2

On a non-international forum I was reading a discussion about using an Antivirus on Linux Desktops. There are two opinions:

1. Anti-Virus is best-practise regardless of the OS used
2. Anti-Virus on Linux does more harm than good

Now most of the answers there are primary opinion based. However one argument that keeps getting used is that there is a real danger in having an AV on Linux because it has to run as root. I personally do not really see why this in itself is such a big security risk, assuming you install a 'legit' antivirus. I am having trouble seperating the opinions with 'facts' about the risks of Linux AV.

What are the real risks of installing an AV on a Linux Desktop?

10

AV pros:

  • Can detect old viruses
  • Sometimes can detect recent viruses (depending on vendor detection/update time)
  • Sometimes can proactively detect viruses and alert to a suspicious activity

AV cons:

  • Do contain bugs (all software does) and run with high privilege level, sometimes exploitable.
  • Usually consist of megabytes of closed-source, really complex (parsers for tens of file formats, process monitoring, etc...) code that you run as root.
  • Demand trust in vendor, vendor's internal security architecture, vendor-generated SSL certificate for https web AV functionality, ...
  • Slow down your system
  • Do close to nothing against qualified attacker or targeted attack.

I tried to be objective, but my bias is clear. AV can protect against CoolPhoto.jpg.exe email attachments, but if you are advanced enough to run Linux on the desktop then you do not need that protection.

  • 4
    I think this is a fairly objective post. Given that virtually any programmer can write a virus that is not detected by AV in 10 minutes is testament to the fact that AV is only good for known samples or very, very badly written malware. I wrote an answer similar to yours on another post, elaborating on the downsides to antivirus (although it was not specific to Linux). I came to the same conclusions you did. – forest Jun 25 '18 at 2:39

protected by Community Sep 3 at 7:07

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.