Linux/Unix viruses demand special attention

• Related stories

• Alerts

Add your opinion

1. Hi there! I notice you did not include clamav in your linux virus list. Was this simply an ommission in ignorance or do you have reason to believe it to be inadequate for the list? regards Robert Anonymous -- 26/06/03

   Hi there!
   I notice you did not include clamav in your linux virus list.
   
   Was this simply an ommission in ignorance or do you have reason to believe it to be inadequate for the list?
   
   regards Robert

   • Reply to comment
   • Reply to story
   • Report offensive content

2. Virus scanners are a band-aid solution. Trying to detect viruses is constant battle that can never be won, because there are always new viruses and the virus writers are constantly changing their behaviour in order to avoid detection. The real Anonymous -- 26/06/03

   Virus scanners are a band-aid solution. Trying to detect viruses is constant battle that can never be won, because there are always new viruses and the virus writers are constantly changing their behaviour in order to avoid detection.
   
   The real problem is the underlying vulnerability in the operating system, that the virii, trojans and worms exploit. The real way to stop viruses/Trojans/worms in there tracks is to ensure that the OS and all associated software have no weaknesses that can be exploited.
   
   Errors do occur in software, it is a fact of life. What is important is that the errors are detected and fixed as soon as possible and the affected systems are updated shortly there after. This is why many Linux vendors have automatic update services. Using these, the cracks in the OS can be removed before some virus writer can exploit them.
   
   It is finally time for _all_ OS and software vendors to take software errors and security more seriously and not just pay lip service.
   
   Ian

   • Reply to comment
   • Reply to story
   • Report offensive content

3. First, secure your servers properly. A good firewall config that drops everything not known to be allowed is an important first step. Avoid running daemons as root if at all possible, and if you do have to run them as root run them in a chroot e Anonymous -- 27/06/03

   First, secure your servers properly.
   
   A good firewall config that drops everything not known to be allowed is an important first step. Avoid running daemons as root if at all possible, and if you do have to run them as root run them in a chroot environment. Limit user priveleges and enforce decent passwords. Don't allow the use of telnet or FTP - you can replace both of those with the much more secure ssh. Keep the system up to date.
   
   Then, start thinking about virus threats. Viri are an issue for UNIX, but much less of one than windows due to the handling of executables. A file cannot be executed on a UNIX system unless it's explicitly marked as executable - a filename won't cut it. The user would have to save the virus, run "chmod u+x filename", then execute it. As a result, trojans are a significant threat but the auto-executing email worms that are the #1 threat to windows/Outlook hosts are much less significant.
   
   Additionally, a virus on a UNIX system will typically only be able to affect one user, since the users won't have permission to see or alter each others' data, nor the system. This is frequently not true on Windows desktops, where most users can modify the system even if they can't access each others' data. A UNIX system's "administrator" account is never used for day-to-day use, whereas this is depressingly common on Windows sytems.
   
   Viruses and worms are a serious issue on UNIX, but a very different one.

   • Reply to comment
   • Reply to story
   • Report offensive content

4. Worst article ever. Ever. In the history of bad articles on computing. "The more machines you have the more vulnerable you are because Unix worms spread so rapidly". Please take a look at the Code Red worm and even more so Anonymous -- 27/06/03

   Worst article ever. Ever. In the history of bad articles on computing.
   
   "The more machines you have the more vulnerable you are because Unix worms spread so rapidly".
   
   Please take a look at the Code Red worm and even more so the SQL.slammer worm, which took oh, about 10 minutes to spread around the world.
   
   The Linux/Unix FUD stream continues from ZD Not.

   • Reply to comment
   • Reply to story
   • Report offensive content

5. Yet another fud piece from yet another ZD mouthpiece. What a surprise. Full disclosure. Frequent updates. These days it's easy to keep your system current, and if you do you won't be subject to these so-called "viruses". U Anonymous -- 28/06/03

   Yet another fud piece from yet another ZD mouthpiece. What a surprise.
   
   Full disclosure. Frequent updates. These days it's easy to keep your system current, and if you do you won't be subject to these so-called "viruses".
   
