Linux malware

Linux malware includes viruses, trojans, worms and other types of malware that affect the Linux operating system. Linux, Unix and other Unix-like computer operating systems are generally regarded as well-protected — but not immune from — computer viruses. According to advocates like Scott Granneman, Linux provides better protection compared to Microsoft Windows.

There has not yet been a widespread Linux malware threat of the type that Microsoft Windows software faces; this is commonly attributed to the malware's lack of root access and fast updates to most Linux vulnerabilities. These are the equivalents of User Account Control and Windows Update in modern Windows operating systems.

The number of malicious programs — including viruses, Trojans, and other threats — specifically written for Linux has been on the increase in recent years and more than doubled during 2005 from 422 to 863.

Linux vulnerability

Like Unix systems, Linux implements a multi-user environment where users are granted specific privileges and there is some form of access control implemented. To gain control over a Linux system or cause any serious consequence to the system itself, the malware would have to gain root access to the system.

Some Linux users run Linux-based anti-virus software to scan insecure documents and email which comes from or is going to Windows users. SecurityFocus's Scott Granneman stated:

The total number of viruses has passed the one million boundary. If the 4 % Linux adoption would be proportional to the amount of malware for this system, we would expect to see at least several thousands of viruses and worms. This may be near an order of magnitude more than observed. Hence minority may not be the only reason contributing to Linux security.

Because they are predominantly used on mail servers which may send mail to computers running other operating systems, Linux virus scanners generally use definitions for, and scan for, all known viruses for all computer platforms. For example the open source ClamAV "Detects ... viruses, worms and trojans, including Microsoft Office macro viruses, mobile malware, and other threats."

Viruses and trojan horses

The viruses listed below pose a potential, although minimal, threat to Linux systems. If an infected binary containing one of the viruses were run, the system would be infected. The infection level would depend on which user with what privileges ran the binary. A binary run under the root account would be able to infect the entire system. Privilege escalation vulnerabilities may permit malware running under a limited account to infect the entire system.

It is worth noting that this is true for any malicious program that is run without special steps taken to limit its privileges. It is trivial to add a code snippet to any program that a user may download and let this additional code download a modified login server, an open mail relay or similar and make this additional component run any time the user logs in. No special malware writing skills are needed for this. Special skill may be needed for tricking the user to run the (trojan) program in the first place.

The use of software repositories significantly reduces any threat of installation of malware, as the software repositories are checked by maintainers, who try to ensure that their repository is malware-free. Subsequently, to ensure safe distribution of the software, md5 checksums are made available. These make it possible to reveal modified versions that may have been introduced by e.g. hijacking of communications using a man-in-the-middle attack or via a redirection attack such as ARP or DNS poisoning. Careful use of these digital signatures provides an additional line of defense, which limits the scope of attacks to include only the original authors, package and release maintainers and possibly others with suitable administrative access, depending on how the keys and checksums are handled.

Vulnerability to trojan horses and viruses results from users willing to run code from sources that should not be trusted and to some extent about distributions not by default checking the authenticity of software downloaded while a system was the target of an attack.

Worms and targeted attacks

The classical threat to Unix-like systems is vulnerabilities in network daemons, such as ssh and WWW servers. These can be used by worms or for attacks against specific targets. As servers are patched quite quickly when a vulnerability is found, there have been only a few widespread worms of this kind. As specific targets can be attacked through a vulnerability that is not publicly known there is no guarantee that a certain installation is secure. Also servers without such vulnerabilities can be successfully attacked through weak passwords.

WWW scripts

Linux servers may also be used by malware without any attack against the system itself, where e.g. WWW content and scripts are insufficiently restricted or checked and used by malware to attack visitors. Typically a CGI script (meant for leaving comments) by mistake allows inclusion of code exploiting vulnerabilities in the browser.

Buffer overruns

Older Linux distributions were relatively sensitive to buffer overrun attacks: if the program did not care about the size of the buffer itself, the kernel provided only limited protection, allowing an attacker to execute arbitrary code under the rights of the vulnerable application under attack. Programs that gain root access even when launched by a non-root user (via the setuid bit) were particularly attractive to attack. However as of 2009 most of the kernels include address space randomization, enhanced memory protection and other extensions making such attacks much more difficult to arrange.

