Linux Myths Series: Linux Doesn't Need an Antivirus (2020)

For some reasons it often works for Windows and MacOS, why wouldn't it work for Linux?

> The problems listed on the page are real and we should tackle them.

Considering the number of breaches of NPM/Ruby repos and other projects hosted on github/gitlab, it surely looks like no one really does anything to tackle them.

> Instead security should be treated in a systematic way

As the article mentions even distro maintainers do not actually care about the issue that much - often because the maintainers do not get paid for their work and do it in their spare time. You cannot expect much from that while a basic AV could provide at least a modicum of additional protection and safety.

> Security is not an app to be installed. It's an architectural problem.

Android solves it by not allowing the user to get root permissions and completely isolating apps. That's unlikely to ever happen to Linux on the desktop.

> Namely, are distro maintainers qualified to verify antivirus code?

AV vendors have a reputation to keep. There are not that many of them actually, and a lot fewer than software packages in an average Linux disto (to the tune of many thousands).

> They also commonly run with elevated privileges (the point about sudo).

That's absolutely true but they work this way to fight off low level malware/rootkits. You can't have it any other way. The same applies to Linux unfortunately - in order to protect against malicious kernel modules you need to hook into the kernel.

I wonder if there are any viruses/exploits which are known (so that antivirus software can detect it) but unpatched/unpatchable so regular (security) updates are not good enough.

So any compromise in the anti-virus client or the server it downloads from can cause serious security issues. There's been numerous reports of bugs, exploits, and really stupid behavior like man in the middle attacking all certs, and "forgetting" to check if the certs were valid. Similarly false positives can cripple a machine. Some anti-virus companies even put malicious entries into the anti-virus databases to try to trick the competition from banning clean files.

So there is a security cost, CPU cost, memory cost, I/O cost, and reliability costs. It's far from clear that anti-virus makes sense on any platform. Sure the major vendors are pushing FUD to keep the income stream going.

Obviously compromising an anti-virus company would be huge win for an attacker, so it shouldn't be a surprise they are common targets, in particular NSA and GCHQ have both targeted anti-virus companies.

In my experience users of OSX and Windows have MUCH less functionality out of the box and need MUCH more of the dreaded google for software and download from a random site, thus the higher need for anti-virus.

Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? Or calls exec() on some weird strings.

However, what comes to mind as a relatively easy win with real gains for a large part of Linux desktops would be a global scanner for hostile npm/pip/etc packages. To catch typosquatters, takeovers etc of dependencies.

A lot can be inherited or borrowed from existing implementations.

Many well-respected security researchers do not use anti-virus at all or strongly recommend against: [4]

For Linux the technical incentives around ClamAV are a bit better aligned that the horrifying realities of the Windows world but still, I am afraid the current status is not that great: [5]

"It might be time to stop using antivirus" [1] https://arstechnica.com/information-technology/2017/01/antiv...

"How to Compromise the Enterprise Endpoint" [2] https://googleprojectzero.blogspot.com/2016/06/how-to-compro...

"AV firms do need to stop breaking HTTPS security" [3] https://www.zdnet.com/article/google-and-mozilla-are-right-a...

"Rutkowska: Anti-Virus Software Is Ineffective" [4] https://www.eweek.com/security/rutkowska-anti-virus-software...

"Clamav : Security Vulnerabilities" [5] https://www.cvedetails.com/vulnerability-list/vendor_id-8871...

Let's say you already have regular zfs snapshots of your workstation, that get synced to one of your servers using something like syncoid or zfs-repl.

Then you could have a service that runs e.g. a daily scan of the most recent snapshot.

Or regular scans of newly modified files, with a less frequent full filesystem scan locally. The upside of Linux is that you can tailor it to your needs.

That's true unfortunately. AV vendors have server solutions (i.e. without UI) for Linux but those scan mostly for Windows/MS Office malware.

Would be interesting to see a benchmark/study evaluating it as a desktop antivirus - but arguably any server-side malware (which I assume is the majority for Linux today) also apply for a large part of Linux workstations.

Next to none.

So there are few chances to have “web shells” as long as your git repository is intact, and you deploy periodically.

That said, if you want extra security, you can add a process monitor which sends an alert any time there is an process running with web server‘s user.

You want full-disk encryption or homedir encryption if you want to protect your data.

Yes, there have been times when distros have allowed things through, but that happens far less than malware getting through in a self service ecosystem.

The only benefit I see is that AV may point out that you have software that needs updating.

Is running AV on linux worth the downgrade performance that you'd get from dropping your CPU one or two generations and a couple of hours of battery life?

ClamAV last time I checked missed over 30% of in the wild malware which renders it pretty much useless. AV-Comparatives and VBulletin have long stopped testing it for this reason.