60

I have recently started using Ubuntu. I am wondering about the point of installing antivirus programs on Ubuntu. On SuperUser, I found the opinion that it only detects "windows viruses" and removes them. Is there a point in installing antivirus if I don't have any other OS?

As far as I know, there are no viruses for Linux. What about malware and any other harmful programs? Is it safe not to install any protecting software?

Improve this question
5
  • 11
    +1 because I think it is important that all people with Linux should understand that there is no such thing as 'a 100% save' OS.
    – Mixxiphoid
    Sep 12, 2012 at 7:37
  • Its simple because PCI level 2 needs it!
    – user150563
    Sep 12, 2012 at 12:25
  • I always say common sense is the best antivirus. But even you yourself can't avoid all virusses. Unless it's to big of a performance impact, always install an AV!
    – Simon Verbeke
    Sep 12, 2012 at 14:42
  • 1
    @SimonVerbeke common sense will let you avoid most virus infections; but isn't much help against driveby attacks from legitimate sites that were hacked if your system has the unpatched vulnerability they exploit.
    – Dan Is Fiddling By Firelight
    Sep 12, 2012 at 17:19
  • 2
    A reminder - the first big piece of malware was the UNIX based Morris Worm
    – Rich Homolka
    Sep 13, 2012 at 20:42

6 Answers 6

Reset to default
50

This is simply not true. There are many types of malicious code which can be run on 'Nix.

The point is (and the misunderstanding), is that there is significantly less when compared to Windows. For whatever reason it's become common place to use AV on Windows.

http://en.wikipedia.org/wiki/Linux_malware

There are a few AV programs for Linux.

There is also more information on super user. The rest of 'my' answer is copied from the answer of that post:

Well, it factually is not... it's just less subject to hackers developing viruses that target Linux systems. Consumer grade computers usually run on Windows and thus, when targeting a wide audience, Windows is the way to go.

Don't misunderstand Linux and viruses, there definitely ARE Linux viruses.

Some distros have additional protection layers such as SELinux in Ubuntu for example. Then there's the default firewall and the fact that alien files don't automatically have permission to be executed. Specific execution permission has to be granted before execution is possible.

Then there are several other factors that make Linux a hard place to be for viruses usually non-root users on Linux systems have no to little executable files at their disposal that would allow for viruses to stay undetected en propagate. Some programs just require you to be logged in as root (or by use of sudo) before they run or to access/modify directories other than your home. It's just a lot harder to develop a viable virus that would spread as good as it would in Windows.

UPDATE:

As mentioned below, most machines that run Linux are either servers that are run by people who know a thing or two about what they're doing. People that run Linux for desktop use usually choose to and also do know what they're doing. Almost all computer illiterate run Windows and therefore it's much easier to get those computers infected. "Hey, this machine tells me that I have I virus and I have to purchase this Anti-Virus program called 'FAKETrojanHunter' to get rid of it... Okay, let's do it!"

Because no Linux distribution/installation is equal per se, it's harder to develop malware that would infect them all as efficient as possible. Furthermore, almost all software run on Linux is Open Source, making malware much more easily detectable since it's source is open to the public.

Improve this answer
8
  • 4
    +1 for giving link to possible AV's and explaining why it is generally though that Linux has no viruses. deleted my comment.
    – Mixxiphoid
    Sep 12, 2012 at 7:31
  • 12
    Furthermore, almost all software run on Linux is Open Source, making malware much more easily detectable since it's source is open to the public. What?! There are plenty of examples (especially in the corporate sector) were the software that runs in *nix systems is not FLOSS. And why should a malware writer make the code public?! Almost all computer illiterate run Windows and therefore it's much easier to get those computers infected. What you're describing is called "social engineering", that's completely different from the main attack vectors like browser or plugin exploits.
    – Bobby
    Sep 12, 2012 at 7:58
  • 3
    Also Linux has much more variety than Windows, making it hard to exploit a bug in all of them the same time.
    – vsz
    Sep 12, 2012 at 12:29
  • 7
    "I assume there are more 'Microsoft haters' then that of other operating systems" - nah, it's simply (more windows users == more virus authors who use windows + more targets who use windows == more windows viruses)
    – Adam Naylor
    Sep 12, 2012 at 14:49
  • 3
    @DanNeely Variety is not security by obscurity; restricting access to the source code or other implementation details in the hope that doing so improves security is security by obscurity. This isn't to say that either of making the source code public, or restricting access to it, automatically makes software more secure (when was the last time even the average developer reviewed, say, the OpenOffice or LibreOffice source code for possible security vulnerabilities, let alone intentionally hidden malware?), but let's keep the two concepts clearly separated.
    – user
    Sep 13, 2012 at 12:26
16

First ask why is Ubuntu-Gnu-Linux more secure.

