Is there a scenario where releasing an update to virus detection software is better than releasing a kernel security update? I guess maybe if the former was many days faster than the latter?
Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
31–40 of 55 posts
Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
#32The page outlines some security issues of Linux Desktop. It doesn't explain how an antivirus would mitigate them. It just ends with > As you can see, having a decent antivirus in Linux is not that a crazy idea. Well, actually, it is far from obvious. Antivirus software even on Windows is commonly the thing that makes the system more vulnerable, not less. This page however uses the word "antivirus" as "a magical piece…
> The idea that to fix a security issue you should install an additional program which "increases" security is dubious. For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? > The problems listed on the page are real and we should tackle them. Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anythi…
> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux?
Does it work though? What evidence supports this claim? I use Windows with no AV and I've been having no problems. Mainly because I don't install software from shady sources. But I know people who install pirated software, because they can't afford it (a common situation for e.g. architecture students), or pirated games and use an AV and after some time their computers become universally unusable, because of course they got a load of malware. AVs do not protect them. Builtin security mechanisms in Windows (such as UAC) bring a lot more benefit to me than AVs bring to those who pirate software.
> Considering the number of breaches of NPM/Rubt repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them.
People obviously are doing something. Effort is going into Wayland, we continue getting new Linux namespaces in new kernels, firejail is under continued development, some people rewrite their apps from C to Go and Rust (newsboat, coreutils for Debian recently), even more of them gets written in one of those languages, when started from scratch.
It may be that things are moving a bit slow, but such is life in FOSS. NPM doesn't have anything to do with Linux Desktop. If Linux Desktop relied on NPM for security, it would be obviously broken (since distributing software any other way would sidestep NPM mitigations).
> You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety.
Again, I would like to hear what exactly a Linux AV would do. Just compare file checksums against a db? What system APIs would it use? How is an "antivirus" superior to a sandbox? How would it be able to prevent Xorg keyloggers? How would we audit it?
> Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop.
It is exactly what you can do with firejail. The issue with Xorg and firejail is that there is a socket to the outside world that needs to be available in the sandbox for any X apps to work, and then all Xorg issues are available. But that's a flaw of Xorg, not firejail.
> AV vendors have a reputation to keep.
Just like Apple has a privacy reputation to keep, yet doesn't provide end-to-end encryption for the data which is sent to iCloud. They still get to be "champions of privacy". Just like Zoom has a reputation to keep and had a major issue in that regard as well. If it is proprietary, then I have less of a reason to trust it, not more because of a "reputation".
> That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel.
The way to protect against malicious code in the kernel is to move as much code out of the kernel as possible. I certainly don't feel more secure by having more proprietary code run with elevated privileges.
Overall, if Linux security issues cannot be solved systematically, then I really doubt they could be solved with an antivirus. A better bet at that point would be ditching Linux for something else. (In the future maybe some operating systems will be built on seL4, which is promising.)
Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
#33Earlier quoted context omitted.
> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? Is it actually working for Windows? Especially for programmers. "Avast detected unusual, rarely program and quarantined it" - well, I just compiled it, I bet that it was not seen by AV before. That was my latest contact with AV sotware.
My friends sometimes have to download odd software from the net and their AV's have helped them avoid disasters.
Well, 2020 was not a year of Linux of desktop. How many people use Linux AND fail to notice obvious signs AND download malware/viruses common enough to be detected by antiviruses?
Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
#34Earlier quoted context omitted.
As you already mentioned, I would also argue that in general most anti-virus solutions are likely to decrease the security of your systems. Sadly, the majority of AV vendors follow practices that open attack vectors: [1] ,[2] and [3] Many well-respected security researchers do not use anti-virus at all or strongly recommend against: [4] For Linux the technical incentives around ClamAV are a bit better aligned that th…
While all these issues have taken place, AV vendors have solved them and nowadays it's safer to have them running when you need to work with the software you download from the net. If you run nothing but e.g. Windows + some web browser and _never_ download any executables you may as well not run any AV at all. Lastly, Windows Defender has become really good recently, so you don't even need to worry about that.
I do not think so. Its a structural problem:
"Microsoft Defender Remote Code Execution Vulnerability" https://msrc.microsoft.com/update-guide/en-US/vulnerability/...
Patched only on a update from this late March/April. Allows remote attackers to infect targeted systems with executable code via Windows Defender.
Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
#35Earlier quoted context omitted.
> For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? It's interesting that this specific example would've also been caught with a sandbox and permission system. The surface covered between antimalware and sandbox/permssions aren't entirely the same but there's a lot that is shared. Unpopular opinion perhaps, but I think desktop operating…
> Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default. Very much welcomed but both Windows and Linux were not created with this idea in mind and it entails quite an overhead. Under Windows I love using SandBoxie: https://github.com/sandboxie-plus/Sandboxie/issues Under Linux I use firejail but it's 100% user un…
It's definitely not ideal as I'm probably going to get compromised through development tools / extensions I acquire or some Firefox exploit/ exploit in some open source tool I use. However, I've made a big effort on my system to put all proprietary software behind flatpak and customize the sandbox via flatseal.
Right now all the non-open source games I play are installed via flatpak. I also use Spotify and Discord which I've both put behind it. In the case of steam+spotify+some other games,they have no reason to be accessing any of my personal files and so they've been cut off accordingly. Discord has a slightly more permissive model but soon I won't need to give it any direct file system access thanks to recent electron changes (the file chooser should be able to selectively grant permission for files I want).
Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
#36Somewhat related question: is there any way to detect hidden web shells that may be installed on a Linux server? Something like a script that pings a webhook any time any user logs in? I suppose that would be easy to disable if a hacker knows what they're doing. But it could be another layer of security that could tip off an administrator that something is happening.
Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
#37What you need isn't an antivirus...
It's an anti distraction...
Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
#38Thinking aloud here. How common are actual computer viruses (not just malware / ransomware, etc) these days? Meaning, an unauthorized program running on a computer that attempts to propagate itself to other computers. This was a real problem in the past when a program would be written to exploit shoddy network code, or when we still used removable media more frequently. I think all the modern OS vendors have locked their platforms down to prevent this mode of attack.
Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
#39This blog post needs to show how an anti-virus would protect against any of the threats it's talked about. The one that an anti-virus might catch is this: > Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer. This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`. The tru…
> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For ins…
> For instance a simplistic image viewer which opens internet connections and fetches data from the net
How does the AntiVirus know that /usr/bin/mfvwr is supposed to be an "simplistic image viewer"?
Is an simplistic image viewer that allows you to upload images to an image hoster not simplistic, anymore? And is there another category of semi-simplistic image viewers who are allowed to do that but not scan your home directory? What about mfvwr's new feature of finding all your image files?
Who tells the maintainer of the AV that mfvwr became non-simplistic in version 1.5-rc1 and a fully-fledged image manager in version 1.9-beta2?
What about forks that add new, non-simplistic features but keep the name of the binary to be a drop-in-replacement?
Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)
#40Earlier quoted context omitted.
> The idea that to fix a security issue you should install an additional program which "increases" security is dubious. For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? > The problems listed on the page are real and we should tackle them. Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anythi…
> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? Does it work though? What evidence supports this claim? I use Windows with no AV and I've been having no problems. Mainly because I don't install software from shady sources. But I know people who install pirated software, because they can't afford it (a common situation for e.g. architecture students), or pirated games and use a…
> How is an "antivirus" superior to a sandbox?
This. If you really care about protecting your system and not about security theater, consider security through compartmentalization, like Qubes OS does.