The Anti-virus Times

Thursday, July 26, 2018

Disclaimer

1. The author of this issue has a background in software development for Unix-like systems.
2. Nothing mentioned below can be deemed as an attempt to prove that one platform is superior or inferior to another.

A typical news item except for the fact that it concerns free operating systems. How would people respond if the incident affected Windows? Administrators would do nothing more than apply a security patch and/or change settings. Some of the technical details would probably be reviewed in forum discussions. We’re not saying that Linux administrators are unwilling to resolve security issues, but look at the reactions on forums…

And whenever news posts about malware (such as the ones below) emerge:

…the number of people wanting to demonstrate how intelligent they are is increasing dramatically:

And those comments are left by professionals. More often than not, when a news post about issues involving Windows appears, someone will claim that none of this would have happened if Linux had been used.

Of course, the number of malicious programs for Unix-like systems is not comparable to that for Windows or Android—but these operating systems enjoy much greater popularity than Linux. Why are some people so convinced that malware for Linux can’t exist?

We're not saying that Linux is a bad operating system. It has its advantages—after all, most high-performance servers servicing Dr.Web anti-virus service subscribers do not use Windows, and their administrators use open source databases as their Dr.Web AV-Desk server repositories. The problem is that some advocates of this operating system firmly believe and perpetuate certain myths:

• Linux is secure because its code is reviewed by experts on a regular basis. This is arguable to say the least since vulnerabilities that have remained unpatched for years are being discovered regularly in open source programs.
• Thanks to open source, security patches are released promptly for the discovered vulnerabilities. To some extent, this is true, but two problems exist:
  • Patches for commercial programs can be tested against a variety of software and hardware configurations. When it comes to free operating systems, the patches made for them are tested by users.
  • Linux administrators and users are as reluctant to install updates as users of other platforms. Even security patches for publicised loopholes often never get installed.
• Since Linux users don't use administrator accounts, they can't launch malware. The same is true for other operating systems too. However, ordinary Linux users are no different from people using Windows. It’s unlikely that switching from Windows to Linux is going to change the habits of an accountant who clicks on links willy-nilly and doesn't use a strong password.

• Fragmentation keeps Linux safe. Malware must be compiled for each specific distribution. First, attackers may target the most popular distributions. Second, a malicious script can be run on any Linux machine.

But these are general problems (and far from all the myths!). There also exist specific security-related problems:

• No matter what we may think or say about Microsoft, the latest versions of Windows are being constantly upgraded with new security routines, making it more difficult for attackers to exploit vulnerabilities and design new malicious programs. Even if a Trojan acquires administrator permissions, it will have a hard time eliminating the anti-virus because Dr.Web’s self-protection routines operate as system drivers. Meanwhile, issuing the kill-9 command in Linux will shut down any process including the anti-virus.
• Most encryption ransomware programs for Windows incorporate all the code they need to perform their tasks. Linux already includes everything necessary to encrypt data. Attackers only need to write a script that to use out-of-the-box features.