Cross-platform viruses

A new area of concern identified in 2007 is that of cross-platform viruses, driven by the popularity of cross-platform applications. This was brought to the forefront of malware awareness by the distribution of an Openoffice.org virus called Bad Bunny.

Stuart Smith of Symantec wrote the following:

"What makes this virus worth mentioning is that it illustrates how easily scripting platforms, extensibility, plug-ins, ActiveX, etc, can be abused. All too often, this is forgotten in the pursuit to match features with another vendor... [T]he ability for malware to survive in a cross-platform, cross-application environment has particular relevance as more and more malware is pushed out via Web sites. How long until someone uses something like this to drop a JavaScript infector on a Web server, regardless of platform?"

Social engineering

Linux is as vulnerable to malware that tricks the user into installing it through social engineering as other operating systems. In December 2009 a malicious waterfall screensaver was discovered that contained a script that used the infected Linux PC in denial-of-service attacks.

Anti-virus applications

There are a number of anti-virus applications available for Linux, most of which are designed for servers, including:

Avast! (freeware and commercial versions)

AVG (freeware and commercial versions)

Avira (freeware and commercial)

Bitdefender (freeware and commercial versions)

ClamAV (free open source software)

Dr.Web (commercial versions) Eset (commercial versions)

F-Secure Linux (commercial)

Kaspersky Linux Security (commercial)

Linux Malware Detect (free open source software)

McAfee VirusScan Enterprise for Linux (commercial) Panda Security for Linux (commercial version) Root Kit Hunter

Sophos (commercial)

Symantec AntiVirus for Linux (commercial)

Trend Micro ServerProtect for Linux (commercial)

Threats

The following is a partial list of known Linux malware; however, few if any are in the wild, and most have been made obsolete by updates. Known malware is not the only or even the most important threat: new malware or attacks directed to specific sites can use vulnerabilities not previously known to the community or not previously used by malware.

Trojans

Kaiten - Linux.Backdoor.Kaiten trojan horse Rexob - Linux.Backdoor.Rexob trojan Waterfall screensaver backdoor - on gnome-look.org

Viruses

42 Arches Alaeda - Virus.Linux.Alaeda Bad Bunny - Perl.Badbunny Binom - Linux/Binom

Bliss - requires root privileges

Brundle Bukowski Caveat Coin Diesel - Virus.Linux.Diesel.962 Hasher Kagob a - Virus.Linux.Kagob.a Kagob b - Virus.Linux.Kagob.b Lacrimae (aka Crimea) MetaPHOR (also known as Simile) Nuxbee - Virus.Linux.Nuxbee.1403

OSF.8759

PiLoT Podloso - Linux.Podloso (The iPod virus) RELx Rike - Virus.Linux.Rike.1627 RST - Virus.Linux.RST.a (known for infecting Korean release of Mozilla Suite 1.7.6 and Thunderbird 1.0.2 in September 2005) Satyr - Virus.Linux.Satyr.a

Staog - made obsolete by updates

Vit - Virus.Linux.Vit.4096 Winter - Virus.Linux.Winter.341 Winux (also known as Lindose and PEElf) Wit virus ZipWorm - Virus.Linux.ZipWorm

Worms

Adm - Net-Worm.Linux.Adm Adore Cheese - Net-Worm.Linux.Cheese

Devnull

Kork

Linux/Lion

Mighty - Net-Worm.Linux.Mighty Millen - Linux.Millen.Worm

Ramen worm - targeted versions 6.2 and 7.0 of the Red Hat Linux distributions only

Slapper SSH Bruteforce

See also

List of computer viruses

List of computer viruses (Numeric)

List of computer viruses (A-D)

List of computer viruses (E-K)

List of computer viruses (L-R)

List of computer viruses (S-Z)

References

External links

Linux virus samples at VX Heavens

Linux viruses on VirusLibrary

Category:Linux viruses Linux computer viruses and worms Category:Linux