Since Android has malware, does it mean no Unix is immune from malware?

Question

Android has virus: Android.Counterclank, Android.Tonclank (seal info, back-door). Does it prove that FreeBSD, Solaris, Fedora, CentOS, ArchLinux, Ubuntu all is running and having similar virus/trojan/malware, but not in publicly well known?

Basically in general linux/unix desktop or server, we do not see because there is no scanner/nor better tools available nor we care by saying Linux/Unix do no thave virus.

But Android shout proves it every Linux/Unix has trojan/virus/malware sitting and sleeping somewhere which is stealing business logic, confidentical information, transactions, paswords etc same like Windows?

Answer 1

There are scanners and tools. But it's not worth the hassle to develop them more.

No system is immune to viruses, trojans, malware. In the end it's just some piece of code that runs, but doing things you don't want. It happens in every systems and 99% of the world is probably vulnerable at some point.

Android has become a really interesting target, this explains why you can see some media activity about vulnerabilities targeting android systems. But it's really nothing special, and the best defense is as always stay up to date, do backups and be alert of suspicious programs/links/activities.

I have been running windows 7 for 2 years without an anti-virus. My system is fast and I never had any problems. It's easy if you know where to look, I know exactly what's executed, and why. If I don't know, I look for it, and I may remove it from my system.

On Unix it's way easier to monitor a system and find suspicious programs/activity. Most people using Unix are competent (more than windows uers) so malware writers will not change their targets that easily, because less chances of success.

So yes, virus are potentially everywhere. But using some diagnostic tools will probably reveal them. On a noisy system as windows and android, viruses' noise will be hard to spot, and at this point it's realistic to consider that you are already infected. Never think you are safe except if you are sure you know what is going on. It takes years of studies and experience to be a competent system administrator, if you install an Unix system, it's your responsibility to become administrator. Or else, accept the fact that you'll never be safe, especially against targeted attacks.

Now let's talk about rootkits. This is the next level, if you get one, you will probably be specifically targeted by someone very competent. As most working rootkits are very recent and kept hidden. You will probably never notice it. If you're lucky your system will crash and this may alert you. There have been rootkits targeting Unix for years, Mac OS X, FreeBSD (There's a book to learn how to write them, very fun, Designing BSD Rootkits), GNU/Linux, etc.

Answer 2

First of all - there are the virus-like apps for linux desktop/server. They are named rootkits.
As far as linux has another security model then windows and android, rootkit often are targeted against applications and not against system at all. I mean, for example there are special rootkits which infect server/desktop via apache or php.
Secondary, "Android is a software stack for mobile devices that includes an operating system, middleware and key applications". It uses modified linux kernel but it has completely different security model, so far it's more vulnerable for different threats.
And as final point - viruses are developed for wide distributed platform. And as far as linux is not wide distributed in end-user world. So there are not many desktops runned linux but there are a lot serevers runned linux.
So far, there are not viruses (in windows meaning, the user runned process which can affect system at all) for linux based desktops, but there are rootkits which are able to infect linux-based servers. From other hand, Android is a wide distributed platform, that's why peoples create the windows-like viruses (runned by end-user) for this platform.

Answer 3

You seem to think that 1) a system can be virus-free; 2) antivirus can catch all threats. If you have really sensitive information and you are relying on antivirus or on the fact an operating system is not as used as others or less targeted by script-kiddies, you're doing it wrong.

For short, no, GNU/Linux, Solaris and BSD aren't virus-free. And will never be. We just don't usually have people running their mail client with administrative priviledges and running whatever Visual BASIC script arrives embedded in an incoming mail message.

There are scanners and tools, that can hash binaries and check for changes, look for setuid programs, and tons of other fingerprints. If you think lack of antivirus means you can't find threats, then you don't know what the real threat is (it's not the script kiddie who just builds a self-replicating worm, it's the guy who's so devoted to build your data that he builds a specially-crafted tool just to attack you, so no antivirus will ever get the fingerprint in their database).

Answer 4

Why are there viruses found on Android, but not so much on FreeBSD, Solaris, Fedora, CentOS, ArchLinux and Ubuntu Desktop systems?

There are several conditions which are important to spread a virus. The most important one is IMHO the infection way.

On servers, for example web servers, there are root kits in the wild for a long time, but not for Desktop systems. Why is that?

A server has to be reachable from the outside, so if there is a known vulnerability, it can be infected. On a desktop system, foreign users can't run code. It's hard to make you step into a trap, for example to let you open a manipulated, broken, malicious image with a certain, known to be vulnerable program, and if you do so, you do it with restricted rights. And from outside, it is hard to tell which version of a program you use, or whether the problem is already fixed on your system. On a server, the software version can often be detected from outside.

Because desktop users mainly use a repository, where they get software from the authors, legally and for free. There is no reason to use a crack for a otherwise expensive software, but on windows, there are much warez circulating where nobody knows where it origins, nobody is responsible, and nobody can complain while using a cracked tool.

On android, the repository and free software idea is given up. There is no central, trusted place where you get your software, but it is an unorganized mess. You often can't investigate, where it's coming from. And the idea to save some money by using a cracked software makes the people vulnerable for letting malicious code on their devices.