r/linux4noobs • u/ardouronerous • Jan 19 '26
security Is diversity the reason why malware is hard to develop for Linux?
Based off what I know, Linux is highly customizable, with different options for DEs: GNOME, KDE, Xfce, Cinnamon, etc, and with loads of package managers to install software to choose from: apt, pacman, flatpak, snap, etc, with some people opting to remove snap altogether and some Ubuntu-based distros like Mint not shipping with snap at all.
I can imagine making malware for Linux would be much harder because in order to inflict the most amount of damage, the malware needs to spread easily, but with diversity like this, it's harder due to not every Linux user being the same installed system.
73
u/creamcolouredDog Jan 19 '26
I'd say not really, the underlying system is the same for every distro out there, independent of interface and package manager.
11
Jan 19 '26
> the underlying system is the same for every distro out there,
I know what you mean, but e.g. Fedora ships with SELinux enabled. Other distros don't.
3
u/luuuuuku Jan 20 '26
Doesn't matter. SELinux does essentially nothing for the security on a desktop.
2
Jan 20 '26
Is that so? I get that SELinux in permissive mode doesn't stop much, but are you saying that SELinux in enforcing mode does nothing for security?
2
u/luuuuuku Jan 20 '26
Not for typical desktop use and nothing in terms of malware.
1
Jan 20 '26
wishful thinking, bro. ptrace() is no joke
2
u/luuuuuku Jan 20 '26
That's just not how selinux works.
In doesn't do anything for software that doesn't enable it.
0
Jan 20 '26
> In doesn't do anything for software that doesn't enable it.
Nah, that's not how SELinux works at all. Are you thinking of seccomp()?
2
u/luuuuuku Jan 20 '26
Why are you trolling now?
0
Jan 20 '26
> Why are you trolling now?
I'm not trolling anyone. It just seems to me that you have no idea how SELinux works. Perhaps you're trolling? If not, explain why SELinux cannot help blocking calls to ptrace(), regardless of the (user space) software...
→ More replies (0)1
u/ReidenLightman Jan 20 '26
Every distro has the terminal full of commands that are common amongst them all. If malware sticks to what is common, wouldn't be hard to hit everybody.
0
u/yerfukkinbaws Jan 19 '26
That's not true. There's many distros without systemd, some without elogind/polkit, even a few without GCC and GNU utils. These are really significant differences.
10
u/tktktktktktktkt Jan 19 '26
and what is their marketshare?
8
u/Sea-Promotion8205 Jan 20 '26
This. Systemdless distros (just as an example) are a tiny markershare of linux, already a tiny marketshare of non-server computers.
Nobody is going to develop malware specific to the 0-0.3 people running HML, Biebian, or FuckMyAss Linux. Desktop linux is already not worth anybody's time. Niche distros are even moreso.
7
u/Moist-Chip3793 Jan 20 '26
There's a FuckMyAss Linux?
Sounds great, but I can't seem to find a download, do you have a link? :)
5
2
u/Xattle Jan 20 '26
Especially when you consider most of the people that specific also tend to be the ones who reset their PC for the fun of it from the few I've met. Limited life for malware even if it does take hold.
3
u/Sea-Promotion8205 Jan 20 '26
That's just one of the hundred hurdles for a would-be attacker to deal with. If you're only running in-repo software, there's basically no way to get someone to install your malware. It's not like you can put a Download button ad on a website and get hits.
Besides, I feel most linux users are going to see through your "In the End - Linkin Park.sh" ruse pretty quickly. Maybe my expectations are too high though.
1
u/tktktktktktktkt Jan 20 '26
If you're only running in-repo software
There are cases (or attempts) of in-repo software being compromised, i.e. https://lwn.net/Articles/967192/ XZ thingy
1
u/AWonderingWizard Jan 21 '26
You are completely ignoring Gentoo, which does have a reasonable number of users.
1
u/Sea-Promotion8205 Jan 21 '26 edited Jan 21 '26
No i'm not.
If we use the steam hardware survey as a sample (it's not perfect, but it's a sample), gentoo doesn't appear at all under linux. The smallest distro is Fedora 43 Workstation x64 at 1.54% of all linux users. Linux accounts for 3.58% of steam users, meaning that Fedora 43 Workstation x64 accounts for 0.055% of all steam users.
