'WannaCry Makes an Easy Case For Linux' (techrepublic.com)

An anonymous reader writes: The thing is, WannaCry isn't the first of its kind. In fact, ransomware has been exploiting Windows vulnerabilities for a while. The first known ransomware attack was called "AIDS Trojan" that infected Windows machines back in 1989. This particular ransomware attack switched the autoexec.bat file. This new file counted the amount of times a machine had been booted; when the machine reached a count of 90, all of the filenames on the C drive were encrypted. Windows, of course, isn't the only platform to have been hit by ransomware. In fact, back in 2015, the LinuxEncoder ransomware was discovered. That bit of malicious code, however, only affected servers running the Magento ecommerce solution. The important question here is this: Have their been any ransomware attacks on the Linux desktop? The answer is no. With that in mind, it's pretty easy to draw the conclusion that now would be a great time to start deploying Linux on the desktop. I can already hear the tired arguments. The primary issue: software. I will counter that argument by saying this: Most software has migrated to either Software as a Service (SaaS) or the cloud. The majority of work people do is via a web browser. Chrome, Firefox, Edge, Safari; with few exceptions, SaaS doesn't care. With that in mind, why would you want your employees and staff using a vulnerable system? [...] Imagine, if you will, you have deployed Linux as a desktop OS for your company and those machines work like champs from the day you set them up to the day the hardware finally fails. Doesn't that sound like a win your company could use? If your employees work primarily with SaaS (through web browsers), then there is zero reason keeping you from making the switch to a more reliable, secure platform.

Comments

This opinion isn't new and is still wrong.

[Aequitarum Custos]

Virus writers will target the largest market portion. If that's Windows, they'll write viruses for Windows. If it's Mac, they'll write viruses for Mac. If it's Linux, they will start writing viruses for Linux. Just because more vulnerabilities in Windows are known, does not mean there are less total in Linux. And short of taking away admin/sudo access from users completely, malware can always social engineer it's way into administrative privileges during an installer or something similar.

Re:This opinion isn't new and is still wrong.

[OrangeTide]

Linux has been around enough and is used widely in high-value enterprise servers that it most certainly is attacked by malware, hackers, etc on a regular basis. Much is known about the security of Linux, and multiple vendors work to improve the security of the Linux Operating System and key applications.

Microsoft, Adobe and others have not been doing that great of a job securing Windows and its key applications. And much of the industry that touts that they enhance security on Windows are also trying to sell you virus scanners that significantly impact system performance.

What you fail to understand are two factors at play here:
1. Linux(FreeBSD and Unix in general) have a very different security model than Windows. Unix is a much simpler model and is less flexible, but it is also applied more consistently as a result.
2. Windows is not the top OS in the world in terms of numbers. Virus writers, if they are going only for high-volume attacks, would also aim their sites at Android or iOS as either of those have more installed systems than Windows. And like I said early, Linux dominates the enterprise environment and would theoretically be more valuable of a target to attack than Windows.

Re: This opinion isn't new and is still wrong.

[Anonymous Coward]

I keep hearing this argument, but every time Microsoft releases another Windows, I am shocked by the security holes I find open. They just don't care enough. With Linux, more eyes on the source exposes more bugs and the security ones often get fixed before the ink dries on the mainstream media post about it.

Plus, older Linux installs are often maintained for security patches far longer than Windows.

Re: This opinion isn't new and is still wrong.

[Anne Thwacks]

It is not just an issue of "more eyes". If you ignore Canonical, Gnu/Linux is far more stable internally - I specifically say Gnu, because the issue here is userland culture: The Unix/Linux world has enormous motivation to keep reusing the same code over massively diverse hardware as well as application use cases.

The same code gets more thorough testing in the Unix, with more motivation to fix the problems - because people are able to locate and describe problems better.

I know there are still bugs in Linux - hell, I know there are bugs in OpenBSD - but if I report them, they get fixed - sure it can take a year if the impact is only on me. If I phone Microsoft, all I get is a phone bill and a sore ear.

In the BSD world, some of the code really is over 40 years old, and generations of students have tried to hack it - to improve their game scores or college grades. When they succeed, it is fixed.

In Windows, when a new version is released - it probably comes with more new, improved bugs than bug fixes.

Re:This opinion isn't new and is still wrong.

[UnknownSoldier]

> and therefore Linux is NOT going to become the largest market portion any time soon.

Oh really? Try taking off the myopic PC blinders for once.

Google achieved 2 Billion devices with Linux in 9 years what Microsoft WinCE couldn't do even in 20 years

MS may have 96% of the gamer's PC desktop but that ignores all the servers and virtual machines running non-Windows, let alone consoles.

MS is a total joke on the Top 500 super computers.

Since November 2015, no computer on the list runs Windows.

Hell, even 33% of Azure runs Linux

In the OS server space things get fuzzy -- are we talking Web Servers? Database Servers? Email servers? Windows be has high as 33% or 20%-- there are no accurate stats.

Let's recap where Linux dominates:

[x] Mobile: Linux
[x] Super computers: Linux
[x] Servers: Technically *nix, due to BSD and OSX.
[ ] PC Gaming Desktop

The only place Windows has a niche in is PC gaming and XBox -- but desktops aren't the only thing anymore.

In the global space MS is slowly becoming irrelevant next to Android, iOS, PS3/4, Servers, Super computers, and Wii/Switch.

Not bad for an OS that "(free) operating system (just a hobby, won't be big and professional like gnu)"

Re:This opinion isn't new and is still wrong.

