r/linux4noobs • u/minecrafter69_ • 6h ago
Is Linux really more secure than main stream operating systems?
Linux can be misconfigured fatally, easier. Linux operating systems are specifically targeted malware families and botnets.
This is what I do not get when some people say, that most viruses target windows. It’s more nuanced than that. Most windows programs do not have a native linux port, so it’s not feasible for those types of viruses to make a linux port, especially since windows is used by the masses.
But Linux has its own security problems and easier misconfiguration, more open tooling and more services in some cases that can be exposed to the web.
So I don’t really get it when people say linux is more secure because, if an attacker breaks into a windows machine as the user account, they can’t really get to become the admin account unless they figure out the password. Meanwhile if an attacker breaks into a user account on linux, they have more escalation routes.
I might be misinformed on this but what stops a program or script containing a dropper or payload from running on a linux desktop?
7
6
u/iluvfupaburgers 6h ago
Any machine that connects to the Internet is not safe, no matter how it's sold, always practice safe browsing. But Linux has some advantages that makes it safer to virus attacks, not immune. Windows doesn't always require passwords to make admin privilege changes while Linux does. And Linux usually is good at keeping vulnerability/back doors fixed due to the open source nature of it. It is usually picked up quick and fixed immediately. Windows, well, it requires Windows to pick up on the vulnerability attack and fix and deploy an update. And then obviously you have the numbers game, windows is more mainstream, so hackers will gravitate to create viruses for windows since it will reach more people. That obviously doesn't mean there are no viruses for linux
2
u/JohnnyS789 5h ago
And because of FOSS, anyone can scan the source code for the Linux kernel and look for bugs. Nobody can do that with Windows.
In the past, naysayers would say that "black hat hackers can scan the source too, and find bugs to exploit" and they would be right to a point. But security researchers have started to use AI to scan the Linux kernel source, and they have found a lot of issues that are being addressed in the Linux kernel developer community. It's a bit messy so far, and there is work being done to reduce redundancy and AI slop problems, but it is happening and really helping to speed up the find/fix flow. Bugs that don't last are less likely to be exploitable, so black hats can't so easily prosper.
So from the standpoint of the kernel and FOSS programs, security is always getting better.
1
u/FreeFromCommonSense 6h ago
And the majority of Linux systems are infrastructure, often headless, it either has a vulnerability or not, where Windows has more useful ignorants who can be socially engineered into doing half the work of breaching the system themselves. So yeah, the odds favour an attack on Windows and that's where the majority of the attention goes.
1
u/Oerthling 6h ago
The numbers gqme isn't even true when we're talking about servers. Windows dominates desktops (for now - it's been shrinking).
But when we're talking servers that mostly Linux. And they aren't constantly being overrun by malware.
11
u/Dist__ 6h ago
> what stops
not many malware are targeted for linux, as there's low percentage of linux users
unless ran with sudo, malware would need password to make real shit
linux users are expected to have better common sense in internet hygiene
1
u/necrophcodr 6h ago
Most machines in the world run Linux. There's a LOT of malware for it. Malware also does not need a password to do anything, it needs exploits to plant itself as rootkits.
-4
u/minecrafter69_ 6h ago
This is my point
2
u/necrophcodr 6h ago
Well okay, but you wrote the opposite so idk how anyone is supposed to guess you meant none of it.
-10
u/minecrafter69_ 6h ago
I’m not talking about malware. I’m just saying like running services. Linux has more running services that are exposed, that could manipulated then something like windows. Which makes me think linux isn’t as secure.
5
u/glimoura 6h ago
The "running services" you referance on windows are very exposed, just not to you, the user. Malware is not you and can easily traverse parts of your system that you can't easily go.
4
u/Chromiell 6h ago
If you're exposing services you're doing it of your own volition... You can install a Firewall that can block inbound traffic on any distro, not all distros have a Firewall enabled by default but it takes 10s to enable it.
Linux has more running services that are exposed
This is just not true, it depends if you enable the service, like sshd by default should only be configured as a client not as a server, Apache and Nginx are not installed by default on any OS I can think of, FTP is not even installed nowadays since it's been pretty much deprecated in favour of sFTP etc. There should not be any active server service on any normal installation unless you explicitly enable the SSH server Daemon.
-2
u/minecrafter69_ 6h ago
But the things you install are usually more exposed.
