Was AntiVirus; Now something Completely Different!

[SteveRiley]

Found it

Thanks, Feathers.

It shouldn't be a normal thing to run antivirus software on a system... if you know there are security bugs in your code you should fix the bugs instead of writing another program to look for people trying to exploit them. You're only stuck with crappy security bugs that you know exist but can't do anything to fix if you're using someone else's proprietary code.

It may not be possible always to fix the problem. For example, The OWASP Top 10 list of common web application vulnerabilities is as relevant today as it ever has been. If you purchase a web application, you may not be able to modify the code for contractual reasons. Or if you develop applications for your business, you may not be aware of how to properly code to limit these risks. For this reason, I always urge organizations to place web application firewalls in front of public-facing servers. You've done this yourself, using mod_security.

My employer, Riverbed Technologies, sells a web application firewall (it's a pretty decent one, too). Chapter 11 of the Stingray Application Firewall User Guide has a good overview of the common vulnerabilities, threats, and ways to mitigate them. [Note: we've embarked on a product-wide renaming exercise; Stingray is now called SteelApp. I mention this because you'll see references to both names for a while.]

[Feathers McGraw]

No, you don't need a host firewall either. Some time ago I wrote a post here explaining why. I'll look for it later when I'm on my PC.

Found it:

https://www.kubuntuforums.net/showth...server-correct

[Feathers McGraw]

Nice link Steve! I think this part of it sums up what everyone has been saying nicely:

Staog
Shown in:1996
Risk Level: low
Wild Level: low ( It has not been detected in the wild since its initial outbreak)
Platforms: Linux
Threat Description: Staog was the first virus written specifically for systems running on Linux. The virus operated by exploiting vulnerabilities in the kernel that allowed the virus to stay resident in the memory. While residing in the memory it infected executable binary files. The virus functionality depended upon bugs that was immediately fixed by software upgrade.

It shouldn't be a normal thing to run antivirus software on a system... if you know there are security bugs in your code you should fix the bugs instead of writing another program to look for people trying to exploit them. You're only stuck with crappy security bugs that you know exist but can't do anything to fix if you're using someone else's proprietary code.

Here's an analogy, just for fun...

You live on a street of houses, and nobody locks their doors when they go away. One day your neighbour's house is burgled, and the evidence showed that that person got in through the unlocked door. Someone got a good look at the intruder, so you have a description. Do you a) lock your doors or b) hire someone to sit in your house with a baseball bat and attack people if they look like the burglar?

If you go for b) your grunt might get it wrong and attack your guests, the intruder could always put on a disguise next time and still come in through the unlocked door, and there's always the possibility that the grunt could be compromised through a vulnerability of his own (blackmail?) and used to break into your house . Oh, and the grunt is a big fellow so he eats lots of your food, and he gets in the way when you're in the house, slowing you down and using up your precious resources!

[vinnywright]

Just completed the upgrades.

Four yesterday, but ten today.

I believe that they take immediate effect.

yes they do ,,,,,,except for kernel upgrades and one or 2 others and you will get a notification of needing a reboot for these .

It looks like the best method for handling updates is to wait for notification and then upgrade, rather than constantly checking.

It reminds me a little of Windows Update that I used to use with Vista.

Best wishes.

A

ya if thats what you like ,,,,,,,I turn off update notification and just run

sudo apt-get update && sudo apt-get dist-upgrade

once a week or so .or when I feel like it

VINNY

[SteveRiley]

No, you don't need a host firewall either. Some time ago I wrote a post here explaining why. I'll look for it later when I'm on my PC.

[anonprivate]

Uuhhh... I'd argue that's too strong of a statement. Some malware has targeted Linux, but it's rarely seen in the wild. Much of it targets ELF executable files.

Nevertheless, because the risk is so low, and the ability to spread is so difficult, I maintain that it's unnecessary to run anti-malware software on a Linux desktop computer.

From all that I have read, I am left with the impression that anti-virus and anti-malware programmes are un-necessary.

However, I am still left wondering regarding the use of a firewall. There is a recommended GUI firewall available. Is installation desirable, or like the AV programmes unnecessary.

Regards.

[SteveRiley]

There are no viruses out in the wild that can affect a Linux computer.

Uuhhh... I'd argue that's too strong of a statement. Some malware has targeted Linux, but it's rarely seen in the wild. Much of it targets ELF executable files.

Nevertheless, because the risk is so low, and the ability to spread is so difficult, I maintain that it's unnecessary to run anti-malware software on a Linux desktop computer.

[anonprivate]

Full Upgrade, yes that'll be the better English

Just completed the upgrades.

Four yesterday, but ten today.

I believe that they take immediate effect.

It looks like the best method for handling updates is to wait for notification and then upgrade, rather than constantly checking.

It reminds me a little of Windows Update that I used to use with Vista.

Best wishes.

