Re: [gentoo-user] Which desktop antivirus?

[Jonas de Buhr <jonas.de.buhr@gmx.net>]

Am Sat, 22 Oct 2011 13:43:53 +0200
schrieb Florian Philipp <lists@binarywings.net>:

> Am 22.10.2011 13:29, schrieb Nilesh Govindarajan:
> > On Sat 22 Oct 2011 04:57:33 PM IST, Mick wrote:
> >> Hi All,
> >>
> >> I'm asked for a desktop antivirus (the box is running KDE) but I
> >> have never used an antivirus on Linux.  This page that I googled
> >> up shows a number of them:
> >>
> >>   http://www.makeuseof.com/tag/free-linux-antivirus-programs/
> >>
> >> Meanwhile, portage only lists clamav under app-antivirus/.
> >>
> >> The machine in question is running kmail to receive/send messages
> >> from ISP mail servers and ssmtp to send log messages for relaying
> >> via said ISP.
> >>
> >> What have you tried and what would you recommend for such a
> >> desktop setup?
> > 
> > IMHO, you don't need antivirus on a Linux box, unless you're going
> > to run a mail relay, where you are responsible for saving recipents
> > from viruses.
> 
> I agree. Check that your ISP performs virus checks. If not or if you
> want to be extra sure, I think kmail can work with clamav -- at least
> it could in the old 3.x days when I still used it.
> 
> > The simplest reason of all is, Linux doesn't know how to execute 
> > Windows binaries.
> > 
> 
> Well, this is an oversimplification.
> 1) Any box running Wine is possibly as exposed to your classic
> pretty-women.exe mail attachments as any windows systems.
> 2) You should also be worried about Open/LibreOffice macro viruses as
> well as PDF vulnerabilities. Not to forget Flash, Java or Mozilla
> based exploits.

or image rendering library bugs. or mono. or tricky multi-platform
viruses/worms. saying that linux based viruses don't exist is simply
wrong. there may not be much in the wild, but they definitely are out
there.

it is probably more difficult to write a successful virus for linux
than for windows for a number or reasons but in principle the problem is
the same as on windows.
i think the main technical reason is the heterogeneity of the
installations. one or two local exploits and you can hit almost any
windows XP installation. in linux you have to deal with n combinations
of kernel-version, glibc-version, etc. and there is very little you can
depend on to be in a fixed location in memory since different compiler
options may already change that. there are ways around all this of
course[1], but its a lot of work. too much for the limited impact.
also, a lot of malware seems to depend on social engineering for
infection these days. i think thats going to work less good on a lot of
linux users because the system conditions you to think before you act.

that aside, i predict that we will see some linux viruses or worms with
larger infections in the future. i guess the first ones will be for
ubuntu because it has a large base of rather consistent base
installations.

/jonas

--

[1] fun idea: something exploiting bugs in the usb storage subsystem or
file system handling code spreading to usb sticks. you could probably
even make that multi-platform if you find the needed bugs for different
OSes.


> 
> Still, keeping your system up-to-date and observing the freshly
> revived GLSA notifications is more likely to save your butt than
> clamav.
> 
> Cheers,
> Florian Philipp
>