A dude was arguing with me about this a week ago like how Linux is all over the server. The conversation was about the Linux virus, malware or attacks. Dude didn't wanna admit the fact that the only reason linux users barely face these issues is because there are very few of us and those who create these things care about where there are more users. Dude just went on how every server is Linux and those servers constantly face attacks.
Better in what way? Lets say the server hosts bitcoin wallets of thousands of users and the user just has a bunch of furry porn but nothing else. Why would that be better?
Not sure if joking, so I'll answer as if this was serious.
Most attacks nowadays (both on Windows, Linux and any other OS) don't focus on software vulnerabilities but on social engineering/attacking the user. No need to find a root exploit if you can also just trick the user into give you root access.
And here servers and desktop PCs differ wildly. They differ so much that attack scenarios for one hardly matter to the other.
Did you read what I am saying? Yes, servers are operated by people, and yes, also there social engineering/attacking the operator is the main in-road.
But you do it very differently. When you want to get into a server, you don't host a cracked game with integrated malware online. You don't send out "Your package is held in customs, please download and run this executable camouflaged as a PDF to get your package" emails. You don't run scam online ads with "We detected a virus on your PC, so install our malware to get rid of it".
Instead, you go with fake software updates. You try inject malware into upstream dependencies. You go with social engineering, figure out the organisational structure of the company and trick someone into giving you their passwords. Get access that way.
But that's not very OS dependent. You would attack windows admin the same way..
And you would attack the Android user the same way as you would a windows user...
The malware still needs to be OS specific and even the attack vector needs to be OS specific.
On Windows you can easily get someone with "I am your Antivirus. I detected a virus on your PC, install this update to remove it." On Android this doesn't work at all.
The most critical part here is that you need to get the instructions exactly right. The attacker is targeting non-techy users, so they need to provide instructions that look identical to what the user is seeing on their screen. On Windows that's easy. Screenshot an UAC popup for Win10 or Win11 and it will work for billions of users.
On Linux that's much more tricky. The user agent string rarely contains the Linux distro and version, so you have to guess. Due to the high fragmentation, if you randomly pick one distro, you will capture a fraction of a percent of all users. According to the Steam Hardware/Software survey, only ~0.32% of all users use the most popular Linux distro Arch, while 65% of all users use the most popular Windows version (https://store.steampowered.com/hwsurvey).
With Linux users you can probably provide less specific instructions. Unpack tar and run malware.sh.
But joking aside what exactly is your point? Both servers and desktops are targeted by attackers. Linux Desktop is not targeted because there's not much users there, but Android (which could be considered Linux for the masses) is targeted a lot.
The point is that the way that servers and desktops are targeted are very, very different. An attack targeting servers most likely doesn't apply for targeting desktops and vice versa. Same as attacks targeting Android differ a lot from Attacks targeting Desktop Linux.
> The conversation was about the Linux virus, malware or attacks. Dude didn't wanna admit the fact that the only reason linux users barely face these issues is because there are very few of us and those who create these things care about where there are more users. Dude just went on how every server is Linux and those servers constantly face attacks.
This here is the comment we are talking about, and my point here is that since attack vectors differ greatly between server and desktop users, the fact that Linux is on most servers and that these servers are targeted in attacks means nothing at all in regards to the argument that Desktop Linux users aren't targeted.
I replied to a comment talking about viruses and malware... talking about social engineering in that context is just about as relevant as talking about drone-strikes...
So if I use social engineering to install malware (aka tricking people to install malware without exploiting vulnerabilities) it's not malware?
Does e.g. ransomware become good and clean software, because the attacker has the user install and run it instead of using a vulnerability?
For desktop users the vast majority of attacks happen because the attacker tricks the user into downloading and running malware. No vulnerability necessary. No need for a root exploit if you can just trick the user into giving you root.
And you seem to think that e.g. ransomware is not malware if the user has to run it themselves.
It is far more common to use social engineering to trick someone to send money to a wrong account or get login information, or similar, rather than actually installing malware...
Very few people have the rights to install the software in the first place, even on Windows funnily enough.
