Windows gets attacked because "it's everywhere"
 

I've been seeing the title phrase above a lot (reading about security).

Basically, the argument for why windows gets hit with malware so often is because windows is installed everywhere and linux is clearly in the minority and is such protected.
From my understanding though, unix like systems (Linux, BSD) run practically everything except desktops (you know - in a majority). It runs all sorts of embedded stuff (tv's, routers), servers (amazon, netflix, yahoo) supercomputers, etc.
*nix based systems are apparently commonplace and must be high value targets (servers and routers have got to be valuable sources to crack)

Continuing on with that thought, there isn't much difference between a linux server and a linux desktop.
You may or may not have X, you probably have less "desktopy" programs like libreoffice/banshee/etc but it's otherwise the exact same thing underneath.
Presuming yahoo and netflix use bsd, shouldn't you be inheriting a tremendous amount of risk since you have now entered the same target territory as multi-mullion companies?
Since linux has existed for a long time (decades worth after all), since the same code to run decades ago are still relevant today (in the terminal at least) there ought to be well refined, heavy set malware ready to go in our "desktop linux" world.
so..

... why doesn't linux has bugs and exploits being exposed all the time?

Viruses and malware don't just infect computers "by themselves". 99.999 of the time they need a user sitting at the computer doing something stupid. This isn't the case with routers, servers, tvs, or other embedded systems, this is only the case with desktops. And since most desktops are Windows, they're under the heaviest fire.


Edit: and why the hell are the percent symbols disappearing from my LQ posts all of a sudden!?!?!

Linux DOES have bugs and exploits and new ones are being identified almost every day. Just for example look at the CVE list for Linux Kernel (which is only the base of Linux):
http://www.cvedetails.com/vulnerabil...ux-Kernel.html

The kernel as noted is just the base of Linux. There are hundreds of different packages that have their own exploits. (Some big recent ones were ShellShock and POODLE exploits.)

The statement you started with is saying that most hackers (especially script kiddies) spend more time attacking Windows because so many more people use that (and don't bother to secure it).

Linux on the other hand is mainly used either for commercial purposes where organizations might actually have a patching and security strategy or by hobbyists who are often fairly technically adept that don't fear using Linux. Such folks are also more apt to be doing patching on a regular basis.

Another thing that occurs is there are many folks involved in the various upstream projects (kernel, ssh, bash, etc...) that will look at any reported exploit work quickly and providing fixes. You then have folks devoted to the various distros (Fedora, Ubuntu, etc...) that will work on implementing those fixes in their distributions' repositories so that end users can patch. Since Linux has source code available for most things by its very "open source" nature people that are curious can work on seeing what it actually does, how to exploit it and most importantly how to fix it if it is exploitable.

Saying Linux is less likely to be targeted simply by number of installations is in my view true. Saying that Linux has no exploits or bugs is demonstrably false and thinking that way rather than being diligent about keeping your systems patched (and more importantly protected by firewalls and other mechanisms) is a good way to get rooted without ever knowing it happened.

You're never safe no matter what OS you use. You can be safeer by using a locked down OS, but that won't stop inside jobs like what most likely happened with Sony, despite what the NSA claims.

I'm sure that type of stuff exists, but it hasn't reared it's ugly head...yet. The NSA probably has loads... If you're curious about exploits currently, somewhere on the Ubuntu page (I forget where offhand) it lists all of the current bugs and exploits in Ubuntu.

Things will not get better, that's for sure. Thankfully there are AVs out for Linux when the crap hits the fan.

related:
http://www.linuxquestions.org/questi...on-4175525320/



also:
http://www.linuxquestions.org/questi...ml#post3948145

There is, in fact, a lot of dangerous malware that targets Linux-based router firmware.

I'm tempted to take the subject literally and point out that the security of an OS is determined by how well it resists attacks. Not by how many attack attempts it generates.

I've asked this elsewhere, never got a good answer.

When you buy and/or install microsoft windows, you don't just use it by itself without a separate anti-virus program. It is general accepted practice that you have to go out and buy it.
I compare this to a car and seat belts, you buy a car and drive down the road 100mph with no seat belt on. Dangerous right? Well you don't have to get seat belts, air bags, and crumple zones installed by someone else. The car manufacturer had enough brains to design and build all that into the car. And the manufacturer would know best right?

How is it that Microsoft Windows, after about 20 years, still needs a separate anti-virus program?
How is it that others like Symantec, MacAfee, and all the other anti-virus programs listed in PCmag and wherever know better than Microsoft the designer and manufacturer of the Windows operating system?
And before you say there is microsoft security essentials, there's plenty of articles out there how it's no where near as good as at least a handful of other programs.

with linux on the other hand, what's the general consensus of anti-virus programs for linux?
my understanding is the linux kernel operates completely different than microsoft windows, such that an "anti-virus" program is not needed for linux. is that true?

While I do think that user assisted exploits might be more common on M$ desktops, I tend to be aligned with Miati on this one - Linux (actually Unix and Unix-like OSs) stand up better to the relentless tide of hacks and exploit attempts.

The sheer number of internet facing Linux based devices and the incredible level of persistent 24/7 attack traffic tends to vouch for that.

As the CVE lists show, it is not without fault, but problems tend to be self limiting in scope and fixed rapidly... pick just about any recent newsworthy exploit as an example.

