I use Linux to store private data and backups for my team because it is said that Linux is itself very secure from malware and doesn't need antivirus.

But now as ransomware is spreading and has started affecting business PCs that run Windows, so it won't be too long that a new variant of ransomware is released or there might already be that can affect Linux systems also.

I don't want to risk our data getting encrypted by ransomware just for bitcoins. Do Linux systems need anti-virus now for protection against this threat?

closed as primarily opinion-based by techraf, Matthew, Dmitry Grigoryev, crovers, Xander Dec 6 '16 at 16:13

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 18
    The best defense against ransomware is keeping versioned backups that are at least on a different host, if not completely offline. Antivirus might help to prevent accidents, but it is hardly dependable protection. – trognanders Dec 6 '16 at 6:35
  • 7
    Do a Google search for "Linux ransomware" you might be surprised by what you find. – schroeder Dec 6 '16 at 7:46
  • 3
    Just to state the obvious: If you use file shares that can be written from a windows machine, having the files stored on a Linux machine doesn't help at all. – linac Dec 6 '16 at 12:22
  • From my personal experience: a lot of ransomwares are not "filesharing-aware", i.e. if you use Dropbox they will encrypt the dropbox folders like any other folder, which means you can just rollback the changes to restore the original data. Obviously this doesn't preserve the data outside the dropbox folder. An other option: keep important data in a different partition and keep this partition unmounted by default. In this way, if you are lucky, the ransomware will not encrypt it and you'll notice the issue before it corrupts important information. – Bakuriu Dec 6 '16 at 13:21
  • Make a bash script using find | xargs to encrypt all files matching a regex expression using GnuPG with your public key. Good luck finding antivirus that detects that. – forest Dec 14 '17 at 4:49
up vote 26 down vote accepted

There are actually multiple parts of the question:

  1. Is Linux affected by malware and especially ransomware?
  2. Do antivirus products exist for Linux?
  3. Do these products help against this threat?

To answer the first:
Yes, there is malware for Linux and there is also ransomware. Currently it is usually propagated in a different way compared to Windows: Malware on Windows is mostly distributed by phishing mail and web and makes use of platform specific vulnerabilities and features, i.e. currently mainly windows scripting host, macros in office documents and vulnerabilities in Office. On Linux systems instead it is usually installed by attacking the server, often by using security issues in Wordpress and other CMS. But this is mainly because server use of Linux is large while desktop use is still rare. The capabilities and vulnerabilities needed to spread ransomware in a similar way to Windows do often exist on Linux too although some differences (like the need to explicitly set the permissions of executable files) make some exploits harder.

As for the second, i.e. are the antivirus products for Linux:
There are both free products like ClamAV and commercial products available.

And finally, do these antivirus help against malware/ransomware targeting Linux?
They mostly don't. These antivirus products care mainly about protecting against attacks targeting Windows and are usually used to scan files or mails which might be served to Windows systems. Thus they are for example useful on a mail server or file server and also on a web server to make sure that the server is not used to spread malware. But they don't even protect fully against attacks targeting Windows. They might have some code in it to detect some well known (and sometimes only proof of concept) malware against Linux but they will not protect against new things. There are also products which scan for traces of existing system compromise and sometimes these are called antivirus but often not.

  • 7
    Note: Most antivirus won't protect against new things. Those that do often handle this through heuristics: check what a program does and if it does things that the antivirus deems dangerous, stop it and put it in quarantine. It doesn't always notice these though. The threats that antivirus protect the best against are those that are already running amok in the wild and have been analysed by the antivirus creators. – Nzall Dec 6 '16 at 11:52
  • @Nzall Heuristics used to work better when a virus was something that edited executable files, boot sectors or just formatted drives. Today, a ransomware might just be an application that reads and writes user files - just like all your other end-user software. There's still some tricks that kind of work, but ultimately the cost of rejecting a safe application can easily outweigh the savings of avoiding malware (MSR actually has plenty of studies on the opportunity costs of security in terms of both users and software). – Luaan Dec 6 '16 at 15:17

The best way to protect from data manipulation is backups onto a machine that provides append-only storage.

The simplest case of this are logfile servers -- there is a single serial link that you can send data over, which gets timestamped and stored; the system does not otherwise interpret the data, and there is no command interface on the serial link.

For full backups, I'd dedicate one machine that connects to the others, actively fetches the current state and directly archives it, possibly deduplicating with earlier versions. Clients have no way of contacting this system in any way, all the TCP ports are closed from the outside.

This system then has an excellent vantage point to not only provide earlier versions, but it can also be used to detect manipulations -- malware authors have a choice of either hiding the malware from this system (so you have a clean backup), or including it (which allows an antivirus system running on the backup server to spot it).

Linux is secure but it is not perfect.

The Linux malware exists and there is an example : WordPress-Delivered Ransomware and Hacked Linux Distributions witch describe how can a linux machine will be infected with a ransomware by exploiting a program vulnerability.

How it work?

A WordPress site is hacked through any method available. That may be a brute force password guessing attack or by exploiting a vulnerability in a plugin, theme or core.

The attacker installs code on the WordPress site that redirects visitors to other infected websites that are running the Nuclear Exploit Kit. The redirects may happen through a series of websites to try and prevent web browsers and Google from warning you that a site is infected. The sites involved in the redirect change frequently.

When a visitor to the infected site is redirected, the nuclear exploit kit searches for vulnerabilities in the site visitor’s Flash Plugin, Microsoft Silverlight, Adobe Reader or Internet Explorer.

If Nuclear finds a vulnerability, it exploits the visitor machine and installs the TeslaCrypt Ransomware.

The ransomware then encrypts all files on the workstation and extorts the owner into paying to get their system decrypted.

A second example:The Linux.Encoder.1 descovred by Dr.Web

Why you don't need an antivirus program under linux?

because you installed your programs from a trusted repositories and your system is frequently updated to patch the programs flaws

with the open sources softwares, the sources codes is available for everyone and can be tested, patched by experts and developers.

Why you need an antivirus?

The antivirus can be useful:

  • To scan email for viruses.

  • If you have wine installed on your system to run your favorites windows software.

  • If you have a windows machine on your network.

  • To scan a windows hard drive.

  • To scan some file before send it to windows machines.

The easy way to defeat ransomware on any operating system is having a regularly updated backup.

  • 1
    It's just that windows is 90%+ of the client computer (those who browse the web, so not the servers) so websites containing malware have very high chance to only have windows malware. The easy way to defeat ransomware on any operating system is having a regularly updated backup. what if the ransomware don't encrypt everything straight but wait for one month ? two month ? This is technically possible, this mean you'd have to be carefull to only save data and not make a system backup containing the data too. – Walfrat Dec 6 '16 at 15:51

This answer is specific to your scenario, and does not apply to every Linux system in general:

You do not need anti-virus protection in your setup. You can add it if it makes you sleep better, but it is unlikely to increase your security in any considerable way.

Your system is essentially a file store. Unless you didn't mention important details about the system, it has no outside attack surface (i.e. it is not connected to the Internet, doesn't run any other services and isn't used as a desktop or work machine by anyone).

I don't see realistic ways for a malware to get executed on this machine. Yes, your file-sharing service might have an exploit, but the malware would have to infect another machine on the network first and then attack that exploit, and while not impossible, it seems unlikely.

In addition, I'm sure you are keeping a secondary off-site backup if you are thinking about a solid backup solution. Ensure readability of that secondary backup with a read-back test before shipping it off-site and even if something happens to your backup server, you can simply wipe it and get the off-site backup.

Not the answer you're looking for? Browse other questions tagged or ask your own question.