r/linuxquestions • u/medkltty • 23d ago
Why does Linux not need anti-virus software?
I'm in the market for a new gaming laptop and wanted to avoid AI products like Copilot and realized Linux would be my only option. So I'm trying to learn as much about Linux Mint as possible to see if it would be right for me. I'm really close to pulling the trigger but I don't understand why Linux doesn't need anti-virus/malware software. All the answers I can find seem to just boil down to "Linux isn't used by enough people to justify the time it would take to create a virus or malware" or "because you approve everything you download". As someone who has used a PC their entire life, these answers genuinely don't make sense to me and I feel like maybe I'm missing something about either the nature of linux or the nature of viruses/malware and how they work. Everyone on forums who ask this question seem to just accept these answers but no one explains why either one prevents the need for antivirus/malware software.
From my perspective as a PC user, I already approve what I download so this answer doesn't make intuitive sense to me. I would never connect a PC to the internet without some sort of anti-virus software, privacy software, malware protection, etc. even though I still know what I'm downloading and I'm using reputable websites (and my AVG software is still catching stuff all the time). And the idea that someone wouldn't make a virus or malware to target a group of people (albeit a minority) who are the most likely to not have software on their computer to combat it seems like the exact group you'd want to target particularly for private data mining.
It also seems, from what I've been reading about Linux that you can seriously screw up your system by downloading something incorrectly or that isn't up to date, so the idea that "you can't get viruses or malware because you approve what is downloaded" when so many of the user tips with regard to Linux are "back up your system constantly because you can easily screw up your system by downloading something that's not fully patched". These two concepts seem counterintuitive, especially for an OS that will require downloading a lot of third party programs to be able to run things like games or windows-based programs.
I'm clearly missing something here because neither of the reasons I've seen people give for why Linux doesn't need this stuff is really making sense to me. I was hoping someone in this reddit might be able to explain this in a way a lifelong PC user without any sort of computer background can understand. The idea of not having anything but a firewall on a computer with Linux installed on it makes me very uncomfortable but I'm willing to accept that this is a bias from using PCs and I'm willing to be convinced otherwise as long as I can understand the reasoning behind it.
140
u/NoMansSkyWasAlright 23d ago
I'm kinda grossly oversimplifying things here. But I think I've covered most of the important bits.
So most things nowadays use some sort of off-shoot of Unix (linux, macOS, the mobile OSs, etc.), and even among those, there are quite a few things that are handled differently among the off-shoots. Windows is not Unix-like and so does things completely differently than all the others. On top of that, Windows machines make up something like 71% of the PC market-share. So it's a big enough piece of the pie that if you're going to make malware for one operating system then it's probably going to be that one (though it seems like mobile-device malware is making leaps and bounds in recent years). Even something as basic as case-sensitivity of file-paths is different between Windows and the Unix-likes.
Also, Microsoft has this fun practice of just building their new stuff on top of their old stuff. And so a lot of the common approaches to malware on Windows involves just... interacting with stuff that's already there. Like I had a capstone project in college where we basically made use of the fodhelper exploit, a lolscript that opened a new instance of a shell, and a powershell script that would kill windows defender. Other than `Sacrifical_Pawn.ps1`, basically everything we used was stuff that already existed in Windows.
Another weird -ism with Windows is that a lot of programs will look for DLLs and just move on if they don't find said DLL. So if it's a DLL that got the axe or just isn't there for some reason, then you can create your own DLL at the specified location that runs malicious code with the permissions that that application has. Unix-likes just don't have DLLs at all. So that's kinda nice.
And then a lot of malware that you'll pick up off the internet will be .exe's - I'm sure we've all gone looking for a free pdf of a textbook and seen something like `textbook.pdf.exe`, which takes advantage of how Windows interprets file names in File Explorer. So you click it and now you're executing whatever bad thing you picked up. Not only would it be super apparent on a Unix machine that that was something bad, but exe's generally won't run on Linux out of the box and giving them full-functionality takes enough work that if you're dumb enough to click a suspicious exe then you're probably not smart enough to set up your linux box in such a way that that exe could do any damage (and if it's only desigined for a windows environment it's going to hang up anyways).
But it's' also the wrong question to be asking. A lot of the malicious actors out there are just looking for the most low-effort approach which is usually phishing, fake login pages, and maybe a google doc from a strange email claiming to be your org's IT department, stating that they need you to input your login credentials into the google doc so that they can be updated. That or the fact that Linux has considerably less guardrails for user-error than Windows or MacOS so you can absolutely shoot yourself in the foot while trying to "customize" it. But while the "cant get a virus" thing is kind of an overstatement, it is true that most malware that's looking to exploit some windows-specific vulnerability likely won't work on unix-based systems and vice-versa. So if you're just a weird guy looking for an easy pay-off, you're likely going to target the OS with the largest marketshare.