Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible for my Linux box to become infected with a malware?

I haven't heard of it happening to anyone I know, and I've heard quite a few times that it isn't possible. Is that true?

If so, whats up with Linux Anti-Virus (security) software?

share|improve this question

9 Answers 9

up vote 104 down vote accepted

First, it's certainly possible to have viruses under Unix and Unix-like operating systems such as Linux. The inventor of the term computer virus, Fred Cohen, did his first experiments under 4.3BSD. A How-To document exists for writing Linux viruses, although it looks like it hasn't had an update in 7 years or so.

Second, source code for sh-script computer viruses has floated around for better than 20 years. See Tom Duff's 1988 paper, and Doug McIllroy's 1988 paper. More recently, a platform-independent LaTeX virus got developed for a conference. Runs on Windows and Linux and *BSD. Naturally, its effects are worse under Windows...

Third, a handful of real, live computer viruses for (at least) Linux have appeared, although it's not clear if more than 2 or 3 of these (RST.a and RST.b) ever got found "in the wild".

So, the real question is not Can Linux/Unix/BSD contract computer viruses? but rather, Given how large the Linux desktop and server population is, why doesn't that population have the kind of amazing plague of viruses that Windows attracts?

I suspect that the reason has something to do with the mild protection given by traditional Unix user/group/other discretionary protections, and the fractured software base that Linux supports. I mean, my server still runs Slackware 12.1, but with a custom-compiled kernel and lots of re-compiled packages. My desktop runs Arch, which is a rolling release. Even though they both run "Linux", they don't have much in common.

The state of viruses on linux may actually be the normal equilibrium. The situation on Windows might be the "dragon king", really unusual situation. The Windows API is insanely baroque, Win32, NT-native API, magic device names like LPT, CON, AUX that can work from any directory, the ACLs that nobody understands, the tradition of single-user, nay, single root user, machines, marking files executable by using part of the file name (.exe), all of this probably contributes to the state of malware on Windows.

share|improve this answer
29  
One issue you brushed past that's worth considering is that the Windows ABI has remained stable for years. (Or rather, MS has gone to a lot of trouble to support all the various ABIs they've released transparently. WoW64, for example.) This means that an executable that runs on Windows 3.1 may well run on Windows 7. This makes for a monoculture within a monoculture: malware writers don't have to rebuild their programs for every version of Windows, as you often have to do for Linux. –  Warren Young Oct 5 '10 at 15:30
36  
I think another reason for the low level of viruses in Unix/Linux and Mac systems is the presence of global package management systems, with trusted repositories configured by default. Whereas for Windows go online to download software from direct malevolent vendors they find while googling, on a unix/linux/mac you use your internal software to browse a repository where new entries are scrutinized and removed if problems are noticed. –  haylem Dec 4 '10 at 13:08
22  
Also, Windows being the land of the proprietary (though that happens on other platforms, I'm looking at you Mac OS), people tend to look for cracked software for this platform significantly more than for others. And going in dark alleys online is no different than going to dark alleys in real life: expect troubles. How can you trust a drug dealers to provide what they advertise? And in an unmodified form? So how can you trust cracked software dealers to provide what they advertise? And without the software being modified? –  haylem Dec 4 '10 at 13:10
4  
Also Data is separated from code and config files (var & home; bin & usr; etc). Look in Windows- Program Files- binaries, config files, data (MS SQL). You can mount dirs with no exec for data. Apps don't execute every file you trow at them (mail clients word processors). Open code for review. Quick fix for problems (check response time for RedHat and Debian guys after threat found in the kernel). When a problem found- the Distro pushes some update (I didn't realize for example- KDE is looking for +x flag on desktop shortcuts for example to execute them which feature was missing at some point) –  jet Jan 10 '11 at 18:07

It helps prevent the spread of viruses in Windows


Remember that Linux is used in many ways, such as file and email servers.

Files in these servers (MS Office files, outlook messages, EXE programs) can be stored with an infection.

Even though they should not affect the servers themselves, one could configure the server to check every file at the moment that is stored to make sure that it is clean and prevent future spread when they are moved back to a Windows machine.

I myself have it installed for when a friend asked me to check why their XP machine is not working, or for when I plugged my pen drive on a Windows machine.

share|improve this answer
31  
+1 the real reason for the existence of AV software on linux, is not so much for scanning for problems that could affect the system, but for problems that could affect other systems (like windows). –  xenoterracide Oct 17 '10 at 3:17
    
This should be an accepted answer. The rest of my household uses Windows. I feel it is safer to plug foreign flash drives into my Linux desktop, scan them, and then declare them safe for connecting to other machines in the home. –  Johan Mar 15 '13 at 9:24

Viruses for Linux are possible in principle and there have been some, however in the wild, there are no widespread Linux viruses. The Linux user base is pretty small and under Linux it is much harder for a virus to do much harm as the user model is pretty restrictive in contrast to e.g. Windows XP. Therefore virus authors normally target Windows.

