I understand that no Operating System is 100% safe. Although this backdoor is likely only affects certain Linux desktop users, particularly those running unstable Debian or testing builds of Fedora (like versions 40 or 41), **Could this be a sign that antivirus software should be more widely used on Linux desktops? ** ( I know this time is a zero-day attack)
What if, malicious code like this isn’t discovered until after it’s released to the public? For example, imagine it was included in the initial release of Fedora 40 in April. What if other malware is already widespread and affects more than just SSH, unlike this specific case?
My point is,
- Many people believe that Linux desktops don’t require antivirus software.
- Antivirus can at least stop malware once it’s discovered.
- Open-source software is protected by many parties, but a backdoor like this one, which reportedly took 2 years to plan and execute, raises my concern about being more cautious when choosing project code maintainers.
- Linux desktops will likely be targeted by more attacks as they become more popular.
IMO, antivirus does not save stupid people(who blindly disable antivirus // grant root permission) but it does save some lazy people.
OS rely heavily on users practicing caution and up-to-date(both knowledge and the system). While many users don’t follow tech news, they could unknowingly be running (this/any) malware without ever knowing. They might also neglect system updates, despite recommendations from distro maintainers.
This is where antivirus software can be useful. In such cases, users might be somewhat protected once the backdoor signature is added to the antivirus database.
Thankfully, the Linux community and Andres Freund responded quickly to this incident.
Nope. In Linux the typical action is to immediately get a fix out ASAP and be done with it.
Plus it’s unlikely that AntiVirus would actually make any difference. Even in Windows many things go undetected. All it does is bog down your system
By the way, all Fedora packages are scanned with ClamAV as part of bodhi tests. Here’s the test matrix where xz 5.6.0 passed the scan, and would have allowed the exploit in for the F40 beta if it wasn’t obsoleted by another build where the vulnerability’s mechanism was disabled because it triggered valgrind failures in other software.
Sure, there’s more sophisticated AV software out there, but at the end of the day, the F40 beta was temporarily saved because of luck, the beta freeze period, and valgrind. The ecosystem as a whole was saved because “Jia Tan” wasn’t aware that making Postgres run slightly slower immediately raises alarm bells.
No, av would not stop this kind of attack….
ClamAV is used widely though on inbound SFTP shares though in a corporate environment
What? Use a bloatware that consumes a lot of resources, slows down the whole system and increases the attack surface instead of regular updates? Are you kidding?
I dont think av would help with a backdoor, only things like malware, miners, ect. I feel most people that use linux can figure out not to run lil-uzi_leaked-song.mp3.exe
Music.exe, ahhh the good ol’ limewire days of being too young and novice to not know better.
In this xz scenario an antivirus wouldn’t do shit. it’s better to find and fix vulnerabilities rather than bog your system down with malware
I think you got the response we all expected you’d get.
I wonder why we don’t hear about open source anti-virus even though I think there are a couple of them out there.
In the specific case of xz-utils, many lazy people would never have been at risk because the issue is limited to xz-utils 5.6.x (a quite recent version). Not updating provided (unusually) a mitigation in this case.
I find all this “bog down your system” answers to be a crock of shit. Go run ESET nod32 and put it in interactive mode. Yes, you’ll get a lot of prompts but damn you’ll learn so much about what’s going on in your computer and the networks it’s reaching out to. If you’re on windows run glass wire or OSX run little snitch. I used to know a Linux alternative for those but the point stands that you should have tools that you can use in a desktop setting to really understand what is running, and what it’s connecting to. You should have a program running that can check against a database of hashes of files for signature matches. It seems though like there’s not strong enough AV. And I suspect that’s on purpose so state actors can easily get into our systems in all nations.
If you’re on windows run glass wire or OSX run little snitch. I used to know a Linux alternative for those
Would you happen to know the name of a similar tool for Linux? I was just yesterday searching myself but I couldn’t find anything
The port of Little Snitch to Linux is called OpenSnitch. I’ve never used Glass Wire, so I have no idea if that’s what you’re looking for.
Thank you! That’s exactly what I was looking for. I am familiar with Little Snitch for macOS, so this looks perfect.
For anyone interested: https://github.com/evilsocket/opensnitch
Try portmaster it’s open source. It might not be perfect in UI but I believe that’s what I used last time on Linux.
deleted by creator
Real exploiters go bug hunting for zero days. The XZ thing was a humorous clown dancing a jig in a minefield. The clown spent 5 years on the sideline, then stepped on a mine immediately upon entry.
I like your last statement.
I agree that users should take responsibility for their system, I myself learned to fully encrypt my Linux with luks2 and things about secure boot, tpm2 or so.
That’s why I’m making assumption of the need for non-tech savvy users, like most Windows users if they come to Linux world.
These are good questions. I hope as a community we can challenge if our assumptions around security are still true without being dogmatic.
