Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why GNU/Linux Viruses Are Fairly Uncommon

gnu.org

Post reply on HN
Print view View original

71–80 of 117 posts

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#71

Post by smnrchrds »

tombert wrote: post #8
chc-sc wrote: post #4

Earlier quoted context omitted.

I think the real answer is that relatively few people use GNU/Linux

That's about 95% of it. There are other things that give Linux a bit more of an edge in this space as well. For example, every time I use Windows, it feels like every app is asking to run as administrator. Admittedly, I haven't used Windows for about a year, but in Linux, it's pretty rare that I ever do admin/sudo outside of the command line, and I only ever use it when I know what I'm doing. Obviously this isn't som…

Relevant xkcd:

https://xkcd.com/1200/

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#72

Post by dinofacedude »

smnrchrds wrote: post #71
tombert wrote: post #8

Earlier quoted context omitted.

That's about 95% of it. There are other things that give Linux a bit more of an edge in this space as well. For example, every time I use Windows, it feels like every app is asking to run as administrator. Admittedly, I haven't used Windows for about a year, but in Linux, it's pretty rare that I ever do admin/sudo outside of the command line, and I only ever use it when I know what I'm doing. Obviously this isn't som…

Relevant xkcd: https://xkcd.com/1200/

Ah, XKCD. Truly a blessing to the modern world!

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#73

Post by lacampbell »

est31 wrote: post #33
ohazi wrote: post #3

On a more serious note, I'm surprised there hasn't been much discussion about potential malware in official Linux package repositories vs. developer-centric source repositories like npm, rubygems, crates.io, etc. One would hope that the bar is higher with strict maintainership rules, but there are a zillion packages, and you can't vet them all. Also, practically everyone installs binary packages, so until we have ful…

> the [Debian] Release Team recently announced that Debian will no longer allow binaries built and uploaded by maintainers on their own machines to be part of the upcoming release. https://reproducible-builds.org/reports/2019-07/

All the npm cases I can think of have been in javascript code, not 'binaries'. So that wouldn't have prevented any of them.

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#74

Post by svd4anything »

wwright wrote: post #46
nextos wrote: post #5

Earlier quoted context omitted.

Nix/Guix are quite cool to tackle this. They are progressing quite quickly towards reproducible builds, so you can avoid compromised servers sending malicious binaries. Also, since package definitions are quite declarative, I guess it's easier to perform static verification to spot malicious code getting introduced there. There's e.g. Vulnix that scans for CVEs [1]. [1] https://github.com/flyingcircusio/vulnix

I believe they aren’t just progressing towards reproducible builds, but that the whole system is already predicated on them. In Nix, you have to make special exceptions for packages that aren’t rebuildable from source.

Rebuildable is different than reproducible. The Nix system is predicated on rebuilding. Ideally the binaries would be all also reproducible however it turns out making compilation completely deterministic is actually pretty hard. When we reach that point and me and you can both independently produce identical binaries and hash them from exactly the same source code that is beyond fantastic for security and auditing.

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#76

Post by pfundstein »

yesenadam wrote: post #52
pfundstein wrote: post #15

Earlier quoted context omitted.

Most malware code I've seen is terribly written and barely works. Hobbyist malware programmers use Windows and write for Windows for the simple reason that it's all they know. Some skiddies use Kali Linux but only because they managed to follow step-by-step instructions on YouTube without which they're lost.

Maybe if it's 'good' you don't see it? Like we only hear about the criminals that get caught...

The funny thing is the most advanced malware out there today (that we know of) was created by the US and Israeli governments.

[1] https://www.symantec.com/security-center/writeup/2010-071400...

[2] https://www.computerworld.com/article/2934593/duqu-2-0-kaspe...

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#77

Post by necovek »

Godel_unicode wrote: post #57
calais wrote: post #14

Earlier quoted context omitted.

This is a flaw with the repository model for software distribution: it confers the authority of the OS developers to packages not scrutinized to the same degree. Users' metal models of trustworthiness don't track very well the actual scrutiny software is subjected to. This might be a problem with any distribution system.