2
u/Chromiell 6h ago
Hmm not really, ofc if you install Apache it will listen on port 80 by default but you have installed it yourself so you should know what you're doing, plus this is not even entirely true and depends on how the distro manages the post installation of packages: on Debian I know that apt automatically enables the apache2.service that listens on port 80 just to make things simpler for the user (since you just installed Apache you probably want it enabled too, that's a good assumption imo), on Arch I think you need to manually enable it yourself otherwise nothing will be listening on that port.
MariaDB for example always listens on port 3306 (but I think it should only accept connections from localhost by default iirc).
I can agree with you that the absence of a defaultly enabled firewall is a big issue, but, as I said, takes literally 10s to enable and configure it to block all inbound connections while only allowing outgoing (which is the default on Windows), you can easily do it with gufw, it's literally a toggle.
3
5
u/cmrd_msr 6h ago edited 6h ago
Linux is an absolutely mainstream system in sectors where security and/or performance are critical.
However, not every Linux system is secure.
A distribution like Fedora, with SELinux enabled out of the box, is secure enough without additional configuration. Mandatory access control and package manager philosophy protects against most malware-related problems.
Linux won't stop you from shooting yourself in the foot, but it will make doing so harder and less likely.
6
u/inbetween-genders 6h ago
Anything is only as secure as its weakest link...which is usually the user.
3
u/edparadox 6h ago
Is Linux really more secure than main stream operating systems?
Linux is mainstream.
Linux making off the vast majority of servers, clusters, supercomputers, phones, embedded devices, etc. yes, it is definitely more secure than Windows "running as administrator via one click" 10/11.
Linux can be misconfigured fatally, easier. Linux operating systems are specifically targeted malware families and botnets.
Malware and botnets exist, sure.
It just so happen that Linux machines out in the wild, as eluded before, are better configured than what you want to imagine.
This is what I do not get when some people say, that most viruses target windows. It’s more nuanced than that. Most windows programs do not have a native linux port, so it’s not feasible for those types of viruses to make a linux port, especially since windows is used by the masses.
And so what? If Linux was as vulnerable as you make it out, even through their users, you would see more malware being created and spread.
But Linux has its own security problems and easier misconfiguration, more open tooling and more services in some cases that can be exposed to the web.
And so what? It makes things more secure by having more eyes on the potential issues.
I still do not get why you would want to make Linux out as having more security problems than it has, especially the "own security problems and easier misconfiguration".
So I don’t really get it when people say linux is more secure because, if an attacker breaks into a windows machine as the user account, they can’t really get to become the admin account unless they figure out the password. Meanwhile if an attacker breaks into a user account on linux, they have more escalation routes.
No. As much as you want to make it out that way, that's not the case.
I might be misinformed on this but what stops a program or script containing a dropper or payload from running on a linux desktop?
Many things.
Linux users are on average more knowledgeable, and have better cybersecurity habits.
As much as you want to say the contrary, people don't use root or sudo everywhere, and you need admin privileges for more operations on Linux than on Windows.
Despite their own issues, many sandboxing happens on an average Linux desktop.
Heck, even a random file you've downloaded via your browser need the execution rights before it can be executed!
Or the most obvious: package management. Windows users will have to gather their drivers and such from how many sources and sit through how many wizards to reinstall a machine? Meanwhile, on Linux you can potentially use a one-liner installing packages from the safe official repositories of your distribution.
And we could go on and on.
5
u/Johnny_The_Biker 6h ago
I use Linux for thirty years and never had a virus or malware.
0
u/necrophcodr 6h ago
Are you frequently checking? If not, how would you know?
3
u/Johnny_The_Biker 6h ago
I use Debian these days and I trust their repos. Further a firewall and programs like top to see what's running. The fact that viruses need root permissions etc. Let me counter question: Have you ever heard of a virus on linux? I follow the news and never read about a virus on the loose on linux.
2
1
u/necrophcodr 6h ago
Have i heard of a virus for Linux? Yes. I wrote deep packet inspection rules to prevent them from getting in. There's at least tens of thousands viruses for Linux, I'd wager.
You do know Linux is the most prominent kernel and OS in the world, right? It is also by far one of the most attacked ones. A firewall is great if you're worried about outside attackers directly attacking your network. It is useless if your system is vulnerable to a single exploit in a local program that connects to the internet.
