sysadmin can configure iptables or some other firewall to block all network traffic except what is specifically permitted. Even when something is exposed, it usually only allows access to specific user accounts (including system service accounts.) Once access is granted to an account, you are then constrained by discretionary access controls (DAC) (i.e. POSIX users + groups + file permission modes), and, for the paranoid, by mandatory access control (MAC) (eg AppArmor or SELinux) as well. As others have said, such access could theoretically allow bootstrapping to greater privilege escalation, especially if you only have DAC and no MAC, but in practice it's harder than it sounds. I have seen plenty of publicly-exposed Linux VMs compromized over the years. They were always compromized via one of two methods: the admin user explicitly enabled password authentication to ssh instead of adhering to keypairs (which we enforce by default); or, they opened up a vulnerable service such as a database to the public internet. It was never via some virus. You hear people saying dumb stuff like, oh no one uses Linux and that's why there are no viruses. To that, I say our Linux server farms have a vast amount of highly valuable compute power and research data. If it were possible to infect these machines with a virus, any halfway competent nation state, ransomware group or bitcoin mining conglomerate would very much consider it a worthwhile investment to develop such a virus.
- Jenda_ 3y ago
  The GP was talking about Linux desktop, you seem to be talking about Linux server.
  - enasterosophes 3y ago
    I'm talking about Linux. I've been using Linux desktop for 15 years. No viruses so far. But if I just talked about my personal machines, would anyone listen? I've had a lot more opportunity to see what it looks like when a VM is compromized, compared to a desktop, because my desktop has never been compromized.
sspiff 3y ago
Depends. Most Linux users will run the latest security patches for all their software, not just the OS, because it all updates automatically. Additionally, a lot of Linix users run most attack vectors (like browsers or email clients) inside a sandbox using Snap or FlatPak). None of these things make it impossible to get through to the system, but they are additional barriers that an attacker needs to deal with.

steve1977 3y ago

I mean there’s people installing stuff with curl | sudo bash and friends, so go figure…

throwaway09223 3y ago

Anti-virus software is utterly worthless in detecting previously-unknown rootkits. Not a factor. The typical attack vector for any system would be compromising the inbound software. This is really easy to do when people are downloading and installing random programs from websites. This used to be less common, but popular cutting edge tools have popularized it recently "distro packaging is too slow, etc, curl|bash to install" On linux, most base software comes from the distro repositories. The question there is how hard it would be to compromise these systems (including one of the mirrors). This includes ancillary packaging systems (pip, cpan, gems, conda, etc)