And Linux systems ARE subjected to continuous attacks - far more I think than desktop M$ systems! In fact, most M$ desktops today are largely protected by a Linux based router of some sort!

Just think of the number of Linux based home routers and yes they are under constant unrelenting attack - it is amazing that most people are able to remain oblivious to it - but only because it mostly works!

Linux based web servers, email servers, etc... in many cases attack traffic is the majority of all their traffic! It is amazing that it works at all! If those machines were remotely as susceptible to viruses, trojans, exploits as an M$ desktop, they WOULD BE taken advantage of immediately - there would be no internet...

And about Linux desktops - I run a room full of them myself, and maintain af few others, and have not had a single successful intrusion using only the native Linux tools as defense (iptables and configurations mostly). I have had a web server exploited briefly, due to a user using the same simple stupid passsord literally everywhere - they handed out the key! But even then, with that level of access, only the single user's account was affected.

Linux is subject to attack on a grand scale, and it stands up!

I figured pilot error would crop up. It's true that user-caused disruptions occur in any OS. I don't dispute that one bit.
But that's not the argument.
If it is, windows users should be claiming windows gets hacked more often because windows users are.. less intelligent (This is sometimes put in the context that linux users are generally more aware of their computer setup)
I could phrase it akin to "unaware of their environment" or "likes to click on spam email links"

What I'm questioning is the premise that windows gets cracked more is because it is installed in a greater quantity as opposed to linux.
I guess you could metaphorically relate it to windows having a greater "surface area". But doesn't linux have a greater surface area once you bring in all those "other" linux run hardware?

You're right, everything has bugs and some of those can be used to exploit programs.
But shouldn't nearly everything based on linux count? While corporations probably have better updating protocols - they are still using the same OS you do (or very similar) and should count as one of the "installs"

I've been following the snowden releases and so far it seems minimal evidence of that has been seen. They seem to be restricted to the same environment as everyone else.

More of less, it's because of the sandboxing of everything. If you get malware installed on your computer and you didn't install it with root, you should be able to wipe your user and the malware erased. Do that on windows and you could very easily have a rootkit. Obviously, running malware on linux as root eliminates these safeguards.
Other reasons like signed trusted package sources negating need to access websites for programs, freedom of source code to minimize risk of backdoors and malicious malware in programs help

Fair point. Should I consider every login attempt to my ssh port a attack? How do you measure how well a OS resists attacks though?

I don't believe that for a second. There are VAST quantities of Windows servers out in the world as well, and they aren't being constantly compromised and brought down like you seem to be suggesting they would. In fact they're quite reliable.

By far the most common type of malware infection on a computer is caused by users doing something stupid, and there are far more desktop users running Windows than Linux.

That's not to say Linux isn't more resistant to malware than Windows is, it is, but that's not the topic of this thread. The topic of this thread is "Why do people say Windows has more infections because it's more popular, when if you include unmanned servers, tvs with no user access or control, or [insert other embedded system with no user control here] Linux installations out-number Windows installations?" The answer is because it's desktop installations that are responsible for the vast majority of malware infections, and in the desktop world, Windows is king.

Moderator response
 

Moved: This thread is more suitable in <General> and has been moved accordingly to help your thread/question get the exposure it deserves.

I think it's becasue of two things.

When MS started selling their OS, it was with little security, and was intended for use by the common people, majoity of whom had little IT security knowledge. So the marked started to fill up with with OS that was pretty vulnerable.
Then attacks started, so MS had to increase the security of their product. At the same time people became a bit more knowledgable about security issues.
Because of all that, windows is still the most popular OS, still for the less IT kowledgable people.

If we compare this to GNU/Linux, it's completely different senario. The developers desiged GNU/Linux with the security as one of the priorities, and it was not software for the common folk, so thanks to this and to MS' monopolistic practices, this is now the situation.

I see GNU/Linux heading in the direction of being more common-user-friendly, but it still isn't there because of what happened as I described above.

So the answer is: GNU/Linux is more secure and its users are more knowledgable about IT security.

Another way to think about it, is that these days windows is working on improving its security, and gnu/linux on its user-friendlyness (if there is such a word lol).

The higher numbers of targets is only one factor though. Other factors include:
1. Ease of tools, point and click script kiddie attach tools
2. Windows security is still an add on rather than design from the beginning.
3. Integration of the browser and other user space tools into system space, the unix's do a better job of keeping components separate. an exploit of Konqueror only affects Konqueror. An exploit of IE has direct access to the system. Other components are the same way in windows, you can disable the main components but portions of it are celled by other components.

Puh-lease! Do you really think most of that would be standard equipment on all cars if NOT mandated by law? Sure some automakers (e.g. Volvo) stress safety and innovate things like this but seat belts did not become ubiquitous in the US until the Federal goverment mandated them. Even then USING seat belts didn't become ubiquitous until most states passed laws requiring them.

Windows does in fact come with rudimentary built in protection/scanner built into it.

It is also not true that there is no antivirus available (and advisable) for Linux. Ever heard of ClamAV?

^ rep added (must be spread first)... but i always thought that clam-av was for linux based email servers to prevent the spread of windows viruses ?
i never used it so i mite be wrong.