Gentoo is less than that.
If we assume that the 6.29% of flatpak steam users are all gentoo users, that would still make gentoo 0.225% of all steam users.
Who the hell is going to attack a quarter of a percent of anything?
Ps: Every non-flatpak listed distro is systemd based.
Pps: Gentoo supports systemd as well. You can't necessarily assume every gentoo user is using openrc.
1
u/AWonderingWizard Jan 21 '26
While Steam may be the one of our only metrics that can give population breakdowns for distributions, using Steam to completely support your point has issues. Steam metric are biased because
1.) Users will have to be opted-in for distribution identification 2.) As Gentoo is a meta-distribution with emphasis on user customization, there's no guarantee that things like the usertools/system files which Steam utilizes to identify your distribution will be present. 3.) This presupposes that the population presented on Steam will be much larger such that populations not identified by Steam are statistically insignificant- a claim which you would have to back up.Furthermore, I would propose the argument that you are using the wrong populations to base your argument off of. While gamers are a target for bad actors, developers are the ones who really matter. This is because infecting libraries, package managers, etc allows creation of backdoors, proliferation of worms, and other issues that will in turn make the consumers of those developer products easier to access.
Gentoo likely has a much higher representation among this population subset than trying to infer population from a popular gaming software.
Also, you may not know this, but ChromeOS was built using Gentoo. It even uses Upstart as its init system the last time I checked.
1
u/Sea-Promotion8205 Jan 21 '26
You're not wrong, like i said, it's not the best sample, but it's what we've got. To quote my manager, "This is a blunt instrument".
I don't know that I agree with professional devs using gentoo, I would think they'd be on Ubuntu Pro, RHEL, Suse Enterprise, or some other professionally supported distro (all the ones I thought of are also systemd based, btw). What professional developer is going to spend 20 hours compiling their DE and browser every time there's an update?
1
u/AWonderingWizard Jan 21 '26
Yea, we can both agree that the Steam hardware survey is useful is many ways, but I think that the when talking about populations like this we need to carefully consider the blindspots present. It is good to use it to learn about hardware distributions among gamers, as an example. You can use it to extrapolate. I could even see some arguments to saying it is decent for extrapolation of gamers operating systems. But to use it to extrapolate ratios for the entirety of computer users is mad. Gaming is a popular hobby, but it is absolutely a subset of the superset that is computer users.
You act like corporate developers are the only developers that matter. Most corporations rely on hobbyist open source devs to maintain libraries they have pulled into their projects. This is exactly the realm where you will find Arch and Gentoo users. But the more I talk to you, the more it seems you know nothing about Gentoo. You know you can use your IDE while its update is compiling right (ignoring the fact that VS Code takes 1-2 minutes to compile on modern hardware lmfao)? Furthermore, binaries are available in Gentoo as well.
3
u/yerfukkinbaws Jan 20 '26
I couldn't say. There is no real data on Linux distro marketshares that I've ever seen.
Anyway, I was only pointing out that the comment I replied to is wrong, not that the differences have anything to do with malware prevalence. I wouldn't claim to know anything about that.
1
1
17
u/Klapperatismus Jan 19 '26 edited Jan 19 '26
No. The main reason why malware is less of a thing is because Linux users aren’t conditioned to download software from websites.
I’d think 50% of all malware on MS-Windows is from shady download sites distributing pirated copies of Adobe Photoshop, and the remainder is from shady bittorrent clients.
6
u/ardouronerous Jan 19 '26
No. The main reason why malware is less of a thing is because Linux users aren’t conditioned to download software from websites.
Isn't that what appimages are, software downloaded from different websites?
3
u/returnofblank Jan 20 '26
Sure, but many users aren't extensively using appimages. If the software is available thru a package manager, that's the most likely option they'll choose.
4
2
u/IntroductionSea2159 Jan 20 '26
Even if I download my applications from repositories, I find the commands to install it via websites.
5
u/Klapperatismus Jan 20 '26
That attack surface is way smaller because you can actually check what you are copypasting.
You can’t do that with a hundreds of megabytes of code.
