- cross-posted to:
- privacy@lemmy.ml
You must log in or # to comment.
Malwarebytes is like that too. They also bombard with ads to pay for their premium services and shit.
A good anti-virus company would soon go out of businesses if they did not secretly create viruses and deploy them out to the world so they can come to the rescue. Not much different than planned obsolescence of washing machines and such.
That happens more with paid antivirus than with free.
Some paid antivirus are actual malware.
Does anyone have any insight on how Malwarebytes is on this front?
If only there was a community driven, open source anti virus, that is easy to use, and available for Windows…
Is this sarcastic or is there one?
ClamAV. Not the shiniest one around and I’ve never used it on windows, but it does exist and filters malware on tons of email servers around the world (among other things).
Free is usually better than paid. With paid you have a profit motive from the onset.
The one and only time this is wrong.
At least they can make money spending way too long making an anti-virus.
Free is unsustainable, so most likely they are robbing you, or trying to sell more of the antivirus.
Most consumer-oriented paid antivirus programs were and are pretty much their own malware.
McAfee basically is a virus. Pops up like hell’s popping corn and is hard to get rid of
They do that to simulate usefulness. Like “that was a close one, without me you’d be increased by now” and “hey look at me now hard I’m at work”
I think a big part of the solution of this entire problem is some form of sandboxing. That way, if one of your sandboxes gets a virus, it won’t have access to information that is outside of that sandbox, and you can delete the virus by deleting the sandbox. At least in Linux, when you install something as a flatpak, it’s automatically in a sandbox. Another example is that some game launchers can automatically launch games in their own sandbox.
Of course, then you have the issue that certain programs have access to tons of personal data and also get used all over the place, like web browsers. Even if you install those in sandboxes, I’m not sure how you can protect yourself, apart from really locking it down and then vigilantly cleaning the directories that they can see. But that’s a lot of extra work. A good solution would be more automatic.
Unfortunately Linux had quite a few kernel level local privilege escalation issues recently. The sandboxes use the same kernel as the host. However, still better to have a sandbox.
Also webbrowsers a use sandboxing for ages and split privileges between multiple processes but can still have critical security issues.
Even full blown VMs sometimes have issues that allow escape to the hypervisor.
I still really like sandboxing and I’m not a huge fan of antivirus solutions, just saying it’s not a magic bullet.
Something easy you can do for web browsers is just have at least two installed: one that you use for personal info and trustworthy sites, and the other that you use for unknown/sketchy sites.
At least in Linux, when you install something as a flatpak, it’s automatically in a sandbox. Another example is that some game launchers can automatically launch games in their own sandbox.
Even then, however, often you have to give those flatpaks access to more system resources to work, which reduces the effectiveness of the sandbox and give viruses other paths to escape from. It’s not a lot of flatpaks I’ve had to do this with, but for the ones I have, it’s been a pain and a little bit frustrating that I have to open access to certain system/user files for it to work.
Also, I’ve just had trouble with certain flatpaks and their packaging for a long time now, but I’ve had various issues that are frustrating with both flatpaks and appimages that I simply don’t have when installing from the apt repository. Sandboxing is useful in certain cases for sure, but maybe not for everything sadly.
So, the way I see it, there are three layers of managing security for sandboxes. There is the developer. There is the distribution system. And then, there is the user.
Flathub gives warnings at the top of each app’s page. Ideally, they’d block publishing of apps that need a dangerous amount of permission, rather than just warning the user, but I understand why they don’t. I think they need like a flatpak secure mode that removes dangerous settings when installing a flatpak, and then they add to the top of their pages which apps don’t work with their safe installs.
I think then, that the future of flatpak security could evolve to alleviate the problems you mentioned. For one, as flatpak adoption increases, developers will end up at least looking at their flathub pages and have a desire to reduce those warnings.
Because right now, too much burden is placed on the user. I’m hoping that the technology will evolve to put all of the burden on the developer and the distribution system.
It actually bothers me that I have to spend Enterprise levels of money to get access to any type of Linux endpoint security a la Bitdefender Gravityzone.
I get it, “they don’t make viruses for linux” or some nonsense. When a massive number of corporate servers run Linux, I think it’s fair to say that’s a target surface for people to develop attacks that can include viruses. I’m just over this idea that we’re safe by default or something. You’re not really safe unless you make your own personal computer use a giant pain in the ass of security steps just to access basics, anyway.
