Linux Myths Series: Linux Doesn't Need an Antivirus (2020) • Hacker News Board

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#21

Post by belter » Mon, Apr 05, 2021, 6:11 PM UTC

TrueDuality wrote: post #6

This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The tru…

As you already mentioned, I would also argue that in general most anti-virus solutions are likely to decrease the security of your systems. Sadly, the majority of AV vendors follow practices that open attack vectors: [1] ,[2] and [3]

Many well-respected security researchers do not use anti-virus at all or strongly recommend against: [4]

For Linux the technical incentives around ClamAV are a bit better aligned that the horrifying realities of the Windows world but still, I am afraid the current status is not that great: [5]

"It might be time to stop using antivirus" [1] https://arstechnica.com/information-technology/2017/01/antiv...

"How to Compromise the Enterprise Endpoint" [2] https://googleprojectzero.blogspot.com/2016/06/how-to-compro...

"AV firms do need to stop breaking HTTPS security" [3] https://www.zdnet.com/article/google-and-mozilla-are-right-a...

"Rutkowska: Anti-Virus Software Is Ineffective" [4] https://www.eweek.com/security/rutkowska-anti-virus-software...

"Clamav : Security Vulnerabilities" [5] https://www.cvedetails.com/vulnerability-list/vendor_id-8871...

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#22

Post by kitsunesoba » Mon, Apr 05, 2021, 6:12 PM UTC

itvision wrote: post #9

TrueDuality wrote: post #6

This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The tru…

> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For ins…

> For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right?

It's interesting that this specific example would've also been caught with a sandbox and permission system. The surface covered between antimalware and sandbox/permssions aren't entirely the same but there's a lot that is shared.

Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default. We've grown accustomed to desktop apps implicitly having access to everything, but if you think about it it's actually a bit strange that an app can just reach out and use your network, camera, etc as it pleases.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#23

Post by zokier » Mon, Apr 05, 2021, 6:14 PM UTC

uniformlyrandom wrote: post #3

That is not a crazy idea at all. I'd feel a lot safer if I could run some detection on my personal Downloads folder, and on my apt feeds. The problem is, Linux antivirus does not really exist. Granted, there is some software that will scan your files for known signatures - but those signatures are for Win/Mac malware, which solves a completely different problem.

Its a bit of chicken-egg problem: "nobody" is buying Linux AV so AV companies are not building extensive databases for Linux, which leads to them being even more useless than their Windows brethren and less desirable to buy.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#24

Post by AzzieElbab » Mon, Apr 05, 2021, 6:14 PM UTC

I argue that an antivirus program is usually worse than a virus wrt to privacy, performance, and stability of the system, regardless of OS. One notable exception is ransomware.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#25

Post by itvision » Mon, Apr 05, 2021, 6:16 PM UTC

kitsunesoba wrote: post #22

itvision wrote: post #9

Earlier quoted context omitted.

> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For ins…

> For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? It's interesting that this specific example would've also been caught with a sandbox and permission system. The surface covered between antimalware and sandbox/permssions aren't entirely the same but there's a lot that is shared. Unpopular opinion perhaps, but I think desktop operating…

> Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default.

Very much welcomed but both Windows and Linux were not created with this idea in mind and it entails quite an overhead. Under Windows I love using SandBoxie: https://github.com/sandboxie-plus/Sandboxie/issues Under Linux I use firejail but it's 100% user unfriendly ;-)

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#26

Post by itvision » Mon, Apr 05, 2021, 6:18 PM UTC

matkoniecz wrote: post #15

itvision wrote: post #12

Earlier quoted context omitted.

> The idea that to fix a security issue you should install an additional program which "increases" security is dubious. For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? > The problems listed on the page are real and we should tackle them. Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anythi…

> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? Is it actually working for Windows? Especially for programmers. "Avast detected unusual, rarely program and quarantined it" - well, I just compiled it, I bet that it was not seen by AV before. That was my latest contact with AV sotware.

My friends sometimes have to download odd software from the net and their AV's have helped them avoid disasters.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#27

Post by itvision » Mon, Apr 05, 2021, 6:19 PM UTC

uniformlyrandom wrote: post #3

That is not a crazy idea at all. I'd feel a lot safer if I could run some detection on my personal Downloads folder, and on my apt feeds. The problem is, Linux antivirus does not really exist. Granted, there is some software that will scan your files for known signatures - but those signatures are for Win/Mac malware, which solves a completely different problem.

> The problem is, Linux antivirus does not really exist.

That's true unfortunately. AV vendors have server solutions (i.e. without UI) for Linux but those scan mostly for Windows/MS Office malware.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#28

Post by itvision » Mon, Apr 05, 2021, 6:21 PM UTC

GekkePrutser wrote: post #4

Good point but what is a good free antivirus for Linux?

Free or not-free - there are none at the moment.

ClamAV last time I checked missed over 30% of in the wild malware which renders it pretty much useless. AV-Comparatives and VBulletin have long stopped testing it for this reason.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#29

Post by itvision » Mon, Apr 05, 2021, 6:24 PM UTC

belter wrote: post #21

TrueDuality wrote: post #6

This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The tru…

As you already mentioned, I would also argue that in general most anti-virus solutions are likely to decrease the security of your systems. Sadly, the majority of AV vendors follow practices that open attack vectors: [1] ,[2] and [3] Many well-respected security researchers do not use anti-virus at all or strongly recommend against: [4] For Linux the technical incentives around ClamAV are a bit better aligned that th…

While all these issues have taken place, AV vendors have solved them and nowadays it's safer to have them running when you need to work with the software you download from the net. If you run nothing but e.g. Windows + some web browser and _never_ download any executables you may as well not run any AV at all. Lastly, Windows Defender has become really good recently, so you don't even need to worry about that.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#30

Post by LeoPanthera » Mon, Apr 05, 2021, 6:25 PM UTC

GekkePrutser wrote: post #4

Good point but what is a good free antivirus for Linux?

Why is it necessary for it to be free? Wouldn't you want your AV provider to be incentivized to keep it up to date? Some types of products should be paid.