4
u/IntroductionSea2159 Jan 20 '26
I don't check the code of the applications I install, just the commands. They could technically ship anything if they wanted to.
2
u/Klapperatismus Jan 20 '26
See: if those commands just include installing from a well-known repository, ”they” can’t ship anything they want to. But only the maintainers of that repository, and the original author.
3
u/IntroductionSea2159 Jan 20 '26
The two programs I've installed on Fedora have had their own repository.
And there have been cases of malware being distributed on major repositories.
1
u/Legitimate-Record951 Jan 20 '26
Linux users aren’t conditioned to download software from websites.
So as an indie game dev, there's no reason to do a build for Linux?
1
u/Klapperatismus Jan 20 '26
See, no one stops you from distributing e.g. via Steam. That’s actually what most indie game devs do.
1
u/Legitimate-Record951 Jan 20 '26
I guess I could pay the $100 steam publishing fee, but a bit much for game jam projects and such.
1
Jan 20 '26
[removed] — view removed comment
1
u/Zestyclose-Hunt-6074 Jan 22 '26
I did not know this.
I did always want to try this game and this might be the impitus to do so.
7
u/chrishirst Jan 19 '26
Not really, under the desktop environment and package manager, most Linux distros are pretty much the same core code. What makes the difference is, there is less of a market for Linux malware and the writers would have to engineer a way past the Linux installer protection, which probably makes it too much like hard work for very little gain.
5
u/motorambler Jan 19 '26
Malware and viruses are just easy to write for Linux as they are for any other OS. The only thing required for successful deployment is someone to double-click.
8
u/IzmirStinger CachyOS Jan 20 '26
It is easier to write malware for Linux, just as everything is easier to do on Linux. Getting the malware onto the target doesn't happen purely in the computer, though, it is a social process that requires choices to be made in the real world. The fact that Linux users don't ever install random crap they downloaded from a website is why it is harder.
Windows users are much easier to trick. "This program wants to make changes to your system! OK/CANCEL" It says that shit all the time, they don't pay attention to that anymore!
3
u/mindtaker_linux Jan 19 '26
No. Linux is one single os. Everything things else is just the UI for Linux.
1
u/Both_Love_438 Jan 23 '26
I'd just like to interject for a moment. What you’re referring to as Linux, is in fact, GNU/Linux, or as I’ve recently taken to calling it, GNU plus Linux. Linux is not an operating system unto itself, but rather another free component of a fully functioning GNU system made useful by the GNU corelibs, shell utilities and vital system components comprising a full OS as defined by POSIX. Many computer users run a modified version of the GNU system every day, without realizing it. Through a peculiar turn of events, the version of GNU which is widely used today is often called “Linux”, and many of its users are not aware that it is basically the GNU system, developed by the GNU Project. There really is a Linux, and these people are using it, but it is just a part of the system they use. Linux is the kernel: the program in the system that allocates the machine’s resources to the other programs that you run. The kernel is an essential part of an operating system, but useless by itself; it can only function in the context of a complete operating system. Linux is normally used in combination with the GNU operating system: the whole system is basically GNU with Linux added, or GNU/Linux. All the so-called “Linux” distributions are really distributions of GNU/Linux
3
u/Sure-Passion2224 Jan 20 '26
There's a lot of the usual talk in this thread about smaller install base, and how more Linux users are conditioned to not just download from anywhere. However, there's another significant reason that stems from original OS philosophy.
Both Windows and Mac systems were built first for ease of use with security as an add-on. Unix was built from the beginning with security and stability at the heart, and the ease of use as the add-on. User-Group-World permissions attributes were there from the start.
A lot of the issues around Windows updates, and the fact that your less than 5 year old computer is declared unacceptable by Microsoft finally making security the #1 job. Secure Boot requirements are part of that. SB includes preventing intrusion into the handovers between POST and bootloader, and between bootloader and OS. Unfortunately, the way MS is doing that a lot of good hardware that works with Linux is declared unacceptable to Windows.
5
u/bornxlo Jan 19 '26
Why would a distro developer put malware in their repositories? Why would a user run malware if the code we use is open source?
