Slashdot Mirror

Here's an interesting rebuttal. The 1st line is "The single biggest security issue facing Linux users at the moment is the misconception perpetuated by highly vocal advocates that Linux is somehow impenetrable to security-based attacks, and in particular, viruses and other malware."

For those interested, there's a rebuttal linked from Newsforge which pretty much summarizes a lot of the points made here.

Direct link to the article here.

I do wish I could get a good, clear, Linux-favoring argument on the security level (or any other level for that matter). I really am concerned about personal zealotry and the less I come off as a Penguinoid, the more believable/convincing I would be.

http://www.virusbtn.com/magazine/archives/200209/l inux_malware.xml
That should answer most of your questions

From what I've read, McAfee, NAI, Symantec et al are more interested in the 'reviews' and 'ratings' done in the mainstream press, rather than in effectiveness against actual viruses ( and, IIRC, all three helped the Chinese Gov't set-up a virus lab, in exchange for access-to-their-market ), and

I believe it was The Really Big Popular Computer Information Mag Conglomerate that rated AV products by manufactured 'fake' viruses:
Any product that caught the fake virus as a Virus, got rated good, and any AV product that didn't, failed.

However...
... actual in-the-wild viruses are used to rate AV products here at VirusBulletin, and the ratings don't necessarily correspond with the popular press's opinions...

If the popular rating-system is NOT based on actual in-the-wild viruses, and sales are based on perceived desirability, then... ... there's Bogosity In The Basis, seemingly

I wrote what I consider to be a fairly informative article on Palladium and the impact on the anti-virus industry here:

http://www.virusbtn.com/magazine/archives/200209/p alladium.xml

Summary:

- It's foolish to expect it'll stop viruses
- Microsoft will have the anti-virus industry by the short and curlies
- Microsoft PR is impressively ... uh ... PR-ish ;-)

More commentary including thoughts on some of the implications here:

http://www.virusbtn.com/news/latest_news/gobbles.x ml

# NO VIRUSES
Linux is not prone to viruses. Because of the data protection functionality in Linux, a virus can not overwrite system files or append itself to applications unless you are working as the "root" user (which you shouldn't do in the first place).

I'll bite. There are Linux viruses (etap and slapper spring to mind), and the author of that seems to be missing a fairly major point.

I can rebuild a Linux server in half an hour or so, if system files get corrupted. The difficulty is retrieving data that's been trashed.

For more about weenies who think Linux is virus free:

http://www.virusbtn.com/magazine/archives/200209/l inux_malware.xml

Despite killing any credibility you had by using the word 'virii', you might be interested in:

Linux/Slapper
Linux/Etap

or any of the host of others (those are the most interesting in my eyes). But seriously, what is it with people saying that Linux is somehow invincible when it comes to viruses? An unpatched Windows box is no less secure that almost any unpatched BSD or Linux distro from six months ago (see: OpenSSH vulnerabilities).

There's a great article about weenies who seem to think that their click-and-drool Mandrake install is somehow impenetrable here:

http://www.virusbtn.com/magazine/archives/200209/l inux_malware.xml

Despite killing any credibility you had by using the word 'virii', you might be interested in:

Linux/Slapper
Linux/Etap

or any of the host of others (those are the most interesting in my eyes). But seriously, what is it with people saying that Linux is somehow invincible when it comes to viruses? An unpatched Windows box is no less secure that almost any unpatched BSD or Linux distro from six months ago (see: OpenSSH vulnerabilities).

There's a great article about weenies who seem to think that their click-and-drool Mandrake install is somehow impenetrable here:

http://www.virusbtn.com/magazine/archives/200209/l inux_malware.xml

Despite killing any credibility you had by using the word 'virii', you might be interested in:

Linux/Slapper
Linux/Etap

or any of the host of others (those are the most interesting in my eyes). But seriously, what is it with people saying that Linux is somehow invincible when it comes to viruses? An unpatched Windows box is no less secure that almost any unpatched BSD or Linux distro from six months ago (see: OpenSSH vulnerabilities).

There's a great article about weenies who seem to think that their click-and-drool Mandrake install is somehow impenetrable here:

http://www.virusbtn.com/magazine/archives/200209/l inux_malware.xml

This article on VB looks at the history of SpamAssassin and SpamAssassin pro, and conflicts of interest this might create; a neat summary:

http://www.virusbtn.com/news/latest_news/spamassas sin.xml

You need to remember that reps aren't *real* people in most cases, and especially in a field like anti-virus, reps are often keen to over-sell products.

Of course, it's worth remembering (going a little off-thread here), that unpatched open-source software isn't any more secure than unpatched Windows software - IIS can be patched and secured too. A good tutorial on hardening IIS can be found here:
http://www.virusbtn.com/magazine/archives/200208/i mpossible.xml

If you want to know how exactly klez works, there's a very detailed analysis here:

http://www.virusbtn.com/resources/viruses/indepth/ klez.xml

Many people thought prior to Slapper coming out that Linux was somehow impenetrable to malware ... VB has a good article (written before Slapper came out, as it happens) on why this is largely untrue:

http://www.virusbtn.com/magazine/archives/200209/l inux_malware.xml

Nah, you have viruses... Even metamorphic ones at that. See: http://www.virusbtn.com/magazine/archives/200207/e tap.xml

Paying money is no guarantee that software will work as expected.

Open-source anti-virus would be very cool, but it's really labor intensive and the signature databases are the vendor's crown jewels.. as it were.

The Virus Bulletin's VB100 test rates AVG fairly low. Do other tests rate it higher?

You have an advantage in that there are less Linux viruses for your users to inflict on the system, and less 'BonzaiCometGators' as well. This situation could well change in the near future though, as viruses like simile are now cross-platform...

Perhaps not such a great idea to trust CNET's reviews of anything ... their reviews of anti virus software are notoriously bad, and a cheap facade for blatant plugging of their advertisers.

Virus Bulletin published this article about the Windows-only version of Simile a couple of months ago.

NAV and McAfee both suck, especially the latter--Norton may also be a processor hogging pile of bloated crap but at least it detects viruses.

People, you should check out NOD32. It has won an improbable number of Virus Bulletin 100% awards, it's affordable, and it runs just fine without slowing down a reasonably modern system.

G

AV companies have been aware of the possibility for a while. It was discussed at the 2001 Virus Bulliten Conference. Here are the abstracts from two papers: MSIL For The .NET Framework: The Next Battleground? amd The Effects of Microsoft .NET on Malicious Threats.

AV companies have been aware of the possibility for a while. It was discussed at the 2001 Virus Bulliten Conference. Here are the abstracts from two papers: MSIL For The .NET Framework: The Next Battleground? amd The Effects of Microsoft .NET on Malicious Threats.

AV companies have been aware of the possibility for a while. It was discussed at the 2001 Virus Bulliten Conference. Here are the abstracts from two papers: MSIL For The .NET Framework: The Next Battleground? amd The Effects of Microsoft .NET on Malicious Threats.

How would anyone be careless twice in a row

• Eicar
  
• Hybris.Gen
  
• TR.Happy99/SKA
  
• TR/IWorm.Fix2001
  
• TR.IWorm.MTX
  
• W95/Hybris.PI.000
  
• W95/Matrix.SCR
  

• AntiCMOS.A
  
• AntiEXE.A
  
• Die_Hard.4000.A
  
• Empire.Monkey.B
  
• Form.A
  
• J&M.A
  
• JS/Kak.A