   UNIX machines are easy to secure. For example, the idiot low privelege attacks launched from /tmp mentioned in the article. Any properly configured internet-facing server is going to have /tmp on its own partition mounted noexec. Case closed. Excellent firewall tools are also available, and most services can be chrooted. Anyone with even a small amount of motivation can build a secure UNIX or UNIX-like server.
   
   This article tries to suggest that such systems are as succeptible as Windows/IE systems to malware. No they are not, as anyone who has administered both types of systems will tell you.

   • Reply to comment
   • Reply to story
   • Report offensive content

6. REAL INFO Your article is highly inacurate in respects to the details. Even WINE has been adapted to prevent klez running. I could go though your article exposing the sloppy research, but it is a simpler process just to provide the real inf Anonymous -- 28/06/03

   REAL INFO
   Your article is highly inacurate in respects to the details. Even WINE has been adapted to prevent klez running.
   
   I could go though your article exposing the sloppy research, but it is a simpler process just to provide the real info.
   
   Aside from just locking down Linux deployments, turning off/blocking unused services etc, there is just three steps which will insure that your Linux deployment will be much more secure than what Microsoft can offer.
   
   1) Closing the window of exposure
   http://www.counterpane.com/window.html
   Keep uptodate with the security updates. This more than anything else will keep your Linux systems secure. Redhat, for example, provides updated RPMs with fixes for vulnerabilities within days (if not hours), incomparison to Microsoft's YEARS
   http://www.pivx.com/larholm/unpatched/
   If you keep uptodate, then it is highly unlikely that you will need to use steps (2) and (3).
   
   2) Chkrootkit
   http://www.chkrootkit.org/
   Unless you are scanning for Microsoft/apple hosted virus for fileservers or incoming/outgoing emails, you dont need commercial anti-virus scanner for just Linux. Chkrootkit does a better job. It should be noted that none of the worms have exploited vulnerabilities which did not have a fix available - you would have been safe if you keep step (1)
   
   3) Tripwire - proactive defense
   http://www.tripwire.org/
   Tripwire is a tool that checks to see what has changed on your system. The program monitors key attributes of files that should not change, including binary signature, size, expected change of size, etc. Read Robert Vibert's "Selling antivirus razor blades"
   http://vmyths.com/rant.cfm?id=469&page=4
   Linux is better off without the false security provided by the antivirus industy.
   
   This reply was posted to the same article in techrepublic
   http://www.techrepublic.com/article.jhtml?id=r00220030625sta01.htm

   • Reply to comment
   • Reply to story
   • Report offensive content

7. The author references an how-to by Alexander Bartolich but did not read the 12th line of text in that paper? I will quote it here for you... "Viruses are not a threat to Linux!" That line has a foot note reference to an FAQ that goes Dennis Lee -- 28/06/03

   The author references an how-to by Alexander Bartolich but did not read the 12th line of text in that paper? I will quote it here for you...
   "Viruses are not a threat to Linux!"
   That line has a foot note reference to an FAQ that goes into great detail as to why Viruses are not a threat to Linux and the FAQ then starts a long section on virus trojans and worms by saying....
   "Should I get anti-virus software for my Linux box?
   The problem with answering this question is that those asking it know only OSes where viruses, trojan-horse programs, worms, nasty Javascripts, ActiveX controls with destructive payloads, and ordinary misbehaved applications are a constant threat to their computing. Therefore, they refuse to believe Linux could be different, no matter what they hear."

   • Reply to comment
   • Reply to story
   • Report offensive content

8. You forgot Panda Software have a free virus scanner, the signatures was old 11 March 2003 and it picked up viruses Sophos and eTrust did not pick up. So get your facts strait pal, I agree with this other fellow, this is a badly written article. Anonymous -- 28/06/03

   You forgot Panda Software have a free virus scanner, the signatures was old 11 March 2003 and it picked up viruses Sophos and eTrust did not pick up. So get your facts strait pal, I agree with this other fellow, this is a badly written article.
   
   >>Was this simply an ommission in ignorance or do >>you have reason to believe it to be inadequate >>for the list?
   
