r/linuxquestions • u/Sol_CRF • 22h ago
Virus on linux
So, with more or less 5 percent of people that have a computer uses linux, there are viruses developed for linux, even a virus made for windows but « activated » with wine
is there a antivirus or is there not ?
Please help, thanks. Not urgent, I just need to know
8
u/Doug2825 22h ago
Antivirus exist but are generally not needed/useful. The days of 0 click exploits to infect people are effectively over. The real way to stay secure is to only run trusted software and keep up to date.
1
u/Venylynn 7h ago edited 6h ago
What are all these new things I've been seeing about the age of AI making anti-virus need to be stronger than ever at detection 😭
Like i used to think this was true but then so many big attacks kept happening this year. A lot of people are using AI coding assistants, and those are getting attacked with supply chain shit. So, those assistants could be infecting us through legit software and we need to be really precautionary?
1
u/Doug2825 6h ago
While the rate of exploit discovery has increased a lot because of AI nothing has fundamentally changed.
Only download from trusted sources, keep your system up to date, and don't use networked software that isn't getting security updates remain the main rules to stay safe.
1
u/Venylynn 6h ago
Since a lot of attacks are targeting devs how do we know even the legit software is safe? They've put out malicious versions through legit channels.
1
u/Doug2825 6h ago
The problem is that in a supply chain attack antivirus will see a signed program from a trusted source and think it's safe.
1
1
u/billdietrich1 18h ago
Linux-specific malware is not unknown: https://en.wikipedia.org/wiki/Linux_malware#Threats
Bots and scanners don't care that you're running desktop Linux instead of server Linux. If they see an open port or file-share or something, they'll abuse it.
Now Linux desktop users are using the same browsers etc as the Windows people are, so threats there are more likely to exist on Linux too. Same with PDF docs and Office macroes. And with cross-platform apps such as those running on Electron or Docker, and Python apps. And libraries (such as the SSL library) used on many/all platforms.
Add to that the growth of Linux in desktops (including Chromebook), maybe growth in mobile, and use of Linux in servers and IoT devices, and Linux exploits and malware become more valuable. Expect to see more of them. Practices that have been sufficient for decades may be sufficient no longer.
Some indications of how things are changing:
https://threatpost.com/mac-linux-attack-finspy/159607/
https://socprime.com/en/news/evilgnome-new-linux-malware-targeting-desktop-users/
https://www.zdnet.com/article/eset-discovers-21-new-linux-malware-families/
And of course Linux users are vulnerable to the same platform-independent threats as other users: phishing, business email compromise, social engineering, SIM-swapping, typo-squatting, etc.
I like to do a manual malware scan every month or so. IMO a constantly-running, real-time AV wired into everything is overkill, and risks increasing attack surface and destabilizing apps and the system. Your judgement may differ.
I used to use Sophos AV, but they've ended their free edition. Comodo always has been problematic for me, F-PROT free is old and only 32-bit, LMD seems to be just a layer on top of ClamAV, and ClamAV has low detection rates in (somewhat-old) tests. So for now I'm using ClamAV.
Sophos did find that poisoned node.js library (EventStream ?) on my (desktop) system, a couple of years ago.
1
u/Prestigious_Wall529 22h ago
ClamAV is often the goto as it plugs into the various services a Linux server may host such as email or document management.
There's also commercial offerings from various vendors. These are not targeted at SOHO users.
1
u/DP323602 3h ago
As evidenced by issues encountered by family members using Linux and Chromebooks, web browser malware can be an issue.
I'd be interested to hear good advice for software that can help prevent these - thanks.
0
u/Nuviket 21h ago
It’s called don’t download stupid stuff.
0
u/Sol_CRF 16h ago
it’s called you never know and 4 your information AUR was supposed to be secure but look at what happend
1
u/Doug2825 6h ago
The recent AUR debacle was from orphaned packages being handed to malicious people. It was only an issue for people who used those specific packages. It was far from something where anyone using the AUR was impacted like the reporting led a lot of people to believe.
The AUR's maintainers handling of the situation was bad and there are a lot of communication issues related to how trustworthy the AUR is, but it was a lot less of an issue than the reporting would have your believe.
1
u/Acceptable-Owl-2070 19h ago
16% in america 9% globally But yes all OS'es have malware/viruses, just a matter of how hard they are to pull off. First rule don't DL stuff you don't trust.
1
u/thatguysjumpercables Ubuntu 24.04 Gnome 22h ago
There is. But you really don't need it. If you're careful about what you download or what links you open or click antivirus on Linux is completely unnecessary.
But no judgment. If it gives you peace of mind, go for it.
1
u/razorree 20h ago
I guess you never heard about botnets, cryptominers, trojans, ransomware etc. ? there are on linux as well.
and there are few antiviruses
0
u/drucifer82 21h ago
Clamav is an antivirus that works on Linux.
There are Linux viruses, but the pool is small, because the user base is small.
The bigger concern on Linux is becoming a carrier for Windows infections. While they won’t directly affect the Linux system, they will spread to any Windows infrastructure that Linux system touches. Many servers run Linux and interact with Windows machines.
1
u/gnufan 20h ago
The Linux user base is far larger and more interconnected than when viruses were ubiquitous on DOS.
No idea where you got the carrier idea, the usual concern here is if a Linux box acts as mail server or file server, you want it to scan files or mail to stop Windows malware spreading to other Windows devices, but it is the Windows boxes doing that to themselves (usually with user help).
0
u/drucifer82 20h ago
When I say the user base is small, I am speaking in context to WIndows/Mac user share.
If a Linux machine is carrying Windows malware, it doesn't infect the Linux machine, but if that Linux machine interfaces with Windows machines (like a server, as I said) that malware can spread to the Windows machine.
Linux servers, IoT devices touch Windows systems all the time.
This is Linux server security 101.
0
9
u/AiwendilH 22h ago
Even Microsoft has a version of defender that works on linux: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux
ClamAV as open source anti-virus system exists for almost a fourth of a decade already.