Linux Myths Series: Linux Doesn't Need an Antivirus (2020) • Hacker News Board

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#11

Post by TrueDuality » Mon, Apr 05, 2021, 5:58 PM UTC

itvision wrote: post #9

TrueDuality wrote: post #6

This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The tru…

> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For ins…

Yup, aware of those. Should probably clarify that I'm specifically trying to say that AFAIK there isn't any "anti-virus" that runs on Linux and is performing any level of behavioral analysis. There are a lot of _auditing_ tools that can allow detection of bad behavior like this, and you can alert / remediate based on that behavior though.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#12

Post by itvision » Mon, Apr 05, 2021, 5:59 PM UTC

yakubin wrote: post #8

The page outlines some security issues of Linux Desktop. It doesn't explain how an antivirus would mitigate them. It just ends with > As you can see, having a decent antivirus in Linux is not that a crazy idea. Well, actually, it is far from obvious. Antivirus software even on Windows is commonly the thing that makes the system more vulnerable, not less. This page however uses the word "antivirus" as "a magical piece…

> The idea that to fix a security issue you should install an additional program which "increases" security is dubious.

For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux?

> The problems listed on the page are real and we should tackle them.

Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them.

> Instead security should be treated in a systematic way

As the article mentions even distro maintainers do not actually care about the issue that much - often because the maintainers do not get paid for their work and do it in their spare time. You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety.

> Security is not an app to be installed. It's an architectural problem.

Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop.

> Namely, are distro maintainers qualified to verify antivirus code?

AV vendors have a reputation to keep. There are not that many of them actually, and a lot fewer than software packages in an average Linux disto (to the tune of many thousands).

> They also commonly run with elevated privileges (the point about sudo).

That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#13

Post by itvision » Mon, Apr 05, 2021, 6:01 PM UTC

Jonnax wrote: post #2

Are there any anti virus for Linux that does that heuristic type scanning that you see on windows? Like monitoring for an unknown application doing esoteric things? I presume there's some sort of security software in this space for servers

> Are there any anti virus for Linux that does that heuristic type scanning that you see on windows?

Next to none.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#14

Post by 3np » Mon, Apr 05, 2021, 6:01 PM UTC

dmm wrote: post #7

> Most open-source projects accept code submissions from strangers and it's not exactly obvious that these submissions (bug fixes or new features) are what they really are and if they don't have cleverly hidden backdoors. I don't think McAfee will mitigate this scenario. In my experience antivirus programs are so painful and slow that I would accept almost any inconvenience to avoid using them, for example, doing dev…

Nothing says we need to mimic all the ways things are done in Windows just because.

Let's say you already have regular zfs snapshots of your workstation, that get synced to one of your servers using something like syncoid or zfs-repl.

Then you could have a service that runs e.g. a daily scan of the most recent snapshot.

Or regular scans of newly modified files, with a less frequent full filesystem scan locally. The upside of Linux is that you can tailor it to your needs.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#15

Post by matkoniecz » Mon, Apr 05, 2021, 6:05 PM UTC

itvision wrote: post #12

yakubin wrote: post #8

The page outlines some security issues of Linux Desktop. It doesn't explain how an antivirus would mitigate them. It just ends with > As you can see, having a decent antivirus in Linux is not that a crazy idea. Well, actually, it is far from obvious. Antivirus software even on Windows is commonly the thing that makes the system more vulnerable, not less. This page however uses the word "antivirus" as "a magical piece…

> The idea that to fix a security issue you should install an additional program which "increases" security is dubious. For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? > The problems listed on the page are real and we should tackle them. Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anythi…

> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux?

Is it actually working for Windows? Especially for programmers.

"Avast detected unusual, rarely program and quarantined it" - well, I just compiled it, I bet that it was not seen by AV before. That was my latest contact with AV sotware.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#16

Post by staticassertion » Mon, Apr 05, 2021, 6:05 PM UTC

Alternatively, no operating system needs a realtime antivirus, and they're actively harmful. It's fine to run a daily or weekly scan to deal with commodity malware, but otherwise they add no value.

The other day we were writing an exploit and defender popped up to block it. It was literally faster to bypass defender than to figure out how to disable it in the UI.

Linux is a hilarious security disaster but AV is not the solution.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#17

Post by staticassertion » Mon, Apr 05, 2021, 6:07 PM UTC

itvision wrote: post #9

TrueDuality wrote: post #6

This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The tru…

> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For ins…

That they of detection in AV is really rare, because AV (rightfully) optimizes to an extreme for low false positives. Instead you just have slightly more complex signatures that look at syscall ordering or whatever. It's not nearly as powerful as it sounds.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#18

Post by ignoramous » Mon, Apr 05, 2021, 6:08 PM UTC

Linux Myths Series: Setting a password secures user data.

Not when you can change passwords of any user account if you've got physical access: https://askubuntu.com/questions/24006/how-do-i-reset-a-lost-...

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#19

Post by eneville » Mon, Apr 05, 2021, 6:09 PM UTC

GekkePrutser wrote: post #4

Good point but what is a good free antivirus for Linux?

Used clamav a lot in the past, it prevented a lot of Windows viruses making it past qmail on to exchange.

Yes, there have been times when distros have allowed things through, but that happens far less than malware getting through in a self service ecosystem.

The only benefit I see is that AV may point out that you have software that needs updating.

Is running AV on linux worth the downgrade performance that you'd get from dropping your CPU one or two generations and a couple of hours of battery life?

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#20

Post by eMSF » Mon, Apr 05, 2021, 6:10 PM UTC

itvision wrote: post #9

TrueDuality wrote: post #6

This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The tru…

> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For ins…

How could an AV possibly know that a program is supposed to be a “simplistic image viewer”? Besides, there are several legitimate reasons for even simple apps to fetch data from the net (including simply checking for updates).

I'm beyond convinced that any available “advanced behavioral analysis solutions” are way, way more trouble than anything but.