Debunking the "Linux is virus free" Myth [View All]

[RoyGBiv]

I want to highlight this for a couple reasons.

First, the idea that any operating system is immune from malware infection is absolute rubbish (I'm looking at you, Mac OSX). Further, the idea that you can load up your system with a phalanx of security tools and overcome the deficiencies in the operating system is also rubbish. Indeed, the false sense of security one gets from all those notifying windows letting us know the Latest and Greatest anti-virus package is working can lead one to engage in ever more dangerous behaviors. This makes the malware author's job just that much easier and the risk of infection and losing your credit card and social security numbers to some script kiddie living in Siberia that much more the likely.

Second, if you're inclined to follow the link in this brief blog post to another that inspired it on how to write a virus for Linux, you can get a little insight into how all this works. Securing your system to the best of your ability involves checking your personal behavior. It's about developing good habits. Linux *is* a more secure operating system than Windows, as far as it goes. But the user-friendly desktop environment and the tools one uses to connect to a network or run a server or applications on that server are not. Each convenience or layer of complexity introduces exponentially more avenues for infection and more tools for the malware author to use to infect you.

A case in point described by these blog posts is the venerable e-mail attachment. Never, ever, ever, ever, ever just click on an e-mail attachment to run it. I don't care of Jesus Himself gets online, confirms his identity, and declares to the world that this is the e-mail to Bring World Peace and End Hunger ... if you just click this link. Don't. Do. It. This kind of thing supposedly cannot work under Linux. Well, that's just wrong.

Not so fast. Modern desktop environments, such as Gnome and KDE, conveniently offer a nice "workaround" called 'launchers'. Those are small files that describe how something should be started. Just a few lines that specify the name, the icon that should be displayed and the actual command to execute. Conveniently, the syntax of those launcher files is the same for Gnome and KDE. And those launchers don't have to have any execute permissions set on them! Desktop environments treat those files as a special case, so when you click on them Gnome or KDE will happily execute the command that was specified within the launcher description and without the need for the execute bit to be set on the launcher itself. Now we are getting somewhere!

http://www.cyberciti.biz/tips/debunking-the-linux-is-virus-free-myth.html

And do note that this is a Linux-centric blog posting this. That's the point. Wise computer users are not fanboys. They know or try to find out where the problems are and freely share the information with others.

Also note that if you read the comments, some are trying to parse this down into wordplay, which is just silly. "By definition, it's not really a virus he made ..." "That's more of a Trojan ..." "No, that's really a worm ..."

I don't care what you call it, and neither will you when your system has become the central zombie for a bot-net that's distributing kiddie porn to half of Asia without your knowledge.