How is Linux not prone to viruses, malware and those kinds of things?

Question

How is Linux protected against viruses?

---

This question was a Super User Question of the Week.
Read the blog entry for more details or contribute to the blog yourself

Answer 1

Well, it factually is not... it's just less subject to hackers developing viruses that target Linux systems. Consumer grade computers usually run on Windows and thus, when targeting a wide audience, Windows is the way to go.

Don't misunderstand Linux and viruses, there definitely ARE Linux viruses.

Some distros have additional protection layers such as SELinux (See here) in Ubuntu for example. Then there's the default firewall and the fact that alien files don't automatically have permission to be executed. Specific execution permission has to be granted before execution is possible. (See here)

Then there are several other factors that make Linux a hard place to be for viruses usually non-root users on linux systems have no to little executable files at their disposal that would allow for viruses to stay undetected and propagate. Some programs just require you to be logged in as root (or by use of sudo) before they run or to access/modify directories other than your home. It's just a lot harder to develop a viable virus that would spread as well as it would in Windows.

UPDATE:

As mentioned below, most machines that run Linux are either servers that are run by people who know a thing or two about what they're doing. People that run Linux for desktop use usually choose to and also do know what they're doing. Almost all computer illiterate run Windows and therefore it's much easier to get those computers infected. "Hey, this machine tells me that I have I virus and I have to purchase this Anti-Virus program called 'FAKETrojanHunter' to get rid of it... Okay, let's do it!"

Because no Linux distribution/installation is equal per se, it's harder to develop malware that would infect them all as efficiently as possible. Furthermore, almost all software run on Linux is Open Source, making malware much more easily detectable since its source is open to the public.

Answer 2

One of the reasons are user privileges.

GNU/Linux systems are Unix-like systems and that means that they are built to be multi-user systems from ground up. That means that there is a strong separation of responsibilities among users. As a result, a normal user cannot actually damage the system because he doesn't have needed privileges. While there are limited accounts now available on Windows systems too, on GNU/Linux systems it is naturally expected from user to use a limited account for day today use and keep root account only for changing settings (some distributions by default won't even allow users to log as root because there are other safer mechanisms to use root account to modify settings).

On the other hand many Windows users were brought up in Windows 9x era or that era made a big influence on them. Back then only user account was administrator and everything was allowed to that user. Even today on Windows systems which are descended from multi-user Windows NT, it is often required (or at least expected) for user to use account with administrative privileges and use of limited accounts is pretty low among home users.

Answer 3

One advantage that Linux has over Windows is that in order for file to be executable, you have to specifically set its permissions.

This means that the double extension trick (eg "brittany_spears_naked.jpg.exe") won't work because the user will need to make it executable before it'll infect them - and hopefully they'll think its odd that a picture needs to be executable.

Answer 4

Linux is protected, but not invulnerable.

Contrasting Linux/Unix with Windows at a high level, from a security standpoint:

• The Linux kernel (where system permissions are examined and enforced) is much smaller than the Windows equivalent. Smaller means simpler; simpler means easier to examine, with fewer unexpected system interactions. "Smaller" and "simpler" are good things in security analysis. The Windows kernel keeps growing at a high rate.

• Linux users tend to run at lower permission levels than Windows, making it more difficult to affect the entire system.

• Linux started with a simple, flexible, security model. Windows started with requirements for backwards compatibility with systems that had no security model.

• Linux has always had functions (e.g, chroot(2)) to ease the tasks of security conscious programmers.

None of this makes Linux invulnerable to malware. It does mean that attacking a properly configured Linux host is even more difficult than attacking a properly configured Windows host.

Answer 5

Linux has a highly-dedicated geeky community working for it, Even if some malware is written, there is always a solution to it.

Answer 6

The answer to your question depends on what you consider a "virus".

If you use the correct definition of a virus--that is to say, code which modifies an existing executable--then the reason why Linux is not virus-prone is because it isn't a viable mechanism for spreading malicous code on Linux. The reason is that Linux executables are rarely transferred directly from one computer to another. Instead, programs are transferred using package-management software or by distributing source code. The fact that most Linux software is available for free from the source means that people have almost no intensive at all to copy programs from one computer to another.

If by "virus" you mean "worm" -- a program that replicates itself across the Internet, then Linux is not at all immune from that attack. In fact, the original Internet worm, the "Morris Worm", replicated using Sendmail, a program that still comes pre-installed on many Linux systems. Nearly all successful attacks against Linux machines target vulnerable Internet-facing applications, such as a mail server or a web application.