consumer451 3y ago
> Anti-virus software is utterly worthless in detecting previously-unknown rootkits. Maybe the "this will be easy" part was that without AV software, there was a greater chance that they could just spin up Metasploit, and wouldn't even have to use one their stockpiled zero-days?
- autoexec 3y ago
  Why worry about stockpiled zero-days even for non-linux systems when they can just force MS or Apple to hand over data or inject whatever they want into an OS "update".
  - consumer451 3y ago
    If I'm beginning to recall the story correctly, it's that your suggested route would involve more time, paperwork, and this particular op might not be important enough to get the big guns authorized by the higher-ups. Hence, "oh, this will be (relatively) easy..."
- throwaway09223 3y ago
  AV doesn't detect the exploit mechanism -- that's not how it works. It's only pattern matching existing binaries. The difficulty level is "recompile with small changes and test that it doesn't match" not "develop a new attack vector" It really is stupid and pointless against an attacker with even a bare minimum of competence (able to run a software build vs downloading binaries)
  - IIsi50MHz 3y ago
    This would fit my expectations of a classical 1990s antivirus, however I would expect modern ones to also employ heuristics against behaviours. Are you referring specific'ly to a limitation ClamAV?
  - consumer451 3y ago
    But AV (EPP) could detect a binary which was passed through a traditional vector, like phishing or gaining access to a "trusted" email account and attaching a compromised PDF, as a random example. Just a reminder that I was originally talking about desktop Linux, and all of the additionally installed attack surface which that entails. It would seem to me that it does not matter how "technical" a user is, they are still human, and some of the time anyone could fall for a well formed phishing attack. We all get tired, overworked, or click too fast, etc. Not running AV on a desktop OS and relying on one's own superhuman technical ability seems like the exact type of hubris that would be ripe for attack.
    - midasuni 3y ago
      How many genuine issues (not nonsense like “blah.con has stored a cookie” does your av pick up?
      - consumer451 3y ago
        It is very likely that a modern AV (I should have been saying EPP) will pick up your average re-encoded payload, or Metasploit fun time. Certainly they will pickup most known vulnerabilities. Endpoint Protection (EPP) orgs use the same CVE DBs that adversaries use. See another user's comment: https://news.ycombinator.com/item?id=38594247 https://news.ycombinator.com/item?id=38594247 Security is an onion, perfect is the enemy of good, etc... Why make it easier for the adversaries? While annoying, running EPP on your desktop OS is not exactly neuroscience. Ideally, it's furnished by the OS provider so that there are fewer parties to trust. I hate to say it, but Microsoft is now teaching by example. MS has factually one of the best-in-class Endpoint Protection agents on the market. If resources allowed, all other desktop OS providers should follow suit, otherwise they are just shirking responsibility.
CAP_NET_ADMIN 3y ago
Most of the currently used AV software contains heuristic/ML components that are able to gather and analyze various indicators of compromise. Without something like that running, you're basically tied to manual review of systems running at the moment. Making malware for such scenarios is basically making a Base64-encoded script in the language of your choice and then exploiting something(either the user or some software) to get it to execute. I know, because I've been writing small malware toys and it got blasted by both Bitdefender and ESET.
- hulitu 3y ago
  > Most of the currently used AV software contains heuristic/ML components that are able to gather and analyze various indicators of compromise Ransomware runs just fine on corporate computers with the latest and greatest "antivirus" software. I really lost hope some 10 years ago, when i saw that i have to manually remove malware from memory sticks, because macaffe was clueless. After more than a year they released an update that will detect and remove the malware (it was a virus speading through autorun.inf with exe names which did not have any sense like jhghjjj.exe)
  - consumer451 3y ago
    I can't speak to that particular attack vector today, but it's interesting that McAfee isn't even on this Gartner chart, and that Microsoft is now a leader. Things have really changed in that space. https://www.cybereason.com/blog/cybereason-named-a-leader-in-2022-gartner-magic-quadrant-for-endpoint-protection-platforms https://www.cybereason.com/blog/cybereason-named-a-leader-in...
  - CAP_NET_ADMIN 3y ago
    Corporate Ransomware attacks typically use 0-days and social engineering to achieve goals. No system is perfect, but a system in place is better than not having anything in place. Things have changed in the last 10 years. Long gone are the days of only using signature databases. https://attackevals.mitre-engenuity.org/results/enterprise?vendor=bitdefender&vendor=microsoft&vendor=mcafee&evaluation=wizard-spider-sandworm&scenario=1 https://attackevals.mitre-engenuity.org/results/enterprise?v...
heavyset_go 3y ago
> On linux, most base software comes from the distro repositories. The question there is how hard it would be to compromise these systems (including one of the mirrors). This includes ancillary packaging systems (pip, cpan, gems, conda, etc) IMO if you're worried about the NSA, I assume they have access to root certificates and your package manager that uses TLS would be vulnerable. Wouldn't have to compromise any system or mirror to do so.
- throwaway09223 3y ago
  I mean yeah, I would say that's one way to compromise those systems.
- sp1rit 3y ago
  > your package manager that uses TLS would be vulnerable most distro package managers (dpkg, rpm, etc.) tend to use gpg which shouldn't suffer from those issues (but they could obviously still have some sort of other backdoor for gpg). Still, I feel like distro packages are really secured compared to stuff you install via pip/npm/... as I don't believe they do anything beyond protecting downloads with TLS.
  - consumer451 3y ago
    This seems like an extremely important point, which applies not just to desktop Linux (my OP,) but especially server Linux. Since I am very much a Linux & infosec muggle, please indulge me with these possibly dumb questions: What are the mitigations for the lack of provenance in pip/npm? Does properly configured SELinux do enough? Or is the fact that many of these packages use 80/443 negate that? Or is the fact that a pip/npm package could be comprised after install, during update the main problem? I always think of that left-pad NPM drama, could that single dev have comprised thousands of systems by changing his update to something much more nefarious, instead of just deleting the package? Again, sorry if these are dumb questions.
    - sp1rit 3y ago
      Well, it depends on what you consider "properly configured". But I'd say most systems used by developers aren't secured against these attacks. This mostly boils down to (like discussed elsewhere in this thread) that the developer runs his tools as his user, thus malicious software can modify his .bashrc and using that hijack a later sudo invocation to gain full access. The thing that "protects" you is package locking, where unless you explicitly update your packages, you'll stay on an uncomprimised version (this broke with leftpad, as every available version was deleted). Locking has the downside that you don't get security updates for your software, which might be even more harmful tho.

