Who’s Afraid of Linux Malware?

There once was a time when Windows users could feel relatively safe and secure as they made their online excursions around the World Wide Web.

Those days ended relatively quickly, of course, followed soon afterwards by a similar waning of confidence on the Mac side.

Linux Girl

For those of us who prefer Linux, however, the Age of Innocence — as one might call it — has lasted much longer. Indeed, the recent discovery of the “Hand of Thief” Trojan has brought that fact to the forefront of many users’ minds, frequently accompanied by a raft of fresh doubts and insecurities.

‘What Is Your Level of Paranoia?’

“Given the recent Hand of Thief news in which RSA’s Limor Kessem explains how a Linux malware kit is sold on Russian websites, I have been contemplating about Linux security again,” began blogger Hans Kwint on LXer, for example, in a recent post entitled, “Linux Malware: Should We Be Afraid?

“Here’s my question to you,” Kwint added. “Are you afraid attackers [will] break into your Linux boxes? Do you scan for rootkits from time to time, and check md5-sums of executables against your ‘trusted-list?’ Do you consider one distro safer as another? What is your level of paranoia?”

Linux bloggers, as per their wont, didn’t wait for a second invitation.

‘Many Layers of Defense’

“Linux malware isn’t new, but for one reason or another it never seems to spread far,” Hyperlogos blogger Martin Espinoza began. “Sure, users could be tricked into installing malware from repositories in Ubuntu, but that could happen on any distribution with meaningful package management.

“Linux at least has some generally working security features that help keep infection down,” Espinoza added.

“I’ve been using GNU/Linux for more than a decade and never saw any malware on it while I have seen hundreds of infections on a single PC running that other OS,” blogger Robert Pogson agreed. “Malware does exist, but GNU/Linux has so many layers of defense that unless a repository distributes it, the malware may not even run on a GNU/Linux system.

“There are all kinds of checks against that happening unless someone sneaks it into the source code,” he explained. “With the open development process of FLOSS, that is very unlikely to happen.”

‘Not a Very Powerful Shield’

Any device that runs code can get malware, Google+ blogger Kevin O’Brien told Linux Girl. “This is undeniable. So while Linux has an honorable history of being security-conscious, much depends on what the user does.

“If you run as root instead of as an ordinary user, if you do not require a login to your system, if you have no firewall between you and the Internet, well, you are asking to be a an object lesson,” O’Brien explained.

“The fact is that Windows 8 has pretty much caught up and is a good, secure system if used properly,” he concluded. “Mac OSX is basically BSD at its core. So the only advantage Linux really has now is low market share (on the desktop). That is not a very powerful shield, so learning safe computing applies to us as well.”

‘No Reason to Attack? Please.’

Indeed, “everybody is shocked and amazed that there’s malware for Linux. I say, big deal,” opined Linux Rants blogger Mike Stone.

“It’s a Trojan Horse,” Stone explained. “Do you know what operating systems are immune to Trojan Horses? It’s a pretty straightforward answer: None of them are. Ever. There’s not an operating system that’s ever been written that’s immune to a Trojan Horse.”

Meanwhile, “there will be people that make the claim that Linux is becoming more of a target because it’s becoming more popular,” Stone added. “I say bunk to that too. People that make that claim ignore the fact that Linux is extremely prevalent in every market it’s a member of.”

Linux may not yet be crushing its competition on the desktop, but “who thinks that there’s no reason to attack the operating system that runs the majority of the world’s websites, a massive chunk of the Internet, over 90 percent of the supercomputers out there and now a vast majority of the smartphones sold in the world?

“The Stock Exchanges in New York, London and Tokyo all run on Linux,” he pointed out. “No reason to attack that? Please.”

‘I’m Not Too Concerned’

So, should we be afraid?

“No, not really,” Stone concluded. “We should be careful, but that has always been the case. Nothing has changed about that since the power switch was flipped on the very first computer.

“The rules are simple, and they haven’t changed,” he added. “Use some common sense about where you go and what you do on the Internet, and for Pete’s sake, don’t believe everything you read. Just because an email says it’s from your bank doesn’t mean that it is.”

In fact, most Linux malware is actually “malicious scripts that run inside the browser thanks to other, third-party software — something proprietary like Java or Flash,” Google+ blogger Gonzalo Velasco C. offered.