  • As it is MOSTLY (unless you install non-free) Free Software (Software libre): the source code is available (Freedom 1 — the freedom to study how the program works), making it harder to hide malicious code.
  • The huge repositories and the installer: make it, mostly, unnecessary to install arbitrary software.
  • The system is better architected: designed to be secure. If a virus is written, that exploits a vulnerability, then fix the vulnerability (vs blame the virus and detect when it gets onto the system).
  • Files are not executable by default, no matter what there name or extension.
  • Diversity: Different distributions, address randomisation in kernel to make bug exploits more difficult, etc.

In addition you should:

  • Backup regularly.
  • You can use the multi-user feature, even if it is just you using the system:
    • Have a sandbox user for testing new software.
    • Set up subversion (or mercurial, or if you are good at using stuff that is hard to use git) a revision control system, so when you break something you can role it back. Then have the repository owned by a user svn, with no write permission to any one else. Then use tunnelling (ssh) to connect. That way if your account is compromised, the intruder can break things, but the old state will be in the repository, and can not be deleted.
  • Look into configuration management e.g. cfengine, Puppet, Chef (or perhaps the fairly new Ansible).

Note: Gnu/Linux is not perfect, there are many problems. There is currently research into new ways to improve security. But it is still better than the rest (possible exception of some of the BSDs)

Improve this answer
6
  • 2
    You could add that the standard policy on many Unix-like systems is "no executable file" so many simple 'click on this .exe I sent you' attacks are not possible. And free doesn't mean open source. I never had to pay for a malware ;)
    – Yves
    Sep 12, 2012 at 11:34
  • 1
    Note: I say Free Software, not software that is free of charge. Most Free Software is Open Source and most Open Source is Free Software. Note the capital letters. Both Free Software (software that has the 4 freedoms: To run, study, modify, distribute, for any purpose, by/to anyone, for ANY PRICE ) and Open Source (I can't remember the definition, but it is NOT software where the source code is available) are names with definitions.
    – ctrl-alt-delor
    Sep 12, 2012 at 12:06
  • 1
    noted :). I'm French and we use two words (libre for Free Software and gratuit for free-of-charge software), hence the confusion....I think I'm gonna read some English on the FSF website tonight...
    – Yves
    Sep 12, 2012 at 15:52
  • Yes it is easier in French. Unfortunately apparently no one has come up with a better term in English than Free Software, and the explaining the confusion. I often use the French term when speaking in person, but this does not always work.
    – ctrl-alt-delor
    Sep 12, 2012 at 16:32
  • Very nice answer, but I would recommend Git over Subversion, as its repos are tamper-proof (and it's better in just about every other way as well). And I'd recommend Puppet or Chef (or perhaps the fairly new Ansible) over cfengine.
    – iconoclast
    Sep 12, 2012 at 20:04
11

Yes there is. Imagine that you have a file with a windows only virus as part of the payload and it passes through your Linux machine. You have the opportunity to remove it before it is sent with e-mail or on a USB stick to a friend. If this happens the virus is now on his Windows machine.

Improve this answer
1
  • This only makes sense, because there is only one architecture to scan for. If there were multiple operating systems and/or architectures, that suffered heavily from viruses, then would we scan for all?
    – ctrl-alt-delor
    Apr 29, 2017 at 23:14
3

It depends on what you do.

The pure power user

A user that sticks to the distribution provided software only, avoids fishy browser plugins such as Flash and Java, and always updates his system does not need an antivirus.

The reason is simple: an antivirus can only detect known viruses. If his system gets security updates on time, this is just as good. Because the security updates usually roll in a fast as the antivirus signatures.

The file server operator

If you are operating a file-server for Windows users, you want an Antivirus to protect the Windows users.

