Slashdot Mirror
Tasmanian Dept. of Education Wants Anti-Virus for Linux, OS X
An anonymous reader writes "One of Australia's largest government technology buyers, the Tasmanian Department of Education, has gone to market for a security vendor to supply anti-virus software for its 40,000-odd desktop PCs and laptops, as well as servers. But the department's not just running Windows — it runs Mac OS X and Linux as well, and has requested that whatever solution it buys must be able to run on those platforms as well. But have we reached the stage were Mac OS X and Linux even need third-party security software? It seems like most Mac and Linux users don't run it."
no.
A computer can still pass on a virus even if it cannot directly infect you. It might not be your responsibility but will a child know this? If he forwards an attachment unwittingly or something?
Linux users and Mac users could accidentally infect a Windows user.
Anti-virus is a security last resort. If you've already downloaded or executed malware, then anti-virus might prevent it from running, or might be able to remove it if it already has. But it can't detect everything. It can only detect common malware. Linux doesn't have any common malware, and I'm not sure about Mac. There is clamav, but that's mostly detecting Windows viruses across platforms.
If you exchange documents and files with other users, having anti-virus and anti-malware software or not is not only an issue for your own protection.
Even if you run on a system that you believe to be safe from those kinds of infections, you might spread it to other users if you ever pass on files that you get from others.
This might not be of any importance to you personally, but in a large organization it might be of vital importance that malicious software can't "hide" in unprotected systems of other flavours that it was designed for.
/.Mattsson - My native language is not English, so please don't whine over linguistic errors. (That's lame anyway...)
I run Windows and I still don't use that stuff... I'm totally open source - err, open-minded - and I don't mind sharing my computer with a botnet and my credit card with poor Russkis, Nigerians, and Chinamen. All for one and one for all, I say!
I use clamav. I'm currently running a dual boot setup with Win7, but its only used for gaming (once a month or so) and for a few programs that I've only gotten to run without a hiccup in windows. Since I dont use it all that often, I also dont update it all that often, so having an AV run from outside the OS seems like its not a bad idea.
#!/bin/sh
echo "stating scan..."
n=`find / -type f | wc -l`
echo "scan completed of $n files"
exit 0
Atari rules... ermm... ruled.
1 group will claim GNU/Linux doesn't need anti virus software.
2nd group will claim they use antivirus on their GNU/Linux already, but only to clean emails destined for MS Windows machines or to look after their Samba exported storage.
3rd group will say GNU/Linux needs AV software because it's only a matter of time before viruses (virii?) appear.
4th group will say viruses for GNU/Linux already exist and provide links to some sensationalist articles on the interwebs where researchers published some concepts.
5th group (partially composed of group 1 and 2) will claim they're not real viruses, but worms/snakes/butterflies/etc...
6th group will claim the threat aren't viruses but PPAs in ubuntu.
3rd/4th group will return saying it's all about users and not the OS. And because they're careful users, they've never in their life needed AV on their MS Windows.
Does that about cover that? Let the holy war begin...
This is probably just a policy issue. "We've put your AIX / HP-UX / Solaris server in". "What AV does it run?" "Er, it's running AIX / HP-UX / Solaris , we've not installed AV". "But our policy says we have to use product X or product Y to AV protect all our servers". "Yes, but you're not understan....." "Just install AV".
Just don't do stupid things.
The average user doesn't know what's stupid and what is not.
To some extent, AV software is good for inexperienced users. Unfortunately most of these AV pograms have "evolved" to a point where they've become more of a burden than help. That's a real problem if you have to churn out a new-and-improved version every year.
http://technet.microsoft.com/en-us/library/cc512587.aspx
>>You can't clean a compromised system by patching it.
>>You can't clean a compromised system by removing the back doors.
>>You can't clean a compromised system by using some "vulnerability remover."
>>You can't clean a compromised system by using a virus scanner.
>>You can't clean a compromised system by reinstalling the operating system over the existing installation.
>>You can't trust any data copied from a compromised system.
>>You can't trust the event logs on a compromised system.
>>You may not be able to trust your latest backup.
>>>>>The only way to clean a compromised system is to flatten and rebuild.
Jesper M. Johansson, Ph.D. [YES, HE'S A DOCTOR], CISSP, MCSE, MCP+I
Security Program Manager
Microsoft Corporation
These are government schools. They don't have the money to waste putting computers on every desk when the students are not going to be using them in every lesson. They have rooms with computers in them and timetables to organise who can use them and when - there is no need to have one computer per student. That makes many large companies in Australia larger users of desktop computers than the education department of a low population state such as Tasmania. There would be more students in just about any city in the USA.
