Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

itvision.altervista.org

Post reply on HN
Print view View original

41–50 of 55 posts

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#41

Post by fsflover »

kitsunesoba wrote: post #22
itvision wrote: post #9

Earlier quoted context omitted.

> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are. Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For ins…

> For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? It's interesting that this specific example would've also been caught with a sandbox and permission system. The surface covered between antimalware and sandbox/permssions aren't entirely the same but there's a lot that is shared. Unpopular opinion perhaps, but I think desktop operating…

> I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default.

https://qubes-os.org

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#42

Post by Causalityl »

matkoniecz wrote: post #15
itvision wrote: post #12

Earlier quoted context omitted.

> The idea that to fix a security issue you should install an additional program which "increases" security is dubious. For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? > The problems listed on the page are real and we should tackle them. Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anythi…

> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? Is it actually working for Windows? Especially for programmers. "Avast detected unusual, rarely program and quarantined it" - well, I just compiled it, I bet that it was not seen by AV before. That was my latest contact with AV sotware.

Avast itself recently became malware and got its extensions pulled. Another reason for architectural security is that every third party program capable of updating itself has one unfixable vulnerability: the almighty dollar. A company gets bought out or an individual gets bribed and suddenly a stranger's in your house.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#43

Post by theamk »

yosito wrote: post #36

Somewhat related question: is there any way to detect hidden web shells that may be installed on a Linux server? Something like a script that pings a webhook any time any user logs in? I suppose that would be easy to disable if a hacker knows what they're doing. But it could be another layer of security that could tip off an administrator that something is happening.

In the modern web dev, you don’t want a mutable web root at all - instead, when you run your deploy command, the entire web root is removed and replaced with latest version from git.

So there are few chances to have “web shells” as long as your git repository is intact, and you deploy periodically.

That said, if you want extra security, you can add a process monitor which sends an alert any time there is an process running with web server‘s user.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#44

Post by ssivark »

yakubin wrote: post #8

The page outlines some security issues of Linux Desktop. It doesn't explain how an antivirus would mitigate them. It just ends with > As you can see, having a decent antivirus in Linux is not that a crazy idea. Well, actually, it is far from obvious. Antivirus software even on Windows is commonly the thing that makes the system more vulnerable, not less. This page however uses the word "antivirus" as "a magical piece…

That’s a good point — even in the more limited sense of security today, the null hypothesis to be compared against is a regularly updated system.

I wonder if there are any viruses/exploits which are known (so that antivirus software can detect it) but unpatched/unpatchable so regular (security) updates are not good enough.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#45

Post by theamk »

ignoramous wrote: post #18

Linux Myths Series: Setting a password secures user data. Not when you can change passwords of any user account if you've got physical access: https://askubuntu.com/questions/24006/how-do-i-reset-a-lost-...

Same with windows and mac os.

You want full-disk encryption or homedir encryption if you want to protect your data.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#46

Post by sliken »

yakubin wrote: post #8

The page outlines some security issues of Linux Desktop. It doesn't explain how an antivirus would mitigate them. It just ends with > As you can see, having a decent antivirus in Linux is not that a crazy idea. Well, actually, it is far from obvious. Antivirus software even on Windows is commonly the thing that makes the system more vulnerable, not less. This page however uses the word "antivirus" as "a magical piece…

Agreed, anti-virus runs with elevated privileges, and downloads rules/code from a central source.

So any compromise in the anti-virus client or the server it downloads from can cause serious security issues. There's been numerous reports of bugs, exploits, and really stupid behavior like man in the middle attacking all certs, and "forgetting" to check if the certs were valid. Similarly false positives can cripple a machine. Some anti-virus companies even put malicious entries into the anti-virus databases to try to trick the competition from banning clean files.

So there is a security cost, CPU cost, memory cost, I/O cost, and reliability costs. It's far from clear that anti-virus makes sense on any platform. Sure the major vendors are pushing FUD to keep the income stream going.

Obviously compromising an anti-virus company would be huge win for an attacker, so it shouldn't be a surprise they are common targets, in particular NSA and GCHQ have both targeted anti-virus companies.

In my experience users of OSX and Windows have MUCH less functionality out of the box and need MUCH more of the dreaded google for software and download from a random site, thus the higher need for anti-virus.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#47

Post by sliken »

itvision wrote: post #26
matkoniecz wrote: post #15

Earlier quoted context omitted.

> For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux? Is it actually working for Windows? Especially for programmers. "Avast detected unusual, rarely program and quarantined it" - well, I just compiled it, I bet that it was not seen by AV before. That was my latest contact with AV sotware.

My friends sometimes have to download odd software from the net and their AV's have helped them avoid disasters.

Did they download a random anti-virus program from the net?

Which ones are the secure ones?

How did they know it was avoided? Did a popup from the software they installed tell them so?

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#48

Post by GekkePrutser »

LeoPanthera wrote: post #30
GekkePrutser wrote: post #4

Good point but what is a good free antivirus for Linux?

Why is it necessary for it to be free? Wouldn't you want your AV provider to be incentivized to keep it up to date? Some types of products should be paid.

Well part of the reason I use Linux is because it's free.. I'd want an AV solution to be that too. Not just as in beer but as in speech too :) The speech part is pretty much mandatory for me. I'd pay for the service if it was decently priced.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#49

Post by GekkePrutser »

itvision wrote: post #28
GekkePrutser wrote: post #4

Good point but what is a good free antivirus for Linux?

Free or not-free - there are none at the moment. ClamAV last time I checked missed over 30% of in the wild malware which renders it pretty much useless. AV-Comparatives and VBulletin have long stopped testing it for this reason.

Well there are some non-free ones. I know Cylance supports some linux distros, and so does McAfee. Maybe others too.

The thing is I don't really want to use those. I use both in work, McAfee is ancient crufty old crap. Cylance is OK but since the takeover from Blackberry their product has gone downhill rapidly. Also, their Linux version is not available to consumers.

Also, if I use one it'd have to be open source. And ideally free in money too, though I could compromise on that if it's not too expensive.

Re: Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

#50

Post by GekkePrutser »

eneville wrote: post #19
GekkePrutser wrote: post #4

Good point but what is a good free antivirus for Linux?

Used clamav a lot in the past, it prevented a lot of Windows viruses making it past qmail on to exchange. Yes, there have been times when distros have allowed things through, but that happens far less than malware getting through in a self service ecosystem. The only benefit I see is that AV may point out that you have software that needs updating. Is running AV on linux worth the downgrade performance that you'd get…

Oh yeah I used ClamAV in the past on Mac. It wasn't great though.
Post reply on HN