A

[Teunis]

Full Upgrade, yes that'll be the better English

[anonprivate]

In Muon's left pane you can select on Status and this will show you the four packages for updating.
The checkmark can only be used AFTER you have selected the fourth button Complete Update.

An update is sometimes deferred untill all required elements are available.

(I'm looking at a Dutch version so my translations might be off)

I see the fourth button, mine is labelled 'Full Upgrade'

I will try it later.

Best wishes.

A

[Teunis]

In Muon's left pane you can select on Status and this will show you the four packages for updating.
The checkmark can only be used AFTER you have selected the fourth button Complete Update.

An update is sometimes deferred untill all required elements are available.

(I'm looking at a Dutch version so my translations might be off)

[anonprivate]

Yes indeed, in Linuxland it's unheard of to get infected by a mail (attachment) or by visiting a website.
But you should never say never
The weakest point is having full Java enabled...
In case you are interested in a full buttoning down your install have a read about things like Tripwire for Linux and SeLinux, but this is especially for people running their own server(s).


I watch out for the notification of available updates and then start up Muon, Muon has a button (Third along) to do a full update, click it.
This will show you a list of the files to be updated.
It is fairly easy to run through this list to see if there are any files or packages marked for removal, like you can click on the Status and Request(?) buttons to sort the list accordingly.
If a file or package is going to be removed without a suitable replacement I would wait for a day and see if the next updates are going to be complete, this usually fixes the earlier issue.
After checking and agreeing with the list you click on the green check mark (Second button) to commence the update.

In case you are impatient you can at any time click the third button to force a check for updates.

Thanks for replying.

I checked for updates ard there are four. Requested says 'No Change' in all cases.
However the checkmark (second from left) button is grey and unclickable.

[Teunis]

Yes indeed, in Linuxland it's unheard of to get infected by a mail (attachment) or by visiting a website.
But you should never say never
The weakest point is having full Java enabled...
In case you are interested in a full buttoning down your install have a read about things like Tripwire for Linux and SeLinux, but this is especially for people running their own server(s).


I watch out for the notification of available updates and then start up Muon, Muon has a button (Third along) to do a full update, click it.
This will show you a list of the files to be updated.
It is fairly easy to run through this list to see if there are any files or packages marked for removal, like you can click on the Status and Request(?) buttons to sort the list accordingly.
If a file or package is going to be removed without a suitable replacement I would wait for a day and see if the next updates are going to be complete, this usually fixes the earlier issue.
After checking and agreeing with the list you click on the green check mark (Second button) to commence the update.

In case you are impatient you can at any time click the third button to force a check for updates.

[anonprivate]

There are no viruses out in the wild that can affect a Linux computer.

That doesn't mean Linux can't be compromised but this typically involves someone getting local access to the computer or the owner installing software from a compromised source.
The last one can be mitigated by only installing from known and trusted sources like the ones from Canonical, the Ubuntu parent company and a couple of KDE specific sources (PPA's).
There are also concepts where a malicious piece of Java can infiltrate the browser and thus the computer but again, it's hardly ever seen 'in the wild'.

Because Linux powers some of the most import servers on the net the bad boys can go to great length to bring such a computer under their control and the sometimes succeed.
This usually involves the hacker getting through your log in and password, like by social engineering.
But Steve Riley is the real expert on this kind of issues so I'd just take his word: No.

Because there are no Linux viruses it is rather hard or impossible to write anti-virus software as this typically depends on fingerprints to recognise, no fingers, no prints

Thank you.

So if someone sent me an attachment to a file that was infected (originating system unknown) I would remain un-infected. But if I passed the attachment on the receiver (if using Windows) would be infected. Am I correct.

[anonprivate]

In that 'Sources' field of Muon you can select how you want to update, automatic or manual.
In case of automatic you can select how often the system checks for updates, daily, per two days, per week or per two weeks.

In case you select the first option the updates will be downloaded and installed automatically.
With the second option the updates will be downloaded and you get a prompt they are available for installation.
You can also select (third option) to only notify about available updates, if so you see an 'Update are available' icon in the system tray.

Below a screenshot of my (Dutch) settings that'll only tell me updates are available, I have to click on the notification icon to actually download and install.
[ATTACH=CONFIG]5188[/ATTACH]

The reason I selected notification is I travel a lot and not every place has sufficient bandwidth to allows for a good download.
Plus I want to check what the proposed update includes, for example it sometimes involves removal of certain 'dependencies' that I rather keep.
Just waiting a day for a new update typically fixes such a dependency problem.

Thank you.

I am configured as you are

If an upgrade involved removing dependencies I would not know what to do for the best. I suppose I would upgrade and hope for the best - what else could I do.

Best wishes.

A

Ps I noted some upgrades through my searching for the right programme (above). I will be very interested to see if they appear in the notification icon. Yes it does (one), it mentions a security upgrade. I thought that I saw a number of upgrades.