The player

If you like installing third-party software from non-official package repositories "PPA"s, whatever that you cannot trust, if you manually install software that will not receive automatic security updates and just always jump the latest trends, maybe even try running windows sofware on Linux, then you are just as vulnerable as the average Windows user, who is downloading unsigned software over the internet. Get an Antivirus.

The power admin

The power admin writes his own tool that frequently computes checksum for key parts of his system and sends them off-site for comparison. Since most of the files come from official software packages, there exists a known "truth" of correct checksum. Any modification of a system file is quickly detected, but since his checksum service is not off-the-shelf but a custom solution, any attacker misses this hidden trap, and triggers the alert. (There exist off-the-shelf solutions such as tripwire, but they are fairly easy to disable.) If the virus actually gets that far, and isn't earlier stopped by sandboxes and SELinux policies hand-crafted by the admin in minutious fine-tuning. An anti-virus provides virtually no benefit here.

Improve this answer
3
  • For the 3rd case (The player) you can also use sandboxing. Set up a special user, to install and run the software. Don't give this user sudo privileges (or any other dangerous privileges), don't log in as root from this user. Don't share the same X11 session.
    – ctrl-alt-delor
    Sep 13, 2012 at 9:08
  • "an antivirus can only detect known viruses" This is incorrect. Software to detect and block "suspicious" or virus-like activity has been around for a long time, as part of antivirus software. I clearly remember back in the second half of the 1990s having to configure the AV software to let the software compiler write to *.exe files, because under normal usage writing to executable files is not supposed to happen (possibly aside from software installation, etc.).
    – user
    Sep 13, 2012 at 12:31
  • Well, a regular user cannot write to system executables on Linux anyway. Unless some player screwed up badly that is and keeps on installing software as user. Then there are SELinux and AppArmor to harden. But all that "behaviour analysis" of AV software mostly does not work. It exists, but it largely does not work. What they can detect is new variations of old viruses (mostly generated in malware toolkits, that is)
    – Has QUIT--Anony-Mousse
    Sep 13, 2012 at 13:32
2

Linux viruses are obviously more rare and have more difficulty penetrating to a level where they can really do damage, but they exist.

With Linux systems I worry a lot more about penetrations/attacks. When I ran an SSH server on the normal SSH port I'd see hundreds of login attempts a day from China, mostly random account/password combinations but it made me nervous enough to move the port higher.

I think you'd get much more benifit from a system like tripwire than from a Windows-style antivirus. I believe tripware scans your logs for particular patterns, watches for elevated privilages and permission changes on files.

Improve this answer
4
  • @Anony You said incorrect then something that had nothing to do with my post then agreed with me. Would you consider reading more closely. I said linuxes VIRUSES were more rare, not installs, and I also implied exactly what you said (with the chineese hacker).
    – Bill K
    Sep 12, 2012 at 19:41
  • Sorry, yes, I misread your post.
    – Has QUIT--Anony-Mousse
    Sep 13, 2012 at 7:51
  • As for tripwire. I was running it for some years on a server, but found it unmaintainable in the long run, at least if you constantly keep your system up to date. It made sense when you did only yearly updates, but if the system constantly evolves, you end up constantly updating the signatures, and probably won't notice a modification. Instead, such a system should use e.g. an off-site debsums database to automatically keep in sync with upgrades.
    – Has QUIT--Anony-Mousse
    Sep 13, 2012 at 7:55
  • @Anony I agree about Tripwire, I was mostly using it as an example to show why I don't think AV software is that useful--as we both said above, it won't detect the really important hacks where tripwire-like stuff will, so the AV is less useful than on a windows machine where viruses are the primary attack vector.
    – Bill K
    Sep 13, 2012 at 17:12
0

Linux may be infected, as any other OS, however in your case burdening system with antivirus services is pointless. It's because:

  • you'll probably use Ubuntu Software Center, which works with absolutely trustworthy and secured repository;
  • it'll be really hard for you to execute affected apps, since e.g. Linux does not support exe by default and also does not allow files to execute as easily as windows does;
  • even executed - need admin privileges to make any significant changes in your system (it means "virus" should ask you for password and confirmation to hurt you ;)...

I'm working on Linux for years, using apps from different repositories, visiting dangerous Internet areas and no problem occurred. Don't worry too much :D

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.