“I’m not too much concerned,” he added. “GNU/Linux, because of its architecture, is safer than other OSes.The recommendation is always the same: Beware where you click, what you download, which sites you visit. In the case of GNU/Linux machines: never work/run things like the ‘root’ user and you’ll be protected enough.”

‘Everything Will Need to Evolve’

Linux users shouldn’t be scared so much as they should be cautious, began Chris Travers, a blogger who works on the LedgerSMB project.

“The threat profile for Linux malware is fundamentally different than it is for Windows due to a number of historical differences between the user bases,” Travers continued. “In particular, the security models are based on sufficiently different assumptions that these are not really comparable.

“Malware will come to target consumers on Linux, and when it does, we will need to address the challenges it poses,” he concluded. “Everything from code management to repository management will need to evolve to meet such a threat, but it will. The software evolves. The culture evolves. That is life.”

‘Just the Beginning, Folks’

There is no such thing as a safe OS, Slashdot blogger hairyfeet agreed.

“The reasons why are simple: 1. ALL modern OSes are some of the most complex programs ever written by man; 2. Man is fallible and makes mistakes, which translates into holes; and 3. With a larger presence comes more attention from all including malware writers.”

So, “‘Hand Of Thief’ is just the beginning, folks, because as more and more virus writers find out that Android bugs can often run on Linux and that ‘How to write a Linux Virus in 5 easy steps’ works, then more and more malware writers will simply make their wares cross-platform.”

The real question now, hairyfeet concluded, “is whether the Linux community will ‘man up,’ accept this is the case and take steps to minimize risks? Only time will tell, but it IS a legitimate threat.”

‘We Must Take Action’

Similarly, “YES! We must be afraid and take action,” Google+ blogger Alessandro Ebersol urged.

“Years of no significant attacks on GNU/Linux made the users kinda of lazy,” Ebersol explained.

“I, for one, installed NoScript and am avoiding websites that are not well-known,” he concluded. “Every security measure must be taken to assure GNU/Linux won’t be the new win XP for virus and exploits.”

Katherine Noyes is always on duty in her role as Linux Girl, whose cape she has worn since 2007. A mild-mannered ECT News Editor by day, she spends her evenings haunting the seedy bars and watering holes of the Linux blogosphere in search of the latest gossip. You can also find her on Twitter and Google+.


  • I’m a huge Linux fan. I’ve run Linux servers for years, and I used to believe that Linux was an inherently more secure OS than Windows. Of course for years people who are into Microsoft’s products have said that the only reason Linux had so few issues with malware was due to the fact that it had such a small market share in comparison.

    I still think the Linux kernel and core apps, especially those with an enterprise orientation, are more secure than their Windows equivalents, but when you move from the command line to a gui all bets are off. What has happened with the Android OS has proven the supporters of Windows doomsayers to be at least partly right.

    What has happened with Android should be a huge wake up call. There truly is no such thing as an invincible OS. It doesn’t matter whether the development model is open or closed source, both have their security advantages and disadvantages. The price of freedom truly is eternal vigilance, and this applies to computing as much as it does to anything.

  • ++ What Linux Rants said, I disagree wholeheartedly with those who claim the more popular linux becomes then the more malware we will see, Linux IS especially popular on those machines that hold up large sections of the Internet, ask Google,Yahoo,Amazon,Facebook,The Stock exchange, to name but a few. Not to mention the lions share of mobile devices (tens of millions). Of course anything on a network can be exploited, but Linux will never be raped and pillaged the way Windows is. We can see the code we run, others are less fortunate.

  • I don’t remember who said it, or exactly how it is phrased, but there’s a quote out there, something like, "Anything built by a (wo)man can be understood and taken apart by a (wo)man)."

    And, from John F. Kennedy:

    "There are risks and costs to a program of action. But they are far less than the long-range risks and costs of comfortable inaction."

    To put a little fear into the hearts of all you who are basking in a sense of false security:

    There is ABSOLUTELY NOTHING MAGIC about the Linux and UNIX operating systems which conveys upon them greater security than any other operating system.

    The magic stopped when Merlin died.

    –a guy who used to teach OS design.

Leave a Comment

Please sign in to post or reply to a comment. New users create a free account.

How will consumers react to Apple's WWDC 2023 announcements?
Loading ... Loading ...

Technewsworld Channels