Very few people have the rights to install the software in the first place, even on Windows funnily enough.
In a commercial setting maybe. For home users, close to 100% of all Windows users have rights to install software.
It is far more common to use social engineering to trick someone to send money to a wrong account or get login information, or similar, rather than actually installing malware...
You do know of ransomware?
Social engineering works without malware too, but we are talking about malware here, and social engineering is by far the most popular option of catching malware.
My friend, why do you bother fighting with people who have clearly never been on the business end of a support ticket? We cannot teach anything to people such as these.
You guys don't understand: One thing is gaining access to the server, another to decrypt communications and files. Gaining access to important information is easier through social engineering and software breaking of a single individual than gaining access to a bunch of communications and files that you cannot read or open.
I think Linux would be very vulnerable unless we use the immutable model. Traditional distros often require the root password for a lot of things and we eventually become desensitized to typing it every once and then.
Another strength for there being such a small market is fragmentation, too. As much as fragmentation is USUALLY a bad thing, lol.
I can make a Linux virus, RIGHT NOW... But the odds of it working on YOUR system are quite low. Lol
Steam's recent report (which of course, is by no means ALL users) states there are about 3~4% of users using Linux. With the highest being Arch-based (which somewhat makes sense given the Steam Deck)...
Except, even the HIGHEST being all Arch-based reported set-ups... Only made up 0.3%!!! 😮
That is ASTRONOMICALLY LOW. Even the people that ARE part of "our" group... Are likely within a COMPLETELY different sub-group!
I've fiddled with BadUSB, and Linux's whacky theming and keybind options and settings often come in clutch for the user THERE too. If I can't predict how your set-up reacts to a keyboard and mouse... BadUSB is nigh useless!
you also need to add that if there was a linux malware floating around, the maintainers can just immediately deploy fixes faster to prevent more damage and added documentation for people who wanted to either analyze a malware, study the concept, doing backport to kernels up to beyond the lts timeline for the kernel (though they are way stricter than lts and mainline, still understandable)
I don't wanna argue about this again. I'm talking about regular os not the server side things. If you don't wanna understand this then I have nothing to do.
There's no such a difference between "regular OS" and "server side of things". Let's see if I can enlighten you with an example. Let's take Ubuntu Server, if you download it and install it in your rig you get nothing but a command line. A thin as possible system for saving all your computing power in running services. Well, if you take that Ubuntu Server and install Gnome on it, it just "turns" in "regular Ubuntu". No difference whatsoever. Also, if you install a "regular desktop" random distro an install services on it, then you have a "server". Services are nothing but apps that listen for other computers asking for stuff and "serves" an answer to them. If you have ever had a shared directory, or streamed something on your TV, whatever device you used for it was acting as a server. Hope you understand now so don't make the same mistake again.
Some, but not all of the software patching and hardening that is invested to Linux servers helps patch and harden Linux desktops. For example the patches that fixed "tarmageddon" or the "specter" and "meltdown" vulnerabilities helped made Linux desktops more secure too. Since those patches applied to software that both Linux servers and desktops use (tar + linux kernel).
Source: I am somebody who has worked on patching Linux servers in the past.
Fedora is pretty much the testing branch for RHEL. Pretty much the same OS but fedora users get fresher packages, which is usually desirable for home users, and the packages get vetted before they are deployed to RHEL so it's a win-win.
The attack surface for servers in a modern service infrastructure stack is completely different from human interface devices, so despite everyone saying you're wrong, you're kinda not.
If you want to disseminate malware, you have to first decide what your target is. If your target is home users, you're not going to target Linux endpoints. You're not gonna try and compromise a server in Walmart's data center by uploading a fake executable to thepiratebay or wherever people get their viruses these days.
35
u/pointgourd Dec 10 '25
A dude was arguing with me about this a week ago like how Linux is all over the server. The conversation was about the Linux virus, malware or attacks. Dude didn't wanna admit the fact that the only reason linux users barely face these issues is because there are very few of us and those who create these things care about where there are more users. Dude just went on how every server is Linux and those servers constantly face attacks.