dharmab 3y ago

The default settings of many Linux distros don't enable major security features. For example, on Arch Linux, microcode updates must be configured separately and most users likely skipped that step. Also, X11 has really poor separation between processes. Any desktop application running in Xorg can keylog all user inputs. It is possible to build a secure Linux installation but it requires a lot of careful OS knowledge and the discipline to only use a small set of software with established provenance. And probably disabling Javascript.

seeknotfind 3y ago

One big example is home folder access. Linux has a variety of file access control systems (the most prominent are Linux file permissions and SELinux). However, typically any application you run will be run under your own user and have access to your home folder. In macOS/Windows, there are runtime permissions these days which allow you to control which folders can be given to which application. Linux needs to mainstream a solution like this. One of the most popular way Linux users can handle this today is by associating a user with a application and granting various permissions to that user. However this is a far cry from safe by default, and it requires deep system knowledge.

foobiekr 3y ago
Once you own the home folder you can drop aliases for anything you want in the bashrc with almost no one noticing. At that moment point you are essentially done in almost all cases even in the absence of a local root exploit which Linux continues to be rife with. You will eventually catch a sudo password (using a trivial sudo wrapper alias) and all the ssh keys and jump host or password manager config.
- medstrom 3y ago
  Moreover, even if the user manages to deny you root access through excellent hygiene, that just means you can't include this machine in your botnet. You still have full view of the home folder! Upload to a data broker, get $.
- Jenda_ 3y ago
  Of course - the point is not to get the home folder owned. There is no reason why Evince/Okular or mpv (to name a few apps which handle files with complex formats from untrusted sources) should have the right to access anything beside their ~/.config/<application_name> and the file they are currently viewing/playing, or maybe read-only ~/Music. If you want to do a "Save as", you will do this through a OS-controlled file dialog, or save it to /tmp and copy it. This can be achieved with AppArmor, with a caveat that in X, applications can steal each other's windows, but unfortunately this is not the default and easy configuration on most distros.

marcosdumay 3y ago

Yeah, that's bullshit. None of the mainstream OSes will help you protect you from a nation-state actor.

consumer451 3y ago
As I wrote in another comment: > Maybe the "this will be easy" part was that without AV software, there was a greater chance that they could just spin up Metasploit, and wouldn't even have to use one their stockpiled zero-days?
tsujamin 3y ago
There’s a lot more footguns for attackers on modern windows than other operating systems. Most can be bypassed (EDR, AV, AMSI, ETW, UAC, controlled folders, App Control, block at first site etc), but it definitely raises the bar if your end goal is very low likelihoods of detection. Put differently: the gauntlet you have to run on Windows (and to a lesser extent macOS I imagine) is much longer
- marcosdumay 3y ago
  Hum... Did Microsoft ever isolate their development infrastructure from the one that was compromised by Solar Winds? They never even tried to claim they did something about it. Anyway, half of those acronyms have more vulnerabilities than Windows on a normal computer.