Finally, if you're referring to malicious code in general -- usually a "Trojan Horse", then what protects Linux is primarily the culture. Linux is a seldom-used operating system, which already limits its value as a target. But when you add to that the fact that Linux users are often exceptionally savvy and security conscious, it lowers the likelihood of a successful attack even further. If, for example, your attack plan relies on convincing a user to download and run a program to infect himself, you're dramatically less likely to convince your average Linux user to do so than your average Windows user. Therefore, malware authors when picking a platform to target, go with the obviously more fruitful target.

Answer 7

There are many aspects that contribute towards this:

1. Heterogeneous environment
   • There are many different flavours and many different configurations;
   • Even in the same distribution, the range of different possibilities is huge;
   • Each distribution provides multiple kernels, supports extra patches;
   • Each big company usually rolls out their own flavour of the kernel.
2. Approach to users and history of strong right enforcement
   • Linux is naturally ahead in this area due to very long history of server-oriented development.
3. Viruses are ineffective
   • Linux is the most installed system worldwide, but there aren't many PC/desktops with Linux;
   • attacks on servers are much more efficient when directed;
   • attacks on embedded systems (routers, televisions, etc...) are usually not worth the effort due to limited system functionality.
4. Current focus of virus creators just doesn't meat with the Linux ecosystem
   • Creators go for what is easiest.
5. Viruses are much harder to hide in Linux
   • Linux is an open system that exposes all information, its not that easy to hide something.
6. Open Source
   • Although Microsoft might claim the opposite, having thousands of reviewers for each line of code and even more people capable of patching a security flaw in several seconds does definitely affect the code quality and security positively.

Answer 8

The main reason is that Linux geeks do not make rich targets.

Organized crime aims at the people who buy a simpler system with a desktop and all their applications already installed and well known. And currently the vast majority of such people are using Windows, which makes Windows a much more profitable target.

If there was as much money to make by going after Linux, I'm sure that the massive effort that is today generating thousands of new virus variants and dummy websites per day would have soon also brought Linux to its knees. And with Linux being open-source, the hackers wouldn't even need to decompile anything.

For every clever programmer there is a cleverer one, only that one is a pirate ...

Answer 9

• multiuser, multitask OS
• built to live in the network world (no RFC ports wide open for convenience)
• there is no such thing as ActiveX (nice vector for contamination)
• there is also a nice separation of code from data from configuration files
• all applications and OS programs are up to date thanks to a central repository
• no incentive to visit unknown sites and download software from there
• updates occur when there is an issue to patch, not "black Thursday"
• file extension doesn't mean anything for OS
• No hidden mess, like the registry
• thanks to privilege separations - even if you get "something", is very hard to survive a reboot (as per definitions for a Virus)

Answer 10

I think the fact that Linux runs mainly open-source software is a big bonus here. It's much more difficult for someone to do malicious things to your system when anyone can read the code.

If you only install software from your Linux distributions official package repositories then you're probably a lot safer than you are under Windows where you have to download random executables and installers off the web to get your software.

There are of course other ways that people could get malicious code to execute on your system, but I think this point is worth mentioning anyway.

Answer 11

There is growing number of people who do not know much about computers (or who migrated from Windows) to modern distros like Ubuntu, LinuxMint or Fedora.

They will read any guide or how-to and happily download any script or program and run it as root or sudo. These can be easy targets of trojans. In effect I feel desktop security is difficult unless you restrict what users can do with their computers.

Answer 12

Malware writers want a bigger target market. A lot more people run Mac or Windows than they do Linux. It's like building a website - you want to make sure it works in the major browsers before going to the less popular ones.

Answer 13

One thing I think people always ignore with Linux/Windows comparisons is the users, who they are, and how they think, act and react. You may find the paper Folk Models of Computer Security interesting.

Linux is (almost) never pre-installed. As a corollary, it means that (almost) all installations are installed by choice, by someone who thought enough to chose Linux over something else, and by someone who at least knows enough to use the installer. Having a filter of minimum computer knowledge before using the computer helps.

By contrast, Windows is the default install on most computers purchased. You can have zero skills and buy a Windows computer and hook it to the Internet and not know anything about viruses, worms, trojans, etc, and become a zombie very quickly.

I would like to also say I'm not "blaming the victim". Computers are complicated infinite state machines. Security is hard. But design also matters. Mac OS X doesn't really have any compelling security features that make it safer than Windows. It is also pre-installed on systems, meaning anyone who can buy a Mac will get it running no matter their skill level. But it was designed as a system, with an idea of how the user thinks and will interact with the system. This cuts down not on security holes, but how likely a user will allow them to be exploited.