Monday, November 2, 2009

Linux Windows Virus

There are so many versions of this observation. One view is that Linux is new, and hence virus people have not had time to get to it. Of course, Unix has been around far longer, so it is not clear if there is any truth here. Second, Windows for various reasons have got more targetted specifically (may be because it is far too commercial compared to Unix bases). What interests me is the comment that Linux (perhaps Unix in general) architecture is lot harder for virus like stuff to penetrate and create much havoc. Can anyone post anything technical to support or contradict this claim - I would prefer a technical answer, than a general comment? I have also heard some remarks saying there are a few virus created for Linux. Any one has any pointers?


To put it simple :

NO Linux can have no viruses (like Windows).

Now, a bit more technical :

As a virus in Linux would have to gain root rights and know the root password to damage the system, it's highly unlikely (probably impossible) to get serious virus infections in Linux.

A virus should have root rights under Linux (or sudo), which it can only gain, after it has infected a system by using root rights.

This is somewhat like: what was first, the chicken or the egg.

However, on badly configurated systems (that's the users choice) a worm might damage the system by inadvertently spreading itself. There once was a Linux virus called Ramen (a Dutch word, meaning 'windows' in English. A lab experiment, which did not survive outside the testing grounds. Again not having root rights causes Worms (which could only be created in lab environments) to simply propagate within a part of the filesystem.

There's is ample literature about this on the Internet. E.g. check www.ubuntulinux.org about viruses or any other major / minor distribution.

And it is not because Windows has a larger userbase than Unix or LInux. That has nothing to do with viruses being more prominent on Windows systems.

Windows systems just are far more easy to infect, hijack, a.s.o.

In my opinion Windows will be the end of the Internet as we know it and some MS sponsored studies are circulating by which MS would like to :

a) create a new Internet, dropping the IP-protocol
b) patenting it

There are 2 reasons that Windows is more often infected. First, that it's a more standard build: for example, a virus can target iexplore, outlook express, outlook etc. The second, far more important reason is that it's a business... why target < 1% of the market?

Also, any services running on a port number < 1024 requires root privileges, so any virus successfully attacking a local web service on port 80 ) for example ) will automatically gain superuser privileges.

Linux isn't harder to hack. It has multiuser privileges built in from the start, rather than being bolted on later, which is a good starting point. However, the real reason its not being hacked *that* much is that the money isn't in it at the moment so resources aren't being applied. But software is written by us mere mortals, and we make mistakes, and don't cover all the bases. Open source software tends to get patched faster ( see the latest breaches in DNS, libpurple... ), but it still gets broken. IIRC one of the first trojans was a C program sent by email, along with instructions to automatically compile and run it on reading, and was sent a long, long time before Bill Gates started Microsoft.

Assuming that this will stay the same in the future is a recipe for disaster. Especially as linux is becoming more popular all the time...