Anywhodles, anyone got the deets on some actual quality Linux virus/worm/malware protection beyond stuff like security hardening, key authorization, firewalls, dns blackholing for ads, and everything else I already have and set up beyond “virus protection.” My servers may not be important, but they’re still servers I’d rather not go through the pain of rebuilding.
Anywhodles
You made me smile
Remember, kids: don’t do security by obscurity
Yeah for sure. AI has made that even more redundant now by removing the effort barriers also.
I know a corporation that runs on that premise, and it worked great up until they added modern frontends as “translator” to modernize the system.
Yea, I’ve got the same issue, i couldnt really find anything either so ive just been using portmaster and hopping that’ll catch the virus if i ever get one.
I don’t think people are saying there’s literally no viruses for Linux, just that because Linux desktop use is so low, malware developers l developers focus on Windows because that’s what most end users will be trying to run their software on.
It’s not a secret that lots of Enterprise systems run Linux. Almost all switching and routing operating systems that run the entire internet are Linux based. But there isn’t a person using those. They get configured and then run without user interaction. So their attack surface is different.
That’s what people mean when they say there’s no real malware for Linux.
Most “virus” infections this day are just programs that look legit and trick people into installing them. You’re not going to get a Linux server that way.
Also people using Linux are some kind of brain and understanding of computers. Not necessarily the case on windows.
No, the ones who say this kind of stuff are literally believing that there is no malware on Linux, and there is precedence for it.
Something something history is doomed to repeat itself.
I think the day there’s a widespread apt or pacman hidden malware ala npm will be a watershed moment for the Linux community. A lot of people don’t even have clamav installed
the day there’s a widespread apt or pacman hidden malware
You mean like all the recent exploits on the AUR? It’s already happening. Digital hygiene is a responsibility that many don’t take seriously.
I’m worried even some random package like
fastfetchgetting compromised. I never installed that, it came with CachyOS, and it’s an “official package”. Does anyone actually check all 70+ packages that update per week? I dunno, it gives me the same uneasy feeling when I first was introduced to NPMWell, there’s a difference between that and NPM, which is that there are some manual steps involved. There’s no standard way to “push an update to every distribution in existence”, you just put out a sign somewhere saying “hey, new release” then everyone has to look at it and package it in whichever way they feel appropriate, oftentimes to a “testing” space first before the “regular” one. Some random Gentoo user who rebuilt just same day would notice way before Alpine stable people, for example.
Even Jia Tan wasn’t too successful, their backdoor only functioned when in a small set of distributions (Debian…) and yet got noticed almost right away.
The only major malware that isn’t for the big 4 right now are:
- ones that are preinstalled in IoT and “smart” devices
- targeting said devices with remote holes (ironically sometimes made available by the preinstalled malware)
First of all, username checks out.
Second, the thing about viruses (as opposed to other types of exploits) is that the user has to run them, and Linux doesn’t make downloaded files executable by default the way Windows does. Nor are Linux users conditioned to download programs from random sketchy sources the way Windows users do.
I think the biggest risk now is supply chain poisoning, where a system update or package installation runs executable code alongside it that can be malicious, as most supply chains for Linux distros don’t have automatic security checks in place but rather rely on the security of the identity of the package maintainer. If their setup gets compromised that’s the bigger risk rather than the traditional “virus” like you said
Nor are Linux users conditioned to download programs from random sketchy sources the way Windows users do.
I think about this every time install instructions for something are “run this terminal command to add our repo to your sources”. Would probably be pretty easy to get an auto-updating attack path for the unsuspecting. The first drop doesn’t even need to be malicious, just ship the virus as an update.
Yeah, if you’re doing some sort of
curl | shnonsense you’d better trust whoever is supplying that script implicitly. On the bright side, I’ve only ever seen that on the first-party website of the project being installed, so it could be worse.I think about this every time install instructions for something are “run this terminal command to add our repo to your sources”.
Or when there’s an installation option that’s just piping curl/wget into bash, like
curl -sSL https://install.pi-hole.net/ | bashIt’s super convenient! But risky. Even if the fetched script is legit, the command is still one typo’d URL away from fetching and executing something entirely different (imagine squatters sitting on install.pi-hole.com instead of .net and serving a malicious script)
I appreciated that pi-hole was (and still is) transparent about the drawbacks of this installation method when I installed it years ago.
All anti virus software actually, not just free ones. The paid ones are probably even worse.
except ClamAV