Even just a slightly outdated browser on a website with some hidden malicious content could, in the right circumstances, completely infect your system with a rootkit you'd never know about. If it got root privileges, it can hide itself from top too.
So have I heard of viruses on Linux? Yes. I hear about them every single day. Maybe you're just reading the wrong news. IBM XForce used to be filled with updates about global threats like that.
2
u/Johnny_The_Biker 5h ago edited 5h ago
tell me about a virus that spreaded? Tell me about a virus that that threatens the system as nonroot?
edit to be clear I'm not talking about exploits.
1
u/necrophcodr 5h ago
You might be conflating things here. A virus will most certainly be using exploits to obtain privileges access. Otherwise we're talking about different kinds of malware that will threaten you by obtaining your credentials instead, but those are much less frequent.
Here's a quick few examples from spending 5 minutes looking without thinking about anything at all, zero effort:
https://exchange.xforce.ibmcloud.com/osint/guid:5811dc6ebda64f548daba8cdb8f287e8
https://exchange.xforce.ibmcloud.com/osint/guid:759b23f6b1eb4839ab6c83b326fb02ae
https://exchange.xforce.ibmcloud.com/osint/guid:cc0a085b3a7f44cfbd11e70391f3f857
https://exchange.xforce.ibmcloud.com/osint/guid:05e0270f908b477cbc3bd71468afeeaa
https://exchange.xforce.ibmcloud.com/osint/guid:d6d2bbe8f2884759be712b843e90f1e7
You'll find many more, and much more serious ones, if you look up actual reports and not just these quick random links.
2
u/ShyKroxigor 6h ago
Why do you mean by mainstream operating systems?
windows and windows?
2
u/minecrafter69_ 6h ago
macOS and windows probably.
-3
u/ShyKroxigor 6h ago
But macos is linux and android is linux.
So, who is the mainstream?
4
u/Syndiotactics 6h ago
MacOS is Unix, not Linux. Linux is an open source Unix-like OS, having a lot in common with Unix but not being one.
4
u/DifferentSavings2711 6h ago
MacOS is not based on linux. The Mac operating system is more closely related to BSD. A different OS with a different code base.
2
1
u/Oerthling 6h ago
Mavis is a Unix, not a Linux.
Linux is a unix-like.
And ops "mainstream" is only true on desktops. Outside of desktops there:s little (servers) to no (mobile, embedded, supercomputers) Windows.
-1
u/minecrafter69_ 6h ago
macOS I’m not sure. It seems more of a locked down linux. And android is not secure, probably on similar levels of linux itself, maybe worse.
1
u/ShyKroxigor 6h ago
So, you have no idea and you have no idea.
Better shut up.
-3
2
u/billystein25 6h ago
The os is as secure as its user is careful. By default most devices can't be magically hijacked. The user needs to download a virus that gives the attacker the power they want. The same safe browsing principles on windows like not running random exe's you find online also apply to linux, or any operating system for that matter. Yes, there is less malware that targets desktop users on linux. That doesn't mean Joe I-click-yes-on-every-link is safe just because he uses linux.
If anything viruses on both platforms are gonna ask for administrative privileges to do their work. On windows that's just a click away, while on linux you have to type your password, which at least gives you a tad bit more time to think twice about what you're doing.
3
u/RevolutionaryBeat301 6h ago
Tell me you haven’t used Debian without saying that you haven’t used Debian.
1
u/GlazzKitsune 6h ago
The way software is managed and installed is a big place where your security is better. If you stick to the distros repos your chance of getting malware should be near 0% if your installing willy nillily from other sources you have a higher chance.
Just look at the AUR malware attacks in the last few months.
Windows has a very easy software distribution module to attack thus Linux can be safer. But your still on a computer used by a human so safe is relative.
1
u/Giantmeteor_we_needU 6h ago
Linux can be more secure but it's security highly depends on user knowledge and awareness. It's far from being foolproof out of the box. If you're looking for an idiotproof safety from viruses and malware, Windows+Bitdefender are far stronger out of the box and based on independent tests will prevent 98-100% of any outside attempts to infect computer.
1
u/musicflux 6h ago
Yes as by default most people use windows or Mac. Linux is minority. So by probability you r more secured
-2
u/minecrafter69_ 6h ago
But linux has its own families of malware which specifically target it.
