1

I know others have asked this, but I have other questions related to this. In particular, I'm concerned about the damage that the virus can do the user itself (his files), not the OS in general nor other users of the same machine. This question came to my mind because of that ransomware virus that is encrypting machines all over the world, and then asking the user to send a payment in Bitcoin if he wants to recover his files. I have already received and opened the email that is supposed to contain the virus, so I guess I didn't do that bad because nothing happened.

  • But would I have survived if I opened the attachment and it was aimed at Linux users? I guess not.

  • One of the advantages is that files are not executable by default right after downloading them. Is that just a bad default in Windows and could be fixed with a proper configuration?

  • As a Linux user, I thought my machine was pretty secure by default, and I was even told that I shouldn't bother installing an antivirus. But I have read some people saying that the most important (or only?) difference is that Linux is just less popular, so almost no one writes viruses for it. Is that right?

  • What else can I do to be safe from this kind of ransomware virus? Not automatically executing random files from unknown sources seems to be more than enough, but is it? I can't think of many other things a user can do to protect his own files (not the OS, not other users), because he has full permissions on them.

1 Answer 1

2

I can't think of many other things a user can do to protect his own files

Make regular backs to media that you take offline. Rotate your media, so if your most recent backup becomes corrupt, you haven't lost everything.

Almost every virus malware problem is trivially solved by a good backup strategy that keeps multiple copies of your data, ideally multiple locations, and at least some of the copies are stored offline.

You can minimize things by mounting your home directory and any location your unprivileged account can write on a filesystem with the noexec flag. This doesn't entirely prevent things from being executed from those locations, but it does filter away the execute ability by default.

You could probably do things with LVM snapshots, so that you take a snapshot before you install/run some entrusted software.

You could setup selinux, or some other mandatory access system to harden your system, this will come at the cost of making your system more difficult to use.

Is that just a bad default in Windows and could be fixed with a proper configuration?

It is a bad default, and Windows could probably lock things down a bit more, but that still wouldn't stop everything. I have seen questions from many neophyte linux users that will blindly follow directions they see off the Internet and trash their systems by downloading and running some script/code that wasn't appropriate to their system. In seems plausible that someone could target something at Linux users.

As a Linux user, I thought my machine was pretty secure by default, and I was even told that I shouldn't bother installing an antivirus

The recent randomware went undetected for a day or two by many vendors. So even properly installed, updated, and fully functional anti-virus software on Windows didn't help the poor souls during the first day.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .