Health Tips, Yog, Spiritual & Computer Hardware Software Download Center

Linux vulnerability

Like Unix systems, Linux implements a multi-user environment where users are granted specific privileges and there is some form of access control implemented. To gain control over a Linux system or cause any serious consequence to the system itself, the malware would have to gain root access to the system. Shane Coursen, a senior technical consultant with Kaspersky Lab, claims, "The growth in Linux malware is simply due to its increasing popularity, particularly as a desktop operating system ... The use of an operating system is directly correlated to the interest by the malware writers to develop malware for that OS."

However, this view is not universal. Rick Moen, an experienced Linux system administrator, says "[That argument] ignores Unix's dominance in a number of non-desktop specialties, including Web servers and scientific workstations. A virus/trojan/worm author who successfully targeted specifically Apache httpd Linux/x86 Web servers would both have an extremely target-rich environment and instantly earn lasting fame, and yet it doesn't happen."

One may still wish to run a linux-based anti-virus software to scan insecure documents and email which comes over from the windows world. SecurityFocus's Scott Granneman stated,

...some Linux machines definitely need anti-virus software. Samba or NFS servers, for instance, may store documents in undocumented, vulnerable Microsoft formats, such as Word and Excel, that contain and propagate viruses. Linux mail servers should run AV software in order to neutralize viruses before they show up in the mailboxes of Outlook and Outlook Express users."

Because they are predominantly used on mail servers which may send mail to computers running other operating systems, Linux virus scanners generally use definitions for, and scan for, all known viruses for all computer platforms. For example the open source ClamAV "Detects ... viruses, worms and trojans, including Microsoft Office macro viruses, mobile malware, and other threats."

Viruses and trojan horses

The viruses listed below pose a potential, although minimal, threat to Linux systems. If an infected binary containing one of the viruses were run, the system would be infected. The infection level would depend on which user with what privileges ran the binary. A binary run under the root account would be able to infect the entire system. Privilege escalation vulnerabilities may permit malware running under a limited account to infect the entire system.

It is worth noting that this is true for any malicious program that is run without special steps taken to limit its privileges. It is trivial to add a code snippet to any program that a user may download and let this additional code download a modified login server, an open mail relay or similar and make this additional component run any time the user logs in. No special malware writing skills are needed for this. Special skill may be needed for tricking the user to run the (trojan) program in the first place.

The use of software repositoris significantly reduces any threat of installation of malware, as the software repositories are checked by maintainers, who try to ensure that their repository is malware-free. Subsequently, to ensure safe distribution of the software, md5 checksums are made available. These make it possible to reveal modified versions that may have been introduced by e.g. hijacking of communications using a man-in-the-middle attack or via a redirection attack such as ARP or DNS poisoning. Careful use of these digital signatures provides an additional line of defense, which limits the scope of attacks to include only the original authors, package and release maintainers and possibly others with suitable administrative access, depending on how the keys and checksums are handled.

Vulnerability to trojan horses and viruses results from users willing to run code from sources that should not be trusted and to some extent about distributions not by default checking the authenticity of software downloaded while a system was the target of an attack.

Worms and targeted attacks

The classical threat to Unix-like systems is vulnerabilities in network daemons, such as ssh and WWW servers. These can be used by worms or for attacks against specific targets. As servers are patched quite quickly when a vulnerability is found, there have been only a few widespread worms of this kind. As specific targets can be attacked through a vulnerability that is not publicly known there is no guarantee that a certain installation is secure. Also servers without such vulnerabilities can be successfully attacked through weak passwords.

WWW scripts

Linux servers may also be used by malware without any attack against the system itself, where e.g. WWW content and scripts are insufficiently restricted or checked and used by malware to attack visitors. Typically a CGI script (meant for leaving comments) by mistake allows inclusion of code exploiting vulnerabilities in the browser.

Cross-platform viruses

A new area of concern identified in 2007 is that of cross-platform viruses, driven by the popularity of cross-platform applications. This was brought to the forefront of malware awareness by the distribution of an Openoffice.org virus called Bad Bunny.

Stuart Smith of Symatec wrote the following:

"What makes this virus worth mentioning is that it illustrates how easily scripting platforms, extensibility, plug-ins, ActiveX, etc, can be abused. All too often, this is forgotten in the pursuit to match features with another vendor... [T]he ability for malware to survive in a cross-platform, cross-application environment has particular relevance as more and more malware is pushed out via Web sites. How long until someone uses something like this to drop a JavaScript infector on a Web server, regardless of platform?"

