Linux and Viruses

Why Linux machines are less likely to face virus attacks

Saturday, July 07, 2001

Print

Comment

Email

Digg

Del.icio.us

Reddit

Twitter

Authored by Madhu M Kurup and Babu Kalakrishnan

The first week of May 2000 saw the nasty "I Love You" virus destroy data on PCs all over the world, causing damage worth billions of dollars. And it isn’t the first time such an event has occurred (remember Melissa just a few months back)? Significantly, not even one of the PCs running Linux was affected. Does this mean that Linux is immune to viruses? Or is it just that virus writers haven’t targeted Linux machines as yet?

Is Linux really immune?

A virus or virus-like program can be written for any operating system. There have been reports of at least one replicating virus—Bliss, May 1997—specifically targeted at Linux executables. Destructive code can also be written very easily using scripting languages like Perl available on most Linux distributions. Even a bash script can be quite powerful.

The relative immunity of Linux stems from the implementation of security at the operating system level. If a user executes a piece of destructive code, the files that the program can infect or destroy are restricted to those for which the user has permissions to write to. All the binaries of the standard programs are normally installed with write permissions only to the super-user (root) and hence can’t be modified (unless you’re running the program as root). Read the Linux Security HOWTO to understand why you shouldn’t be doing that anyway.

Open Source is secure

Another reason why Linux is relatively immune to virus attacks, is because most software used in Linux is available either as Open Source or free software. A major mode of propagation of viruses is through cracked or pirated commercial software, where you can’t verify the authenticity of the copy you obtained. As for Linux applications, most are freely downloadable from the Net, and cryptographic signatures of packages are generally available at the official Websites of the distributors. So, you can verify the authenticity of the package, even if you obtained the software from a different source.

In addition, the most vital aspect of Linux-based software is that the source code is always available for anyone to read, inspect, and verify. Backdoors, loopholes, and other exploits quickly get detected, given that you can compile your own version of a program. Sometimes, availability of the source is considered a weakness, as access to the source code supposedly permits flaws in the operating system to be found easily. However, you should realize that Linux is a huge community effort, and that at any point, hundreds of people are co-operating towards finding, solving, and securing loopholes in the operating system.

Page(s):    1    2