A history of viruses on Linux | Hacker News Reader

A history of viruses on Linux

neowin.net

37 pointsGarbage10 comments

Obligatory: http://www.gnu.org/fun/jokes/evilmalware.html

The installation would be much easier, if they used a package manager.

This article leaves unasked the real question: Why doesn't linux attract the plague of malware that Windows does (http://www.theregister.co.uk/2010/09/13/malware_threat_lansc...)?

Sure, Windows runs most of the desktop computers, but it even attracts more malware proportionately than Macs do. Linux runs a goodly proportion of the "high value" server installations, so you'd think that would make linux worms (at least) a lot more valuable than Windows worms.

So, does anybody have any pointers about this real question?

Easy: GNU/Linux system are vastly less vulnerable than Windows systems, for at least 2 reasons. (1) Their users tend to actually know how computers work. Therefore they are far less vulnerable to mind attacks (such as hot_chick.jpg.exe). (2) They are more up to date. This is partly a consequence of 1 (users care about security patches), and of "piracy" (illegitimates copies of Windows tend to not be updated frequently).

Also, there are many GNU/Linux distributions out there. So, a security breach on one system may not be there on another. Plus, the virus has to be portable.

Anyway, this focus on viruses is probably misleading: GNU/Linux systems are attacked. Regularly. For instance, any new machine with an ssh login will log more than 500 login attempts a day before the end of the first week. Those attacks may just not attempt to install a virus. They do some other "interesting" stuff, though, like adding a web page at www.yoursite.com/secret-loc/gimme-credit-card-number.html, or sending spam.

Someone "caught" one of those SSH scans recently. It's the "Chuck NOrris" botnet, which apparently runs on MIPS-based DSL, wireless routers: http://www.muni.cz/ics/research/cyber/files/chuck_norris.pdf

That's not exactly the tidal wave of viruses, trojans, BHOs, worms, etc that Windows gets. Even supposing an 'attach' from a Chuck Norris botnetted router suceeded in guessing a user ID and password via SSH, the MIPSEL code wouldn't run on your x86 or x86_84 linux box.

You can still download the code that guy got: http://safu.stream-portal.org/pwnd.tgz

Also, the "fractured" nature of the Linux software base comes to its rescue, eh? No strength in monoculture here?

To some extent this could be because the high value server installations are better managed/protected than the average desktop machine.

In the 3 large companies that I worked in, the people in charge of the server infrastructure had a fairly good grasp of security. The windows servers never got infected despite a few virus outbreaks in the company desktops.

Later a worm by the name of Cheese came out that actually closed the backdoors created by the Ramen virus.

Best part.

Avast found a virus in your link.

according to linked article, avast marks occurences of certain sourceforge.net URL as virus. Which certainly shows something about all these "anti-virus" match-substrings-contained-by-known-threats "solutions".

This brand of toaster is better than the others because it is 10 times harder to make toast than the other brands. It is 10 times harder for an evil person to come into my house and make toast.

Reply on news.ycombinator.com