Are Viruses A Major Concern?

[QIII]

Bulletproof?

Heartbleed?

"The October of Java exploits"?

Virtual Machine sandbox jumping?

Maybe not Ubuntu specific, but they certainly all posed threats to your home Linux machines.

I haven't been compromised myself ... ​yet.

Many, many Windows users, me included, can say the same.
Prudence suggests that things like NoScript, ufw, etc., are good precautions.

[ventrical]

What do you think malware is if not exploits of bugs?

The exploiters of *Ubuntu bugs* are practically non-existent (or better said , they are certainly not burning the midnight oil.

I also disagree with your statement about malware. Malware affects perfectly good lines of code. In fact , even the patches that try to lock down unassuming code is a form of malware. MicroSoft software products (with it's authentication schemes) is probably the largest script of malware introduced on a system today. And with Secure Boot and ELAM .. need I say more...yet with Ubuntu ... where .. show me.

Regards..

[ventrical]

Bulletproof?

Heartbleed?

"The October of Java exploits"?

Virtual Machine sandbox jumping?

Maybe not Ubuntu specific, but they certainly all posed threats to your home Linux machines.

I haven't been compromised myself ... ​yet.

Many, many Windows users, me included, can say the same.
Prudence suggests that things like NoScript, ufw, etc., are good precautions.

I wouldn't disagree with your last statement - as I said - nothing is impossible but for the most part, in my own Ubuntu Shack, malware has been non-existent . I have used a variety of made-for-ubuntu scanners, Avast, Comodo, AVG and nothing ever comes up except the EICAR Test. All my service calls are malware removal for Windows machines, not Ubuntu. In fact that is part of the larger reason why I took up Ubuntu. I just got so fatigued removing malware from other peoples systems .. and that is not what I went to University for.

Regards..

[ventrical]

Just for fun I installed ComodAV on a 12.04.4 release that got a lot of use and abuse and it's still the same olde yawner.....

[bashiergui]

I also disagree with your statement about malware. Malware affects perfectly good lines of code.

Fair point. If you set your password to "password" then I can exploit good lines of code. When you configure your ftp server to allow anonymous logon, again I can exploit good lines of code. If I script those exploits then...ta da! I have written malware to exploit good lines of code.

The exploiters of *Ubuntu bugs* are practically non-existent (or better said , they are certainly not burning the midnight oil.

Sure, Windows is far more targeted. Bad actors want to exploit Windows and any kind of server. So the risk of an Ubuntu desktop running no services getting exploited is pretty low.

But do not misunderstand: there are plenty of Ubuntu exploits developed and packaged in Metasploit right now. A google search can find them. They definitely exist. It's pretty simple to exploit bugs in Ubuntu using Metasploit. It's also pretty simple to prevent them. Apply updates regularly and those bugs can't be exploited.

Believing no one will exploit a bug in Ubuntu leads you to erroneously believe there's no point in patching. Totally wrong thinking. Keep your system patched and then it never matters if people start exploiting Ubuntu bugs in the wild.

[VE6EFR]

It's pretty simple to exploit bugs in Ubuntu using Metasploit. It's also pretty simple to prevent them. Apply updates regularly and those bugs can't be exploited.

Believing no one will exploit a bug in Ubuntu leads you to erroneously believe there's no point in patching. Totally wrong thinking. Keep your system patched and then it never matters if people start exploiting Ubuntu bugs in the wild.

I couldn't agree more. This is the main reason I have my system automatically check for security updates daily as well as download and install them automatically. This way my system stays secure without my intervention.

[ventrical]

Fair point. If you set your password to "password" then I can exploit good lines of code. When you configure your ftp server to allow anonymous logon, again I can exploit good lines of code. If I script those exploits then...ta da! I have written malware to exploit good lines of code.Sure, Windows is far more targeted. Bad actors want to exploit Windows and any kind of server. So the risk of an Ubuntu desktop running no services getting exploited is pretty low.

But do not misunderstand: there are plenty of Ubuntu exploits developed and packaged in Metasploit right now. A google search can find them. They definitely exist. It's pretty simple to exploit bugs in Ubuntu using Metasploit. It's also pretty simple to prevent them. Apply updates regularly and those bugs can't be exploited.

Believing no one will exploit a bug in Ubuntu leads you to erroneously believe there's no point in patching. Totally wrong thinking. Keep your system patched and then it never matters if people start exploiting Ubuntu bugs in the wild.

My comments were meant more for MS products, not Ubuntu. However ... we are veering off into other territory here. It is known fact that Ubuntu updates/upgrades can completely bork a system , in LTS stage as well as development release (so yes .. patches will cause breakage and to a noob that may seem like malware. Also , at the EOL of a LTS release the end_user is presented with the option to upgrade to the next LTS milestone which in several cases has out-patched and obsoleted several types of various ATi, nVidia and Intel video drivers - a sure case where patches will do more harm than good.

Practicing a *patching* concept in Ubuntu takes experience and expertise and those willing to learn this have to have a certain type of stamina and endurance. However , in my own experiences I have had great success with patching (keeping system updated) and have learned to lock down previous versions with older legacy systems that will not patch over successfully to newer kernels or newer development releases. Simply put .. a lot of older PCs will not meet the specs when convergence in hemmed in.

I'll look up on your suggest 'Metasploit' and make a comment later but I still think that viruses are not a major concern at this time with Ubuntu. I'll reserve my reasons why. That does not mean to suggest to keep ones radar down and if that seems to be what I have implied then I did not mean it in this way. But certainly know this ; that on an Ubuntu system an end_users downtime will be greatly reduced because the the general absence of malware targeted for it and also for the way the policykit is designed.


Regards..

[bashiergui]

I still think that viruses are not a major concern at this time with Ubuntu.

I completely agree. The point I was making was that it's not because exploits don't exist. It's just that no one is using them en masse.

As for patching, yes it can be challenging. I've had my fair share of issues. Kinda reminds me of this
image.jpg

[vasa1]

...
Believing no one will exploit a bug in Ubuntu leads you to erroneously believe there's no point in patching. Totally wrong thinking. ....

Are you referring one rather popular distro that didn't (or doesn't) offer kernel updates at the "default" level?

[aaditya2]

I've been using ubuntu for the past 3 years and i've never been affected with any virus.

i can only spot a few bugs even in the current version