There is Linux Anti-Virus software, e.g. from McAfee, but no Linux user I know uses such software. It is by far more important to install only software from trustworthy sources and keep your system always up to date by installing security updates in a timely manner.

share|improve this answer
3  
I would like just to add that even if you manage to get a virus (in my 10 years of Linux I never seen one) the worst scenario is that your user folder will be compromised. –  Patkos Csaba Oct 5 '10 at 9:16
30  
No, the worst scenario is complete system compromise. The kernel folk just closed a huge hole in the kernel about six weeks ago that would let any GUI program escalate their privileges to root level. Do a little Googling around, and you'll find other past holes of this nature. It's true that Linux has better security in a lot of ways compared to Windows, but like any other code base of millions of lines of code, you can be sure there are other holes in it waiting to be found. I, too, would advocate keeping systems patched rather than antivirus, but keep your head out of the sand, too. –  Warren Young Oct 5 '10 at 13:43
5  
I have to differ with the "user base is pretty small" reason. The first really wide-spread PC virus was "Brain", in 1988. Surely Linux in 2010 has more desktop users than MS-DOS did in 1988. Why doesn't linux have more viruses, indeed, why doesn't it have a widespread "Brain" virus? –  Bruce Ediger Oct 5 '10 at 18:19
7  
PCs achieved clear platform dominance right around 1988. The tallest nail gets pounded, then as today. –  Warren Young Oct 5 '10 at 20:40
5  
echox is correct. AV software for linux, isn't really there to protect the linux system itself. it's there to scan files that linux is serving. Which is why most of these AV's only look at files they are directed to scan, instead of any file that's accessed or changes on the system. –  xenoterracide Oct 17 '10 at 3:19

As a historical note, the first Internet worm, the Morris Worm, spread through vulnerabilities in Unix utilities. It predates Linux, but shows that it is possible for Unix based systems to be infected.

share|improve this answer
    
The Morris worm wasn't a virus, however. A virus must attach to some other piece of software, whereas the software Robert Morris wrote was in that sense independent. It was self-replicating but also self-sustaining, and thus a worm rather than a virus. –  Michael Kjörling Nov 29 '13 at 13:56
    
@MichaelKjörling malware then? –  Braiam Nov 29 '13 at 18:56

In my opinion, there is one more reason, beside those mentioned in other answers, that Linux platform does not have much viruses. Source code of almost all the components of Linux is freely available.

Say, a team of 5 members develop an application. We include testers and few others in the list and at most 10 person will know the code. Out of these ten, chances are some will have not enough detailed knowledge of the code. Hence the number of people who know code good enough to point out bugs, security holes is very less.

Now if this code is made free/open source, the pair of eyes that will review it increases drastically. Hence the probability of finding security holes also increases.

These new contributors bring their experience with them, and often fresh eyes are able to notice loopholes that originally developers ignored/took for granted/missed.

The more popular the application is, the more contributors it has. I think this freedom/openness contributes to less number of vulnerabilities of Linux platform.

share|improve this answer
3  
I really hate to say this, but the open or closed source nature may only affect the speed at which a particular bug-state is reached. See: "Milk or Wine" by Andy Ozment (andyozment.com/papers/…) and Ross Anderson's "Open and Closed Systems are Equivalent" (cl.cam.ac.uk/~rja14/Papers/toulousebook.pdf) –  Bruce Ediger Oct 14 '10 at 20:03
    
Thanks Bruce for sharing the links. Will definitely go through them. –  Andrew-Dufresne Oct 15 '10 at 2:33
2  
Which Linux user reviews all source code before issuing a sudo make install? –  Calmarius Oct 27 '12 at 16:18

There are already good answers but I'd still like to contribute something.

Including the simple security practices that are still better than windows even after all this time, and all those viruses, I also believe the issues are largely social.

I believe that the main factor is the diversity of distros. This raises the labour involved in making sure that a virus has what it needs to spread. This combined with the demographics of linux users who are not as likely (imho) to click on a dodgy email or generally put themselves at risk means that the success of a virus is further.

People are also arguably more motivated to attack windows.

share|improve this answer

The simple answer is that no operating system is 100% secure, unless it reads itself from read-only medium at startup is 100% secure.

However, Windows has more vectors for infections, those vectors are more readily accessible, and once infected can do much more harm. This can be readily seen by reading the "RootKit Arsenal" or other books.

The number of exploits on any machine is roughly proportional to (ave gain for rooting one machine ) * number of machines/(cost to create rooting malware).

Since the number of exploits is proportional to the number of computers it makes sense that the amount of malware is greater on Windows.

But, it is stupid to assume the only reason. Windows has more viruses is because there are more computers running it. Note that in Linux getting infected with malware is much less costly then in Windows because the damage is more contained. Conversly the amount gained by one rooting is smaller). Note also that the cost of rooting is higher because of the reasons I mention in the first paragraph.

Keep in mind this is true as of now. At this point linux is a better architected system then Windows. There are however forces saying that we need more rapid development of user friendly features. This can lead to making it easier for bugs to exist and viruses to be created. Already I find Ubuntu to be almost as buggy as Windows.

share|improve this answer

While yes, there are a few viruses for Linux, you don't need to worry too much about them. They are uncommon enough to likely miss you entirely.

What you can, and should worry about though, is worms. These programs, unlike viruses that usually take user interaction to infect, spread all by themselves between servers, exploiting vulnerabilities in services and platforms. Worms search for more servers to infect, install themselves on vulnerable machines and frequently modify their behavior - e.g. to serve viruses to visiting Windows clients.

share|improve this answer

Other answers have provided good historical references for viruses on Unix and Linux. More contemporary examples include the "Windigo" and "Mayhem" malware campaigns. These have infected many thousands of systems. Mayhem has been reported to be using the Shellshock vulnerability to spread.

As for Linux malware detection software, you have both open source and commercial alternatives. The most effective, in my biased opinion, is Second Look. It uses memory forensics and integrity verification to detect Linux malware. I am a developer of Second Look.

share|improve this answer

protected by Michael Mrozek Mar 18 '13 at 22:00

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.