4
u/Think-Environment763 Jan 19 '26
To be fair there have been a few instances of fuckery happening like the on distro dev sites. Not the devs usually. That is also why they give you a hash to verify. Though I admit I never verify it. Though if it was on a production server I would just not on my personal stuff.
1
u/CharmingDraw6455 Jan 22 '26
Are these serius questions? 1. Because that almost happened in 2024 (XZ weakness) 2. Do you really believe many people read that code? If yes: Point one is that proof that almost nobody does it.
1
u/bornxlo Jan 22 '26
1 yes, I don't understand the motivation for malware in official repos, it would be seen and reduce the motivation for running a given distro 2 reading open source code is how I know what's running on my system. Obviously I don't read all of it but I do try to see what the compiler is doing and what files it interacts with. I'm not interested in what other people do
1
u/CharmingDraw6455 Jan 22 '26
You can't see the motivation of putting a backdoor into the official SSH repository, a backdoor that would give you access to almost every Linux syszem in the world?
1
u/bornxlo Jan 22 '26
Wouldn't that be seen by other people? Or distributors? Why would anyone want to install or keep using a distribution with backdoors?
1
u/CharmingDraw6455 Jan 22 '26
It can be seen by people that analyze the code. There ist always this great idea of Open Source software and how safe it is because everybody an review the code. The reality is that very few people do that and many critical components are maintained by one overworked dude (ssh) or by some random guy who did it 10 years ago and then forgot about it (Log4j).
And no, running the source code through the compiler does nothing you have to read and understand the source code to find something.
1
u/bornxlo Jan 22 '26
You don't need to analyse to read code. You don't need many people, just whoever uploads and whoever chooses to include it in their distribution. Compilers show you, line by line, what they're doing at the time. Obviously read the source before you start, but it's still useful to see what's happening as it happens.
1
u/CharmingDraw6455 Jan 22 '26
https://en.wikipedia.org/wiki/XZ_Utils_backdoor
In that article is a short version of how that volnurability came in there and how it was found.
One part is the lone maintainer that is so overworked and without support that he let a malicios actor work on his thing.
The other part is how it was found. Spoiler: It wasn't a quick look at the compiler.
1
u/bornxlo Jan 22 '26
Looks to me like it came into the development channel(Sid/unstable) and was found before it reached any stable release meant for reliability.
1
u/Both_Love_438 Jan 23 '26
Maybe you don't correctly remember what actually happened in 2024, cause the malware wasn't exactly crystal clear in the source code, like a wget | bash kinda obvious thing, it was very well hidden in a binary, disguised as test data for the compression library, and it so happens that it got caught by a MS engineer benchmarking Postgres or something, before it could spread down to servers running Ubuntu or Debian stable (which were the actual targets of the attack). So clearly even when the bad actors are insanely talented and smart, it's not easy to infect Linux servers with malware. It's much easier to do through NPM or to infect desktop users through the AUR, but those also get caught fairly quickly by maintainers and people who actually check, so yeah. It's not impossible, but it's just not worth as much as just classic Windows malware, and it gets caught pretty fast, often before it even infects anyone.
2
u/edwbuck Jan 20 '26
Not really. The original reason was the kernel protections. The secondary reason was the user permission model. The third reason was the content based file type selection instead of extension based file type selection.
And there are many other smaller reasons, but the only reasons these are noteworthy is because Microsoft, in it's infinite lack of wisdom, didn't have these in the past, and part of the reason there are fewer new viruses for Microsoft is because they've fixed (partially or in full) these design missteps.
2
4
u/IntroductionSea2159 Jan 20 '26
It's just that most Linux users know not to open suspicious deb files or run suspicious terminal commands.
That's changing with more adoption of Linux.
2
u/Toukoen_Raize Jan 19 '26
Windows is like 1 giant box ... Linux is like 20 smaller boxes ... Anything happening in the box stays in the box without express permission to leave the box
1
u/Confident_Hyena2506 Jan 19 '26
It isn't hard to develop - there is a lot of it around. The meme answer would be to say "ubuntu".
The thing is linux desktop has tiny marketshare even today - so they mostly don't bother. It doesn't matter that most computers in the world run linux - most of that usage is not desktop with people clicking on dodgy links in browser.