I think you're overestimating the rigor of other software delivery channels. Consider for instance that the biggest Windows SSH client (PuTTY) was delivered over http from a super sketchy looking website until very recently. Now it's the same super sketchy looking website, but with a green lock!

Haven't used Putty (or Windows, for that matter) for a while, but the site does not look sketchy at all. It looks like either a two decades old site, or a site of someone who purposely objects the modern web design tendencies (and believes some of the earlier mantras of web design, like user should have control of line lenghts by resizing their window).

A "sketchy" web site is the one festered with ads, pop-ups, seemingly modern-looking but with no actual content or with dead links...

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#78

Post by tkfu »

Godel_unicode wrote: post #66
TheDong wrote: post #62

Earlier quoted context omitted.

> all the major scripting languages (PyPI, Ruby gems, and npm) have had malicious packages inserted None of those package repositories are maintained by a limited set of curators. Debian's repositories and other linux distributions repositories are curated. Uploading a malicious package to npm is as easy as typing 'npm publish'. > "reflections on trusting trust" It's a very useful piece of art and a thought experimen…

The point of "... trusting trust" is not really the specific bug, but rather the observation that the whole supply chain matters. Built artifacts as exist on disk in the repo are a relatively small piece of that. > None of those package repositories are maintained by a limited set of curators. It's always interesting to me how few people seemingly know this. Python package maintainers realize how easy it is to add pa…

> The point of "... trusting trust" is not really the specific bug, but rather the observation that the whole supply chain matters.

There's a really fascinating project by the authors of TUF called in-toto[1] that addresses exactly this problem.

[1] https://in-toto.github.io/

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#79

Post by geofft »

jcranmer wrote: post #30
fao_ wrote: post #26

Earlier quoted context omitted.

> I think the real answer is that relatively few people use GNU/Linux 95% of the server market, though. Which is a huge proportion of attack space. Why steal one sod's credit card numbers when you can steal 100s of them at the same time.

When you attack a server, you don't use a virus, you use a phish or something else to gain access to it to do your dirty bidding. What people call "viruses" usually refer only to attacks that work by getting people to execute random crap on their computer with their privileges. Servers are set up and administered in a way such that it is far harder to get somebody to run the payload containing the virus in the first…

It occurs to me that malicious code that scans WordPress etc. sites for vulnerabilities, installs itself, and sends spam and propagates itself does match the general shape of a virus (even to the point where pattern-matching antivirus would genuinely be effective against it). We just for whatever reason tend not to refer to it as a "WordPress virus," but rather e.g. a "reverse shell" or a "botnet."

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#80

Post by dead_mall »

pfundstein wrote: post #15
liability wrote: post #6

I've always sort of suspected there might be a 'don't shit where you eat' component to it. If you're just being a dick by screwing with people for fun, not profit, then maybe you screw with the windows users instead of your fellow linux users. Maybe that's giving them too much credit though.

Most malware code I've seen is terribly written and barely works. Hobbyist malware programmers use Windows and write for Windows for the simple reason that it's all they know. Some skiddies use Kali Linux but only because they managed to follow step-by-step instructions on YouTube without which they're lost.

> Most malware code I've seen is terribly written and barely works.

Yeaah cause someone is just going to be so kind enough to share their perfect example of what malware code should look like to the rest of the world.. (actually there's an F ton available on Github, quasar, pupyrat, etc) Don't be so naive man. As a hobbyist malware programmer myself, I know that you don't know what you're really talking about other than pointing out skids targeting Windows (cause most available malware/RATs are targeted for windows) and use Kali cause-so-many-yt-tutorials.

edit: fwiw, I find it much easier writing malware under *nix cause they come with python and a bunch of dev libs, where as windows I have to dynamically load libraries in sneaky ways. Also implementing rootkits & RunPEs can be pretty damn puzzling -- definitely not that easy as you say

Post reply on HN