akira2501 3y ago

In order for AV to work, it has to have the highest level of permissions on the system, high enough to analyze all actions and potentially deny or alert on them. I don't trust that an AV vendor can _add_ security to a system with a _new_ and obscure binary looking over the kernels shoulder. I don't think the properties of the universe allow for this to ever be true.

consumer451 3y ago
This is why.. shudder.. Microsoft appears to be the leader in AV (EPP). I also don't want an extra party involved, so ideally, the OS provider should also provide the EPP. I do see how other OSes address this problem differently, such as everything going through a package manager. But, see my question here regarding how often some is going to run apt update && apt upgrade && apt dist-upgrade, vs. the more automated update systems on MacOS and Windows. https://news.ycombinator.com/item?id=38596966 https://news.ycombinator.com/item?id=38596966

akyuu 3y ago

The Linux desktop technology stack lags behind Windows and macOS when it comes to security. The causes are both technical (see this comment [1] for an overview) and non-technical, often stemming from a fragmented development model where there are no clearly defined security boundaries. For example: - There is no real concept of base system because distros are usually a patchwork of software from diverse sources. This means stuff like proper secure boot is not really feasible on any distro (although AFAIK the systemd/Fedora people are working on it with signed UKIs and immutable OS images). - Some features that could live in userland for improved security are instead implemented in the kernel, while both Windows and macOS generally keep moving exploitable features like font rendering to userland. - Distros often disable or disregard security features such as SELinux or mitigations like CFI. Here [2] is a more detailed article examining the lack of security of Linux desktops in case you're interested. [1] https://news.ycombinator.com/item?id=37502088 https://news.ycombinator.com/item?id=37502088 [2] https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html

enasterosophes 3y ago

Malware requires propagation vectors. Computers don't work by magic, instead when thinking about security you should think about your threat model. What are you protecting and from whom, and what is the attack surface you are exposing which would allow them to get prize? On Linux, the attack surface may not be non-existent, but by default it is smaller than some other operating systems. Any halfway competent Linux sysadmin can configure iptables or some other firewall to block all network traffic except what is specifically permitted. Even when something is exposed, it usually only allows access to specific user accounts (including system service accounts.) Once access is granted to an account, you are then constrained by discretionary access controls (DAC) (i.e. POSIX users + groups + file permission modes), and, for the paranoid, by mandatory access control (MAC) (eg AppArmor or SELinux) as well. As others have said, such access could theoretically allow bootstrapping to greater privilege escalation, especially if you only have DAC and no MAC, but in practice it's harder than it sounds. I have seen plenty of publicly-exposed Linux VMs compromized over the years. They were always compromized via one of two methods: the admin user explicitly enabled password authentication to ssh instead of adhering to keypairs (which we enforce by default); or, they opened up a vulnerable service such as a database to the public internet. It was never via some virus. You hear people saying dumb stuff like, oh no one uses Linux and that's why there are no viruses. To that, I say our Linux server farms have a vast amount of highly valuable compute power and research data. If it were possible to infect these machines with a virus, any halfway competent nation state, ransomware group or bitcoin mining conglomerate would very much consider it a worthwhile investment to develop such a virus.

Jenda_ 3y ago
The GP was talking about Linux desktop, you seem to be talking about Linux server.
- enasterosophes 3y ago
  I'm talking about Linux. I've been using Linux desktop for 15 years. No viruses so far. But if I just talked about my personal machines, would anyone listen? I've had a lot more opportunity to see what it looks like when a VM is compromized, compared to a desktop, because my desktop has never been compromized.

sspiff 3y ago

Depends. Most Linux users will run the latest security patches for all their software, not just the OS, because it all updates automatically. Additionally, a lot of Linix users run most attack vectors (like browsers or email clients) inside a sandbox using Snap or FlatPak). None of these things make it impossible to get through to the system, but they are additional barriers that an attacker needs to deal with.