Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

Like monitoring for an unknown application doing esoteric things?

I presume there's some sort of security software in this space for servers

> Many proprietary applications can only be successfully installed under sudo or the root account which is a nice and easy way to compromise a computer.

This isn't even worded very well for the common threat vector in this cases which is `curl | sudo bash`.

The truth is that the threat actors targeting Linux almost always do so by "living off the land". A lot of those files are benign or customized to the system leaving the common hash identification method of identifing known malicious binaries as a non-starter. Checking compiled libraries and binaries for sub-classes of behavior also doesn't get very far due to the wide variance of versions across different distributions and customizations done by different administrators.

There are a lot of ways to detect or preventing those changes to the system that are actively deployed (none of which are an anti-virus).

There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are.

There are also a lot of risks with an anti-virus itself. To be useful it needs to be deep in the kernel, above root permissions watching everything. Usually these are proprietary and all the major anti-virus names have had security issues in the past. Un-audited proprietary code running inside the Linux kernel is always a sketchy proposition.

Which leads us back to the common conclusion that no, Linux does not need an anti-virus. They don't solve any of the security problems mentioned and will consume a large amount of system resources to accomplish nothing.

> As you can see, having a decent antivirus in Linux is not that a crazy idea.

Well, actually, it is far from obvious. Antivirus software even on Windows is commonly the thing that makes the system more vulnerable, not less. This page however uses the word "antivirus" as "a magical piece of software that protects the computer against viruses". How does it do that?

The idea that to fix a security issue you should install an additional program which "increases" security is dubious.

The problems listed on the page are real and we should tackle them. However, I don't think that an "antivirus" is the right solution. Instead security should be treated in a systematic way, not something that you add to a system, after it's done. I think we should invest in, among others, sandboxing techniques, move away from Xorg, write system software in memory-safe languages.

Security is not an app to be installed. It's an architectural problem.

It's also ironic that most of the points listed on the page apply equally well to antivirus software. Namely, are distro maintainers qualified to verify antivirus code? What if an antivirus gets compromised? An open source antivirus could also get code submissions with cleverly hidden backdoors. And what if it's proprietary? (Most of them are.) They also commonly run with elevated privileges (the point about sudo).

However, what comes to mind as a relatively easy win with real gains for a large part of Linux desktops would be a global scanner for hostile npm/pip/etc packages. To catch typosquatters, takeovers etc of dependencies.

A lot can be inherited or borrowed from existing implementations.