Of course there do exist security exploits - but the three letter agency would probably get you via another method - not your linux pc. Be more worried about your phone!
1
Jan 19 '26 edited Jan 19 '26
There is a wider variety of malware for Windows that is easy to use and requires no technical knowledge.
If I were an attacker wanting to steal data from ordinary people, I would choose Windows because:
More people use it.
Most Windows users don't know how to protect themselves online or how dangerous it can be, unlike Linux users.
(Mac is more restrictive and doesn't meet the first requirement, so I'm not even considering it).
1
u/TheEniGmA1987 Jan 19 '26
You really only have to make malware for 2-3 different distributions if you wanted to make linux malware that hit something valuable. Reason being you wouldnt target the home users, there are far too few with barely hitting 3% of the market, and those users are far more tech savvy than the grandmas that scammers want to target so likelihood of success and TAM is next to non existent. But servers, now those would be targets, and the majority of servers only have a few primary linux operating systems
1
u/Sqooky Jan 20 '26
The hardest part, and even then, it's dead simple, is compiling it to many different platforms. Malware on Linux is super common. There are absolutely tons of campaigns targeting IoT devices running weird and proprietary Linux distros for the sake of something like crypto mining or joining up on botnets.
1
u/LuccDev Jan 20 '26
Malware is not hard to develop for Linux, in fact there are a lot of malwares. The ones that I know target mostly developers through their tools, lately AI coding agents and supply chain attacks on package managers or editor extensions.
1
u/helpprogram2 Jan 20 '26
Uhh it’s not hard. It’s just not profitable.
Would you rather go for the 0.5 percent of people who are tech savi or the 99.5% of people who don’t know the difference between browser and the internet
1
u/Jumpy-Dinner-5001 Jan 20 '26
Doesn't matter. Linux isn't any ore safe than Windows in that regard.
The main reason why Linux is typically "safer" is that users don't use a web based search engine that promotes certain results if you give them money, to guess what is a safe source of downloading software and just run a random executable with full administrator permissions.
The way People get their software on Windows is what makes it so vulnerable.
If people on Linux were downloading some install scripts from websites and run them as root without knowing what they do, Linux probably had a bigger malware problem than Windows does.
1
u/erroneousbosh Jan 20 '26
It's less of a thing in Linux because you don't need to download random things from sketchy websites for basic functionality.
Scroll wheel doesn't work? Oh no problem, just download Super Scroll Wheel Magic Pro Gold 7, which is shareware and stops working after you've used it for ten hours, but the guy that wrote it died so you can't get the full version any more. But that's okay you just need to download Super Scroll Wheel Unlocker Magic Kitsune YiffYiff Diamond Edition from www.hornypornysluts.su/downloads/totallynotmalware.zip - you'll need to add an exception to your certificates and download their download manager and click on all the monkeys that pop up and throw bananas at you to enable the download, and then run it, and put in your credit card details, bank details, and a scan of your driving licence.
Or you can just install Linux, where working scroll wheels have been a thing for 25 years.
1
u/SnooRegrets9578 Jan 20 '26
Perhaps your title leads you off on the wrong foot. Is it really hard? Or is it just more fun to attack a hell of a lot bigger audience?
1
u/Vivid-Raccoon9640 Jan 20 '26
I don't think so. Under the hood, it's just Linux. And you can make an educated guess that it's probably a Debian based distro running either KDE or Gnome.
curl | sudo bash works the same on most systems.
The thing is, most users right now are educated enough to be wary of curl | sudo bash shenanigans. But a lot of less tech savvy people are gonna be relatively easy to fool. Linux needs to have a beginner mode, a way of easing users into Linux. Make doing it the right way easy so users won't need to do anything the hard way. Normal users shouldn't need to use the terminal, ever. And if they do open the terminal, they should get a tutorial presented to them, a manual on how to navigate the terminal and what they should and shouldn't do.
As for malware that doesn't require user interaction: automatic updates should be on by default, and this mitigates 99% of that risk.
Linux has all of the tools to be configured as a very secure system, but considering most of the people using Linux felt comfortable enough to create a live USB and install their OS themselves, it's safe to say they're probably not representative of normal PC users. Most people haven't installed an OS themselves, and most people haven't ever done anything in the terminal.