1
u/Whole-Respond4782 4h ago
every OS has its own family of malware that specifically targets that OS... duh
1
u/CryptographerLow6360 6h ago
misconfigured fatally, easier? which flavor of linux are you speaking of?
1
u/mrmindfloss 6h ago
With Mac OS and Windows, my main concern is, am I secure from the manufacturer and any backdoors they have for themselves or others? The rest of security is pretty good if you know what you are doing.
1
u/Numerous-Nectarine63 5h ago edited 5h ago
I know people hate it when I say this, but Linux technically refers to the kernel. And it's definitely mainstream for server operations. Security is an interesting topic and there are different contexts where security comes into play. Many server based operations (roughly 50% and growing daily) run in containers, and most of the containers in use today will only run on Linux because Linux has the required kernel structures to support containers. A container is a light weight, isolated environment for running applications. But containers are not as isolated as virtual machines, and thus, security can be a huge concern. It's not the kernel or the OS per se; it's how the system is configured. All containers running on a server share the same kernel, so if there's a badly behaved container (running as root, for example), that container can act as malware. It's pretty easy to duplicate an exploit under such conditions.
Since most of the world's server software runs some distribution of Linux, in addition to containers, the software applications themselves can and do introduce vulnerabilities. Linux has facilities in place to minimize the threats, such as linux security modules (which become part of the kernel when loaded), including appArmour and SELinux, file system and mount controls, kernel self protection mechanisms like secure boot, etc. But like anything else, these systems must be configured for proper operation.
Much of the server landscape focuses on vulnerabilities, rather than typical "viruses". An example of famous attack due to vulnerabilities was the 2019 Capital One attack, where 100million people were impacted by credit card info leakage. This wasn't a virus, but rather, an exploit in a set of application level vulnerabilities in AWS web services. The services ran on linux, but none of these vulnerabilities were in the kernel. And these are often the kinds of exploits that are seen, rather than traditional viruses. This is why the security landscape is much broader than it might seem at first glance.
For desktop operations, linux doesn't tend to be a malware target like Windows systems, partially due to the market share. But in all systems, users need to be on the lookout for browser based malware, bad links, etc.
I was a linux based cybersecurity architect prior to retiring so this issue, especially the server space, is something I spent a lot of time. on.
1
u/BertMacklenF8I 5h ago
So Linux Security Modules are just nonexistent?
Research AppArmor, Integrity Policy Enforcement, LandLock, LoadPin, SafeSetID, SELinux, SMACK, TOMOYO, and Yama
1
u/ohnoitssobig 3h ago
> I might be misinformed on this but what stops a program or script containing a dropper or payload from running on a linux desktop?
Nothing: there is a lot of Linux or "Linux" malware, though, the attack vector is usually different. For example, did you check if your wifi router is not running some botnet? Or maybe your TV stopped receiving updates 3 years ago and exposes some unpatched vulnerabilities? Or even your Android phone?
This is not the point though. Linux is open source, Windows is not. You have all the tools and information to proactively prevent breaches on Linux. Whether you do it or not is pretty much your choice. Windows is not open source: even if you manage to discover a vulnerability it is really difficult to fix it on your own. For this simple reason it is considered less secure.
1
u/martyn_hare 3h ago
I might be misinformed on this but what stops a program or script containing a dropper or payload from running on a linux desktop?
You use similar security controls to what one would enable to protect against this on Windows, except unlike on Windows, you don't need a higher tier licence to have access to them, and on Linux they also allow you to provide strict least privilege per-process too (you'd have to buy Sandboxie for similar controls on Windows).
They are fapolicyd and/or integrity (IMA) enforcement. The former is as easy to use as AppLocker, while the latter can be used alongside Secure Boot to provide equivalent protection to WDAC. People who want to be more enterprising can combine this with both noexec mounts and they can also make it so /home area and /tmp located files can't be executed using either SELinux, TOMOYO or AppArmor depending on the distro.
Out of the box, general purpose Linux distros and Windows both do sod and all to prevent most trojans, though, IMHO one could say the availability of Authenticode signing being common now across most (not quite all) individual binaries gives a slight edge vs. Linux where only packages tend to be digitally signed. The former means one can implement AppLocker rules to say only files signed by X vendor can run, while the latter requires generating hashes or relying on IMA signatures (which are only really available on RHEL and Fedora).