   I agree with you
   
   http://www.pandasoftware.com/download/linux/linux.asp

   • Reply to comment
   • Reply to story
   • Report offensive content

9. Worms are not viruses, again we see yet another article where the journaist fails to make a clear distinction and fails to understand just how hard it is to infect a machine with a mail borne piece of mal code. Anonymous -- 30/06/03

   Worms are not viruses, again we see yet another article where the journaist fails to make a clear distinction and fails to understand just how hard it is to infect a machine with a mail borne piece of mal code.

   • Reply to comment
   • Reply to story
   • Report offensive content

10. Very well written article. In my experience, too many Linux admins have become complacent and think they are "bulletproof." The fact of the matter is that as cool as Linux is (not very IMHO) it is JUST code. Separate the opensource "move CYBERmerc -- 08/07/03

    Very well written article. In my experience, too many Linux admins have become complacent and think they are "bulletproof." The fact of the matter is that as cool as Linux is (not very IMHO) it is JUST code. Separate the opensource "movement" from the actual bits of the OS/Kernel and understand that no matter how well intentioned the authors are, code is written by humans and thousands of bugs/vulnerabilities/oversights are present and will be present in current and future releases of any operating system that offers advanced functionality.
    
    This is not a chance to belly-ache and moan and say "Yeah but Linux is a lot safer than Windows!" Behaving like spoiled children and turning a blind eye to a very real problem will only cause pain in the future. The fact is that Linux is growing in popularity, and as it does it will naturally become a larger target for virus writers than it has been in the past. This is just common sense and the article did a good job of explaining this. The problem is that many people caught up on either side of the techno-wars are so emotionally immature that they have a hard time facing up to any negative news about their chosen love.
    
    Windows servers are easily secured by a knowledgable administrator, as is a Linux machine. The key here is that companies are paying less and hiring less qualified admins for their systems of choice. They are also less willing to provide training to their employees.
    
    This is all good news for virus writers and hackers. The party is only getting started. Hopefully it will be shortlived, but we all know that this battle will be raging even when Windows 2010 Server is launched (in the year 2011 or 2012) and when Linux 15 is released. The point here is that even though we can learn from the past mistakes, there are always new lessons to learn. This is the price we pay for a world where most computers are connected. It requires that all administrators work together rather than breaking off into groups -- because I promise you that most virus writers don't care about the platform, they just want to see their "babies" grow.

    • Reply to comment
    • Reply to story
    • Report offensive content

11. Linux does not have Outlook which provides an ideal environment for the spread of viruses with auto-executing attachments. That reduces the virus exposure by 90% I would wager. Linux has priviledge separation. That greatly reduces the threat als Tracy R Reed -- 11/07/03

    Linux does not have Outlook which provides an ideal environment for the spread of viruses with auto-executing attachments. That reduces the virus exposure by 90% I would wager.
    
    Linux has priviledge separation. That greatly reduces the threat also.
    
    Throw in something like SE Linux and you pretty much DO have an invulnerable box.
    
    Test drive SE Linux by telnetting to:
    
    http://ultraviolet.org
    user: root
    pass: root

    • Reply to comment
    • Reply to story
    • Report offensive content

12. While there's a tiny bit of truth to this, the article as a whole is immensely misleading. I am speaking as someone who's been responsible for hundreds of servers and desktops running pretty much any OS you can name, so I'm pretty familiar with Laird Popkin -- 11/07/03

    While there's a tiny bit of truth to this, the article as a whole is immensely misleading.
    
    I am speaking as someone who's been responsible for hundreds of servers and desktops running pretty much any OS you can name, so I'm pretty familiar with this area.
    
    The tiny bit of truth is that there are a few UNIX "viruses" (worms, etc.), so UNIX sysadmin's shouldn't get lazy -- it's always a good idea to keep up with the latest security patches.
    
    Now on to the misleading parts:
    
    One misleading part is that the articles states that "The more Linux/Unix systems connected to your LAN and WAN, the more vulnerable your organisation is since many ... viruses proliferate rapidly" -- this is simply not true. The more homogenous your environment is the more danger there is of a single vulnerability allowing for penetration across all of your systems -- the more different operating systems you run, the more resistant you are to getting wiped out. A Windows virus can't penetrate a Sun server, and vice versa. So for a company with primarily Windows computers, security would be improved by running non-Windows machines for, say, mail and file servers so that the flood of Windows viruses can't wipe out those central services. Yes, they could be compromised by the (currently extremely rare) UNIX worms, but those wouldn't spread to the Windows desktops, so again you'd be better off overall. This is the same situation as the danger with agricultural monoculture, where (for example) too many people grew the same potatos in Ireland, so when a disease wiped out that kind of potato there was a terrible famine. If they'd been growing hundreds of different kinds of potatoes, a few crops would have been wiped out, but overall the country would have been far healthier.
    
