Hacker News Reader

Comment by shin_lao | Hacker News Reader

One solid technical reason is that most Windows users run as Administrator (root) which eases the spread of malware.

In addition, the lack of uniformity makes it more challenging to write an Unix virus. You'd need to have the worm recompile itself on the target machine, as did the Morris worm in 1988. That greatly increases complexity and cost.

Many Windows worms target a specific client/OS pair. That means the worm will require you to run, say, Outlook Express and Windows XP. That sounds pretty specific, but the potential target size is so huge that the virus author can allow itself to be that restrictive.

Let's imagine a disease that could contaminate only one human being out of a hundred.

How fast do you think the disease would spread compared to one that can infect ninety human beings out of a hundred?

Why bother write a malware that has got - even if it's perfectly written - an order of magnitude less chances to spread?

View on HN

I will burst out laughing if a worm on my linux starts ask for dependencies.

Why bother write a malware that has got an order of magnitude less chances to spread?

Taking that viewpoint means explaining Windows malware like this: http://www.virusbtn.com/virusbulletin/archive/2009/09/vb2009...

That's an old school Windows file infector, if I read the article correctly. Win32/Induc.A infects Delphi compilers only. And yet it spread around all over the place.

The author of the link above writes this: "It seems clear that we’ve reached an era where rare dependencies, such as having a compiler on the system, or logic bombs can thrive."

Surely linux desktops are far more prevalent than Windows machines with Delphi compilers. This seems like a perfect counter example to the "Market Share" hypothesis. It would seem that the culture of Windows use has some part in their plight.

"Why bother write a malware that has got ... an order of magnitude less chances to spread?"

That's plain wrong. Read Rick Moen takes on the subject here: http://linuxmafia.com/~rick/faq/index.php?page=virus#virus4

I don't know this Mr. Moen, but the fallacy may not be where he believes it is.

When writing an exploit you need to know the kernel, libc and apache version to make your buffer overflow work, because memory layout is important - if it's a buffer overflow. There are so many apache builds, that makes things difficult for a worm (but not for a targeted exploit). Not impossible, but more difficult.

On Windows, the build is uniform.

Additionally, servers are less interesting targets since they are more monitored and operated by administrators. If your plan is to have as many zombies as possible, not a good idea.

Last but not least, a lot of virii and trojans use mail and the web as a channel. AFAIK you don't read mails and visit web pages on servers.

If the underlying argument is that there are less virii on Linux because it's more secure than Windows, this is wrong.

It's difficult to "measure" security and I really don't want to have a Linux vs Windows debate, but Windows cannot be considered as an insecure operating system anymore. User's behavior on the other hand, is still problematic.

Reply on news.ycombinator.com