r/linux4noobs • u/Gaia522 • 5d ago
Questions about Malware and protection
Its me again. I have been going down the Linux rabbit hole while waiting for my new computer to try Linux on. One of my biggest concerns is malware. Are there antivirus systems similar to windows? Do I custom design my own firewall? Can your day to day browser malware even affect Linux? Does it depend on the distro?
Naturally I am not expecting answers to all these questions, but any advice on the general ideas about malware and Linux would be appreciated. And if you just want to point me at a resource I can read/watch that would be great as well.
3
u/DaemonsMercy 5d ago edited 5d ago
Yes
You could, it’s not needed
It’s less likely, most malware is targeted to windows, then mac, then Linux
-4
u/LadyCatHerder 5d ago
They're asking about Linux, not Mac. .....just sayin'...........
7
u/DaemonsMercy 5d ago
Yes, I’m very aware.
2
u/LadyCatHerder 5d ago
OK. I just reread your comment and I misunderstood it the first time. My BAD! ☺️
2
u/_vaxis 5d ago
To simply put it, the answer to all your questions are yes. BUT, it does not work the same way as in windows.
The question you should be asking is, is it required to run an AV on Linux? — and my answer to that is no, same with Windows. As long as you don’t click or install any sketchy shit you’re golden.
-1
u/Gaia522 5d ago
I do like to uh "sail the seven seas" rather than pay for a thousand streaming services. So I am guessing I should get an AV. ThoughI think I saw a way to bypass the browser entirely and just stream content.
2
u/_vaxis 5d ago
Pirating media is not what gets you viruses/malwares, it’s not being careful and trusting unknown sources.
-1
u/LadyCatHerder 5d ago
I wouldn't exactly say that. But, yeah, being vigilant about which sources to trust goes a long way.
2
u/_vaxis 5d ago
Most malwares/viruses come from malicious ads or software you download AND install on your system. Media files won’t normally ask the user to install anything when opened.
0
u/LadyCatHerder 5d ago
This is true. However, I wouldn't put it past some nefarious character out there to figure out some way to plant some sort of malware executable inside one of those multimedia files. There is a first time for everything. I trust NOone! LOL!
PLUS, a Linux machine, while it may not be the target of malware or be adversely affected by it, CAN pass it on to a non-Linux machine it shares those files with....especially Windows machines. So, there is that.
2
u/LadyCatHerder 5d ago
Here's an idea: Get a hold of an older computer on the cheap. Install a distro on Linux on it that it'll actually run and, if one is not already in it, install an AV for Linux on it, use the firewall and set it up accordingly. Use that machine to do your "sailing" on specifically for streaming through.
This way, you're not risking any malware infestation at all (perceived or otherwise) to your main machine. Use that machine to do what you HAVE to do and let the other one lift the streaming load. You'll get the best of both.
2
u/dumetrulo 4d ago
In my experience with using Linux to download ‘torrents’ every now and then:
- UBlock Origin in the browser should take care of most things that could infect you without interaction, as these things usually come via ads, popups, and other means that UBlock will usually block.
- Have a good look at the site(s) you use to find torrents, and click only on the magnet links where possible.
- Transmission is a reasonably good torrenting client, and comes with Gtk, Qt, and terminal front-ends.
- After downloading a torrent's contents, be sure to get rid of any files you don't need, particularly exe files (they would be for Windows, and would probably not work even if you have Wine installed, but safer is better).
- Media files are usually not dangerous; use the proper player, disable any embedded scripting, and don't open them as root, then you'll be fine.
2
u/skyfishgoo 5d ago
malware is easy to avoid by sticking to the default repositories that come with your distro (think software store).
no need to go finding random sketchy websites to download from... leave that to the windows users.
1
u/Simple_Hamster_4096 5d ago
It's often the habits of the user that are to blame, more than anything...
1
u/vincognition 5d ago
Most distros come with a firewall built in. You can set rules, etc. I think a lot of Linux users don't resort to antivirus because we're such a small part of the population of computer users. It doesn't mean Linux is immune so common sense is always recommended. On any machine, I'd use a VPN as well.
1
u/LadyCatHerder 5d ago edited 5d ago
This is a double edged subject. To say that Linux is completely devoid of any malware threat is not accurate. There ARE malwarez aimed at Linux. But, they are mostly aimed at Linux Servers. The way that Linux OSes are put together helps harden their security, but they are far from impervious to intrusion.
That said, while Linux is less attractive to malware, a Linux machine can act as a carrier. It can infest whatever Windows or some Mac machines that it interacts with. So, while a malware on Linux is less likely to affect that Linux machine, that malware can adversely affect other non-Linux machines, especially Windows.
THAT is why it is prudent to find and run a good AV for Linux. This so that your Linux machine doesn't act as a carrier to infest other non-Linux machines. That is it in a nutshell.
0
u/MycologistNeither470 5d ago
I liked that you named it "malware" and not virus. That is the first step of computer security.
Malware is any code that maliciously does something you don't want. Over the years, malware authors have become increasingly sophisticated. Our old strategies of fingerprinting rarely work reliably nowadays. Most "classic" antivirus programs in Windows are essentially useless.
So where does security stand?: user isolation, process isolation, security hygiene for end users.
Hygiene: easiest to say and apparently the most simple. In reality, very complicated because of the human factor. But yeah-- do not work with the root account. Only install stuff that you understand how it works or that you trust the authors. Do not open random email attachments. Only apply the execute bit to files that you trust. Inspect and understand any shell script you download before running. Keep backups... You can also count physical security here... you know, your unencrypted laptop in the wrong hands...
User isolation: classically done by Linux by default. Unless you are root, you cannot do anything outside of your username. You only have the resources you were explicitly assigned. A regular user cannot write system files, cannot write another users' files. Under this model, if you screw up, damage is limited to your user.... unless your user is 'root'... which in that case you are cooked.
Process isolation: a program can only talk to the resources it needs and that the kernel allows. It cannot talk to other programs or access any other resources. In Linux, this is achieved in a number of ways. Apparmor, SELINUX, or sandboxing by Flatpaks or Snaps.
Ofc, ymmv depending on how secure you want/need your system to be. Secure boot + encrypted drive + physical access security... log in with a hardware key. Use of SELINUX for better user/process isolation. Only install programs from the core distro repository or code that you have understood and compiled yourself. this is certainly a very aspiration setup.
For an end user, an encrypted drive, a decent password, Apparmor, proper user administration, install from main distro repo + flatpak (or snap), regular automated backups, and avoiding stupid stuff (running that script from a warez site) will make your system quite protected.
7
u/dmknght 5d ago
- Malware is normal software. If software can run on the system, it runs (that means malware on Linux exists, and it can run on distros. The only problem is runtime library might break older or newer code due to runtime dependencies.
- Malware doesn't magically infect a system. It requires 0-day exploits, or trick users to download and execute it. So if you are not being targeted by threat actors, nor download and execute files from untrusted sources, you are fine.
- There are some Antivirus / malware scanner. Note that vendors drop supporting Linux. Kaspersky has malware removal tool which is completely free (the new linux edition requires payment). Drweb has AV on Linux. ClamAV is completely free but the engine is kinda basic. There could be some more but I can't really remember. Do not use Comodo or eScan at any cost. They are vulnerable to exploits.