Social engineering

Linux is as vulnerable to malware that tricks the user into installing it through social engineering as other operating systems. In December 2009 a malicious waterfall screensaver was discovered that contained a script that used the infected Linux PC in denial-of-sevice attacks.

To aid the fight against computer viruses and other types of malicious software, many security advisory organizations and developers of anti-virus software compile and publish lists of viruses.

The compilation of a unified list of viruses is made difficult because of naming. When a new virus appears, the rush begins to identify and understand it as well as develop appropriate counter-measures to stop its propagation. Along the way, a name is attached to the virus. As the developers of anti-virus software compete partly based on how quickly they react to the new threat, they usually study and name the viruses independently. By the time the virus is identified, many names denote the same virus.

Another source of ambiguity in names is that sometimes a virus initially identified as a completely new virus is found to be a variation of an earlier known virus, in which cases, it is often renamed. For example, the second variation of the Sobig worm was initially called "Palyh" but later renamed "Sobig.b". Again, depending on how quickly this happens, the old name may persist.

This list is incomplete; you can help by expanding it.

Name

Alias(es)

Type

Subtype

Isolation Date

Isolation

Origin

Author

Notes

A and A

MS-DOS
Windows 95, Windows 98

unknown

A-403

MS-DOS
Windows 95, Windows 98

1998

unknown

Abraxas

MS-DOS
Windows 95, Windows 98

April 1993

unknown

Infects COM file. Disk directory listing will be set to the system date and time when infection occurred.

Acid

MS-DOS
Windows 95, Windows 98

1992

Corp-$MZU

Infects COM file. Disk directory listing will not be altered.

Acme

Upon executing infected EXE, this infects another EXE in current directory by making a hidden COM file with same base name.

Air cop-B

Jan 1990

Email
VBScript

2-1989

Does not spread under MultiFinder.

Blackworm

Bounce (computer virus)

Windows XP

This virus will block most anti-virus programs and disable 'regedit', 'msconfig', and 'task manager'

Amiga, Bootsector virus

January 1988

Swiss Cracking Association

Byte Warrior

Amiga, Boot sector virus

(c)Brain

Pakistani flu,

January 1986

Lahore, Pakistan

Basit and Amjad Farooq Alvi

Considered to be the first computer virus for the PC

8-1990

11-1993

Renames the hard drive to "Trent Saburo" on any October 31st.

4-1992

most common mobile phone virus for nokia mobile phones, transmits via bluetooth wireless.

Egg is a computer virus that affects the COM. and EXE files.

Dec 1991

Rich Skrenta

The first virus observed "in the wild"

Macintosh emulator

Targeted pirated versions of the Aladdin emulator.

Friday the 13th - Version A

Created from original identity 'Gotchix'

Spread on Facebook through 'add friend' linkage

Got-you

Grapje

Graveyard

Graybird (Backdoor Graybird, Backdoor Graybird P)

MS-DOS
Windows 95, Windows 98

August 1996

Unknown

Famous for press coverage which blew its destructiveness out of proportion

4-1993

1988

13-3-1992

Malicious, triggered on Friday the 13th.

INIT 9403

SysX

3-1994

Very destructive, destroys all data. Found only on Italian systems so far.

INIT-M

4-1993

Malicious, triggered on Friday the 13th.

Infects .COM files. Affects the computers runtime operation and corrupts data files.

Label

h1n1

Lamer Exterminator

Amiga, Boot sector virus

October 1989

Germany

Random encryption, fills random sector with "LAMER"

Infects COM.And EXE. Files after its visual payload on DOS

Drew, Bradow, Aldus, Peace

12-1987

Trojan

worm/virus

2-2008

infects .exe files

2-1992

Garfield, Top Cat

5-1990

Meditation

MegM

Melissa

1999

part macro virus and part worm

Memory Lapse

Michelangelo

April 1991

New Zealand

Ran March 6 (Michelangelo's birthday)

Script

Atomical

Multipartite, stealth, polymorphic

1994

"Priest"

1987

Malfunctions the mouse while putting itself to the system.

1990

Boot, Bouncing Ball, Bouncing Dot, Italian, Italian-A, VeraCruz

Boot sector virus

Harmless to most computers

Infects the operational memory. It's one of the fastest copying viruses and makes the computer totally unuseful.

RJump.A, Rajump, Jisx

Worm

2006-06-20

Once distributed in Apple iPods, but a Windows-only virus

Reaper

Reader_s

A malware that infects a computer and damages system core files, sometimes making BSOD and disabling anti-viruses. This is a high-risk computer virus.