    Another misleading bit is to equate the impact of Windows and UNIX viruses. Due to the very different designs of the operating systems, once Windows is compromised the attacker (virus, worm, etc.) often has complete access to the entire system, and can do unlimited damage. UNIX systems are intentionally far less integrated than Windows (your email program never automatically executes attachments, etc.), typically default to only running services that you specifically enable, and enforce strict access controls, all of which serve to limit entry points for attacks and to "firewall" any compromised software. The result is that UNIX viruses typically do far less damage than Windows viruses.
    
    Also, operating systems are not all equally secure. For as many years as the data has been tracked, Microsoft's operating systems have consistently had the most vulnerabilities (and intrusions) detected. There are years where there are _no_ vulnerabilities detected in BSD, for example, while Windows usually rates in the hundreds of new vulnerabilities each year. This isn't particularly mysterious -- the historical data is easily accessible. And the reason is also pretty obvious -- BSD (as a particularly nice example) is engineered to be stable and secure, with a very stable code based subjected to extremely rigorous code reviews. Windows is engineered to have tons of new features in every release in order to get people to buy upgrades. The new features may be great, but from a security perspective, new code is always dangerous, and new features should be read "new vulnerabilities." In terms o security, smaller and simpler are better, and Microsoft sells larger and more complicated.
    
    Note that virus scanners sold for UNIX aren't typically used to scan for UNIX viruses -- they are run on UNIX mail servers in order to purge Windows viruses from email passing through the machine in order to protect other Windows machines. The few viruses that do affect UNIX are quite effectively blocked by keeping current with OS security patches, so there's really no market for UNIX anti-virus software as such.
    
    Finally, while in theory viruses could present a comparable danger to any OS, in practice Windows (a

    • Reply to comment
    • Reply to story
    • Report offensive content

13. Sorry, I got cut off there... Finally, while in theory viruses could present a comparable danger to any OS, in practice Windows (and in particular Outlook, Office and Internet Explorer) are responsible for 99% of reported virus/worm activity, so Laird Popkin -- 11/07/03

    Sorry, I got cut off there...
    
    Finally, while in theory viruses could present a comparable danger to any OS, in practice Windows (and in particular Outlook, Office and Internet Explorer) are responsible for 99% of reported virus/worm activity, so there's a pragmatic reason to run "anything but Windows" for any mission critical servers -- they're targeted by 100x fewer attacks.
    
    So while I agree that UNIX sysadmin's should remain vigilant, this article is pretty misleading as to the actual risks. In order for companies to make reasonable decisions about where to invest their security effort, they certainly shouldn't ignore securiting their UNIX servers, but they shouldn't waste money on installing "anti-virus" software on Linux boxes instead of locking down the Windows desktops to keep out viruses, adware, spyware, etc.

    • Reply to comment
    • Reply to story
    • Report offensive content

14. This was kind of silly. Unices of course have vulnerabilities, but there are usually solutions available for these vulnerabilities well before crackers have had the time to exploit them. This is not true for the Windows world, where there are years old Anonymous -- 13/07/03

    This was kind of silly. Unices of course have vulnerabilities, but there are usually solutions available for these vulnerabilities well before crackers have had the time to exploit them. This is not true for the Windows world, where there are years old vulnerabilities that don't get fixed. Any good unix sys-admin will keep there boxes quite secure without too much trouble from day to day. Windows sys-admins don't have the luxury of being able to do it.
    
    Sendmail, as you note, is an embarassment to the unix community. Hideously complex to configure, almost certainly still riddled with vulnerabilities. But even with that so, it is far more robust and secure than Exchange Server.
    
    It's good to enjoin sys-admins to get complacent about their unix installations. Luckily, most unix sys-admins are already not complacent.

    • Reply to comment
    • Reply to story
    • Report offensive content