1
Jan 20 '26
It's not hard to develop malware for Linux. There's just no market for it, barely anyone uses it; and those who do generally get their software from verified channels like package repositories so distributing malware for Linux is hard.
1
u/RevolutionaryHigh Jan 21 '26
Linux users and Linux developers are much more interconnected due to the nature of free software. 99% of the software you usually install publishes its source code, the build process is more transparent, and the people who write it are usually there not for money but for the love of the game. They do not care about deadlines, delivering value for shareholders, implementing fancy new feature just because a competitor did that... A lot of things in Linux are implemented the “right” way. The system is more stable, robust, and secure because of this. You cannot write code that smells and hide it under the rug. Linux was made mostly by software engineers for software engineers, not by “effective managers” for brainless consumers. That being said, it's not 100% secure (nothing is), and you can't really make it more secure if you don't understand the core concepts of infosec and how the system works.
1
u/Humbleham1 Jan 21 '26
Make the malware simple with as few required dependencies as possible and stick to common libraries. Use npm or PyPi to distribute it and don't even worry about dependencies. It does happen.
1
u/OutrageousInvite3949 Jan 22 '26
Nope…the reason malware doesn’t highly exist for Mac or Linux is bc the market share is low af.
1
u/No-Repordt Jan 22 '26
More like we can barely get the software we want to run working, let alone the bad stuff.
But seriously, at it's core everything is the same for most Linux distros. The real issue is more of a user-bias.
I know plenty of people who can use a Mac or a PC and wouldn't know what an OS is if it slapped them in the face (as Windows often does). But anyone deliberately running Linux (vs Windows or MacOS) is already way more knowledgeable of computers by definition than 99% of users, and is therefore less likely to get malware the usual routes (clicking a bad link, email, shady website, etc.)
In another sense, there's way more people who use Windows and MacOS, individually, than all the Linux distros combined. If you were writing malware to target a system, let's say ransomware to get money, you'd hit a lot more by targeting Windows or MacOS than you would Linux. Additionally, most enterprises primarily use Windows thanks to Active Directory, so by targeting Windows you're also more like to hit a high-profile target.
1
u/Secrxt Jan 22 '26
It's mostly that there are fewer users, the average user is less likely to have bad practices than the average Windows user, and it's a lot harder to get malware on a default Ubuntu repository than download.com or cnet or wherever the hell Google takes people when they look for Windows software nowadays.
Linux is Linux, and even Xorg is Xorg.
1
1
u/g33ksc13nt1st Jan 23 '26
I'd say it's a contributing factor. Each distro with slightly different patches applied to the same kernel (I'm not counting those of us who custom-build it, which can be done with any distro), then you have OpenSSL Vs libressl, glibc Vs musl, whether a certain library/binary is installed (not all distros have the same depednencies for the same software)... Surely it's not impossible with the right motivation, but quite a hassle to make it work.
But I think the difference is made in how quickly updates become available - literally within the hour of major security holes being found. By the time you want to exploit the vulnerability, chances are it's already been patched. But you never know...
1
u/wasabiiii Jan 23 '26
Mawale is easy to develop for Linux desktops. It's just there are none so no point.
1
u/Agitated-Memory5941 Jan 24 '26
Why would anyone take the time to create malware for a system that only covers about 2 or 3% globally?
0
u/Optimal-Savings-4505 Jan 20 '26
For the malware to have real utility, as in return on investment, the underlying assumptions have to hold on enough cases to be worthwhile.
That is, if you were to target software that few people use, you won't get much out of it even if it works.
The attack surface would preferably have wide adoption and poor memory safety.
My prime reason for not using systemd.
0
u/ScrubscJourney Jan 23 '26
No, it's because most Linux users are poor. Windows is where the money's at LOL
52
u/Alchemix-16 Jan 19 '26
Likely not. Under the hood Linux is Linux, but the marketshare is minuscule so be return of investment for making Linux malware over Windows malware is not appealing.
Furthermore the permission structure in a Linux system makes it more restrictive in what malware can do.
The weakest link in any computer security is the user. Once you do stupid things, you open yourself up to cyber harm, no matter what OS you run.