Wait, so we bash the govement for using windows, for using faulty antivirus software, for not using any antivirus software, for not using open source, for spending too much......
Now we bash them for asking for something SENSIBLE? Just because most linux/os x users dont run it doesn't mean its s a good idea -> Most windows users don't run antivirus software and use I.E. 6......
Now... if they want one. ClamAV does both linux and windows, not sure about OS X though.
- http://www.milkme.co.uk
It's an extra layer to protect a user either from running vulnerable software, or from doing something stupid...
I've seen many windows systems become infected when the users haven't done stupid things, they were browsing perfectly legitimate sites that just happened to have been hacked and got infected without having to do anything else.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
You must work in IT support.
My personal experience is:
#1. For a technically sane, and security aware user, most antivirus software only exists to make the system hog slow.
#2. Antivirus software is used as a placebo to make users feel they are safer. If anything, I suspect it would make users feel less responsible for their own actions because some AV software is supposedly protecting them.
#3. How is a Linux user supposed to run AV? With WINE? I know there is clamav, but it's not intended for those "active monitoring/scanning" things you have on Windows. Maybe the "shell script" placebo* will work equally well at "educating users" if that's what you want. No point in making a system slow.
* http://apple.slashdot.org/comments.pl?sid=2119134&cid=35997968
You must work in sales, because you have no experience in the real world.
#1. Actual, technical users understand that AV is important, they just recognise the signs of infection as well as any AV does and will take steps when they detect them. For us, AV clients are just a way to be lazy.
#2. Just because AV will not protect against some 0-days does not make it useless. It's a method of protecting against old threats which are still quite prevalent thanks to people who dont use or ignore AV. Not to mention that many viruses are simply minor variations of old ones, the W32.Foo.F virus looks quite similar to W32.Foo.E.
#3. Umm... You do know that there are a variety of Linux clients out there. Clam AV, Trend Micro, AVG, Kaspersky and others have clients. Any AV vendor in the Enterprise space has a client as Enterprises use Linux servers quite a bit. Do a google search for "Linux Anti Virus" before launching on an ill informed rant.
Calling someone a "hater" only means you can not rationally rebut their argument.
I was embarrassed recently when the IT department claim a Linux computer in my office was taken over by the Rustock BOT. After checking the ssh log, I realized it was a coworker who uses it for code repository and SOCK5 Proxy as he works abroad from China. He has a compromised Windows machine. To the best of my knowledge, AV doesn't really catch these stuff which are more and more common now a day. Anyone has recommendations?
The only possible interpretation of any research whatever in the 'social sciences' is: some do, some don't
My impression was that BitDefender was the only free live-CD commercial scanner, the other commercial A/V live-CD's are available only for paying customers.
If I were to upgrade from using only free A/V on my Windows boxes, I would consider paying BitDefender, if only because they are providing such a useful free service to everyone (disclosure: I've paid for Kaspersky in the past).
They want the same solution to run on all platforms. That's as reasonable as wanting the same tyre to fit a bike and a bus.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Android smartphones run on linux.
Android smartphones are used by office workers and integrated with the company IT system.
Android smartphones are vulnerable to malicious apps
Therefore, antivirus or 'anti-malware' for linux is badly needed
The best way to deflect the idea that it is only Windows that has the basic vulnerability is to ensure that Linux and OSX users are forced to run AV too.
That way they can claim that the total cost of ownership on these platforms is ( artificially) higher.
It is also likely a case of the person working that factor then adding support to the lie by persuading his/her colleagues with the classic FUD:
"What if you omit this, and a virus that attacks these other OS infect us? Do you want the blame?"
What is actually needed is some education to users about best practices, detection of infections and how to establish a safety and testing regimen.
Maurice W. Hilarius Voice: (778) 347-9907
Fixed that for you. If it's a 0-day exploit, typically nobody knows about the virus that uses it execpt the jokers that wrote it. Seriously. That's why it's called a 0-day in the first place. That means it won't find the thing for you- ever.
Considering that patching for the holes is a better answer than relying on a signature scan for things...simply put, no. It's less useful than you're making it out to be. It's like closing the barn door after all your horses have went on a walkabout on you. The virus writers have gotten clever, by the way- they don't make easy to flag out a Foo.F from the Foo.E anymore. If you've gotten zapped by an "old" virus like that would get caught out this way, it means you either haven't updated the system or your OS vendor didn't fix the hole like they claimed they did.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
We recently went through a PCI audit. The auditor wanted to make sure that we had antivirus software for our IBM System i. At first we thought he was crazy, but we discovered that such software DOES exist. However, it does not work quite the same way as on a Windows machine. The idea is that infected files, transferred from Windows PCs, can still reside on the System i, even though they cannot do any harm to that system. So they still need to be scanned. The same holds true for Linux and OS X machines. Those systems may not be subject to infection from viruses, but they can still store infected files, and these need to be scanned.