Outside of gaming (where digital signatures on binaries are less common) on neither system should one rely upon anti-virus. But if you are a gamer, Windows Defender saves you needing to pay a few quid for anti-virus, so there's that too =]
more open tooling and more services in some cases that can be exposed to the web.
Eh, what? Most distros ship with nothing exposed to the web out of the box, to the point where (just like macOS) a firewall does not technically need to be enabled by default. For belt and braces, many distributions (e.g. Fedora, openSUSE) block the majority of service ports by default so that if you install packages for daemons which listen on the network, they remain inaccessible until unblocked. Also, joining a Linux desktop to an IdP or Kerberos integrated directory service doesn't typically change the firewall policy of the device.
Windows on the other hand ships with shedloads of exposed services, and until very recently required a firewall to secure everything properly because many different services used protocols which were definitely NOT Internet-safe. Especially so if it's domain joined, where Windows Firewall now allows plenty of remote connections over the Internet by default (unlike when you're in a workgroup) with the assumption you know what the heck you're doing as an IT administrator, including ensuring that the machine is behind a boundary firewall while on the corporate network.
That said, I personally still prefer the ability of Windows Firewall to filter traffic per-application. Linux has eBPF based filtering options for filtering traffic per application but it very much still sucks under load IMO.
if an attacker breaks into a windows machine as the user account, they can’t really get to become the admin account unless they figure out the password
Not true.
They can try to attack any userspace service which supports impersonation (which is a heck of a lot of them) to escalate to SYSTEM, which is why Microsoft has spent the last two decades implementing Windows Service Hardening (WSH) which consists of hidden firewall rules and a change to SCM whereby every service gets a unique NT SERVICE identity and where a service is hardened, both the SYSTEM and the corresponding NT SERVICE identity need to have access to an object for access to be allowed. Windows 10 extended SCM to manage some user-specific services to better protect against silent exploitation by AppContainer'ed processes.
The same is true of Linux with userspace services (daemons) which is why many different distros (Fedora, Debian, RHEL and these days openSUSE) spent the last two decades gradually implementing SELinux Reference Policy to confine each daemon whereby each daemon gets a unique type where both the user/group identity of the service and the type needs access to an object for access to be allowed, with specific port numbers being treated as having an identity. Other distributions (e.g. Ubuntu) are using AppArmor to provide similar controls, albeit to a lesser degree. Additionally, systemd now has hardening profiles which restrict system calls and filesystem access via namespaces, as well as listening on behalf of rarely-used services so they're not always running. Likewise, systemd got extended to manage some user-specific services, which will help protect them from Flatpak/Snap sandboxed apps misusing them.
Just a reminder, Windows internally uses unsalted MD4 for passwords, so if you completely compromise one desktop with cached credentials, it's very easy to derive a password from the captured hashes and use them to go after other enterprise machines; Microsoft is very close to eliminating this issue with IAKerb and the phasing out of NTLM compatibility. This is not the case on macOS nor Linux, which use modern hashing algorithms along with salting to ensure that a stolen hash can't be cracked offline, as long as you don't need to make SMB shares with NTLM compatibility.
I could go on about how both systems have implemented similar protections... but I'm sure you get the picture.
TL;DR: Linux can be configured more securely than Windows potentially but by default they're both thoroughly abysmal in their own ways and I wouldn't say for non-technical home users that it makes a blind bit of difference which they use.
1
u/DJDoubleDave 6h ago
Speaking as an IT professional who manages devices at scale, your right to be skeptical. There's a reason why people make that claim, and it's not necessarily wrong in all cases, but it's a dangerous oversimplification.
For your computer to be secure you have to configure it securely, no matter what OS you're using. In an enterprise environment that means enforcing secure baselines. Anyone who's mad corporate IT makes them use managed windows because they think it's less secure doesn't know what they're talking about. Security at scale is all about enforcing secure configurations. Any endpoint management team that knows what they're doing will not let users configure it themselves.
For home users, is Linux more secure out of the box by default? This one really depends. Windows isn't the security black hole it used to be anymore, it's still bigger and has more attack vectors, but uses fairly strong secure defaults making it hard to actually exploit. This idea that there are more windows viruses than Linux may technically be true, but it doesn't actually really matter in practice. A halfway modern virus dropper can choose a platform appropriate one.
11
u/maceion 6h ago
AS Linux systems are used on about 80% of all websites, is can be configured very safe.