[AmiMoJo]

Linux will fall to the same things that Windows does these days.

- Users conditioned to enter the admin password and click through warning to get that sweet emoji pack

- Vulnerable applications

- Zero day attacks and slow updates

Nothing about the average Linux distro would prevent ransomware attacks, for example. Exploit the browser, get access to the user's files, game over. Yeah, there are more secure distros, but you can lock down Windows too and no-one does.

Re:This opinion isn't new and is still wrong.

[war4peace]

That's a helluva "niche" right there.

Re:This opinion isn't new and is still wrong.

[ctilsie242]

The thing about ransomware, it doesn't need to fight with SELinux, nor escalate to root, to cause damage. It just needs enough access to read/write the user's files, which most web browsers provide. Even having an Internet connection isn't needed, since ransomware can bundle a public key with it that it can encrypt an individualized ephemeral private key, then use the public key from that ephemeral keypair to encrypt all files.

Ransomware is part of a perfect storm. So many companies don't bother with security. Individuals don't care or don't bother. With the lack of consumer-tier tape drives and optical drives of a decent capacity, backup drives and cloud-synced storage are easy pickings for deletion. Not many end users really care to use a program like Mozy, Carbonite, or CrashPlan.

Re:This opinion isn't new and is still wrong.

[Archtech]

Except you're missing the point.

Actually I think you are missing the point.

The exploit worked not because of some security lapse at Microsoft, but because the people maintaining the machines didn't lock them down or apply appropriate updates in a timely manner.

But why do you assume that dozens of "appropriate updates" must be applied every month "in a timely manner"? It's not as if the installed software is decaying in some mysterious way. The patches are needed to prevent exploits that should never have been possible in the first place.

Security cannot be added on as a bag on the side of a software system - although that is what Microsoft is forever trying to do. Proper security has to be built in right from the start, from the foundations up. But that does cost money and take a lot of extra time and effort.

Linux can't fix that....

Of course neither Linux nor BSD nor any other operating system can "fix" the problem 100 percent, completely and forever.

But that does not mean they can't be a huge improvement.

Re: This opinion isn't new and is still wrong.

[Daniel Phillips]

What are you talking about? You can't even fucking ping a windows box with it's default firewall configuration.

And it's still leaky as a sieve. That speaks to basic design flaws.

Re: This opinion isn't new and is still wrong.

[Daniel Phillips]

So far for 2017, Linux has 128 code execution vulnerabilities whereas Microsoft has 71.

Because each Linux vulnerability is reported for multiple distributions. And because Linux vulnerabilities are found faster and therefore fixed faster. However you want to spin it, Windows is the one getting successfully exploited in multiple ways, so that new Windows vulnerabilities are hardly news any more, whereas its big news any time a hole shows up in Linux, and then very few fall victim to it.... partly because of the early and widespread disclosure, but more because Linux vulnerabilities typically require local access, login shell, etc. Whereas a dodgy flash file is often enough to take out a Windows box.

Every... time...

[Bizzeh]

Every single time any sort of media coverage comes up about a non-event (didnt affect real users, only affected organisations which delayed the installation of a critical update), fanboys leap on the opertunity to say how much better linux is.

Linux has its fair share of these, and runs on its fair share of critical infrastructure, and is run by its own fair share of idiots, but it is never really media worthy, because it isnt Windows and it isnt something the general public will relate to.

Give it a rest...

2017

[Anonymous Coward]

I heard 2017 is the year for desktop Linux. Any day now.

Count of 90...

[djbckr]

This new file counted the amount of times a machine had been booted; when the machine reached a count of 90, all of the filenames on the C drive were encrypted.

That should only take a few minutes, right?

Re:Count of 90...

[matbury6017]

A few minutes? Don't you remember how long Windows takes to boot up?

Depends on the company, doesn't it?

[gfxguy]

My father runs an accounting business. His tax software is only available on Windows, and not as a service.

I work in a media company. Yes, some have Macs, but most of the software is only available for Windows, so most users must use Windows. Now the other departments could possibly use something like Linux, but then it's another system that needs to be supported (given that we still must support Windows, anyway).

I'm sorry Linux fans (of which I am one... the web servers I set up for work are Linux, and I'm typing this on Linux as my desktop right now), but there's a lot of proprietary software that many companies use that is only available on Windows. Most of it has no serious competition on Linux.

Re:Depends on the company, doesn't it?

[matbury6017]

Unfortunately, that's true. I still have dual boot (Win7/Linux) because there are some packages, especially for multimedia, that I still need for work. However, there's a huge number of PCs in the world in govt. departments, schools, colleges, and universities (the public sector) that never use anything as exotic as multimedia editing software or generic accounting software (GNU cash is more than adequate for most businesses). Technically and financially, it would make sense for those millions of PCs to be switched over to Linux. The difficulty is at the human end of things; workers who don't care about computers and operating systems and just want to get their work done. Switching OS, to any OS different to the one they use now, would not make them happy.

The best solution? Probably to start with PCs used in education rather than letting Google, Apple, and Microsoft attempt to indoctrinate school pupils into only using their OS'. If pupils grow up understanding that there are different OS' that superficially look different but do pretty much the same things, from most users' perspectives, then switching between OS' won't be such an issue later on in life at work and at home. How about ICT classes in schools that are platform neutral? How about making transitioning between OS' part of the curriculum? It'd also reinforce their learning, according to the learning sciences ;)