Proverbs 21:19
#1. Actual, technical users understand that AV is important, they just recognise the signs of infection as well as any AV does and will take steps when they detect them. For us, AV clients are just a way to be lazy.
You know, in relation to that point, back in 1999 the most effective Virus detection software I had was "Need For Speed 3: Hot Pursuit". Back in the days of the rapidly spreading Win.CIH virus as soon as that got into my system it would end up in that executable (because I used it so often I guess) and that would cause the game to hang. When that occurred it was time to break out the trusty command line removal tool.
Leg Godt!
Antivirus scanners provide a false sense of security with no real benefit. We've got pretty nice workstations at my work, but are saddled with McAfee by corporate IT mandate. Which regularly turns them into unresponsive pigs.
Better to properly lock down user accounts and teach users proper data hygiene. So we can use those resources to accomplish work instead of not-work.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Read up on immunology and specifically the term "herd immunity".
It's not just whether or not you are resistant to a virus, it is also if you help or hinder the spread. It takes surprisingly few non-vaccinated people in a population for an epidemic to get started. Because the spread of viruses, both biologically and in IT, is a numbers game. If the virus finds > 1.0 victims in its lifetime, it will spread and the number of infected hosts will steadily increase. Only if you manage to push down the infection rate to not even on hosts that are immune.
Assorted stuff I do sometimes: Lemuria.org
Read up on immunology and specifically the term "herd immunity".
It's not just whether or not you are resistant to a virus, it is also if you help or hinder the spread. It takes surprisingly few non-vaccinated people in a population for an epidemic to get started. Because the spread of viruses, both biologically and in IT, is a numbers game. If the virus finds > 1.0 victims in its lifetime, it will spread and the number of infected hosts will steadily increase. Only if you manage to push down the infection rate to < 1.0 can you eliminate it.
Anti-virus on a Mac or Linux system does not only protect the system itself, its purpose also is to protect other, for example windows, systems. You Linux may be immune to the Word macro virus, but if it can detect and kill it, that windows system you send it to doesn't get infected.
If you know anything about how stuff spreads in a population, you positively don't want the stuff in your environment, not even on hosts that are immune.
(edit: posting a 2nd time because /. stupid "plain old text" eats everything after the "lesser than" sign if you don't escape it...)
Assorted stuff I do sometimes: Lemuria.org
The DoD's reasoning is pretty straightforward. There are few to no "in the wild" viruses or trojans for Linux/Mac (several worms though), but data rarely stays in one platform in an interconnected world. We put virus protection on every platform so that whenever a document or program is introduced on the network it gets scanned. That way if it has malware in it, even Windows malware on a Linux/Mac system, it's caught early. Just because I first put the document on a Linux system doesn't mean it's going to stay on a Linux system.
Exactly. 99% of what my Linux boxes scan for are Windows malware (viruses, worms, trojans, etc). I prefer to scan for such things on a box that is not succeptible to most things. Since websites, USB keys, and portable media, bittorrent, etc., mean virus can come into almost any system on the network, all machines shoudl be scanning for all viruses, whatever the platform.
Home users can do what they want, but in any larger networked environment where you don't have absolute control, this is absolutely neccessary.
You are in a maze of twisted little posts, all alike.
As far as protection from linux virus's you would be wasting your time. Not so much entirely because of a better security model, but because of a lack of virus's in the wild, and a lack of spreading capabilities within them. Odds are if you have a virus on a linux system, it was most likely crafted for your system and specifically targeted, and targeted/custom written virus's won't be stopped by traditional AVs.
teach users proper data hygiene Totally impossible. They don't care and you can't make them care.
Totally easy: 1: Here's not how to be an idiot. 2: If you're an idiot, you're fired without severance or health benefits.
Can you tell me how I can fire my boss? There's basically nobody above him in the organization, so I'm just wondering how you'd apply your totally easy method in this case?
There are also the cases where an employee is main rain-maker for the company, but hasn't a clue how to keep from getting malware on their computer. A law firm is not going to fire an attorney who brings in $30 million a year just because they keep getting malware on their pc, for example.
Putting moderation advice in your