Updated: May 28, 2010
Recently, I've come across a few interesting, yet misleading articles debating the pros and cons, mostly pros, of using this or that Linux distribution as the ultimate solution to Windows security problems, including frequent malware infections and reinfections and other related issues. While the overall conclusion might be correct, the specific analogies used to prove the point and bring you to said conclusion are most erroneous.
As a rational, logical and rather impartial Linux user, I would like to give you a sanity check regarding your security habits and computer usage models, using the neverending Windows vs. Linux analogies as the stepping stone for crossing the bridge of confusion.
We talked about using Linux for all sorts of wrong reasons, with Windows malware being one of the major points raised. Then, we discussed the necessity of using anti-virus software in Linux. However, while the layered and healthy security model in Linux works well, it does not replace or obsolete common sense. I will show you why.
Claim 1: Linux is Windows anti-virus
Not sure if my sub-title makes sense grammatically, but you get the point. If you're prone to getting infected in Windows now and then, regardless of the security measures taken, moving over to Linux will keep you malware-free. That's the claim. The truth is, well, a little different.
I'm not going to tell you that there's no Linux malware because the market is so small and no one tries to code any bad software. I'm not going to tell you that it's only a matter of time. Here's what I say:
People prone to getting infected in Windows will most likely escape the same faith when moving over to Linux only if two conditions are met: 1) they do not know the root password or have no sudo account 2) see point 1.
Working as a limited or standard user in any operating system works well against accidental damage to the system. But if you're also the owner of the machine and have in your power the ability to elevate your privileges to the highest level, that of the admin or root account, then you have the ability to cause damage, if needed.
Root works great only for people who do not know the password and cannot abuse the system. Otherwise, while it's convenient against accidental damage or automated attacks, it is useless against user-initiated commands. And believe it or not, most damage caused to operating systems worldwide is a result of deliberate user actions. To sum it up, let your user have the ability to administer the system and the entire concept behind root collapses into probability of human error.
Here's a scenario:
I could in theory write a piece of C code and compile it, then send it to a friend. The binary would be statically linked with its own libraries, so it would be rather cross-platform. I could also write a simple shell script and send it to a friend. Again, it would work on most releases of Linux. I could also create a DEB or an RPM package and send it to a friend. The packages would be restricted to a few choice, popular distributions.
What does this package do?
Well, it's a secret. The point is, the user gets the file and now has to open it. He double-clicks on the package and is prompted for a password, because my package wants to run as root. Alternatively, he follows instructions given in forums about how to run shell scripts in a terminal window. Again, the user is prompted for a password.
To root or not?
The thing is, the entire security mechanism of the operating system focuses now on one single point of failure - the computing skills of the user at hand, and his/her willingness to execute code. The higher the temptation and the sweet promise beyond the execution, the better.
Ultimately, people who double-click on unknown, suspicious files in Windows and get their system hosed will do the same in Linux. It may take three or seven years until this happens, it may be more difficult to achieve, given the statistical probability of using packages found outside the official, digitally signed repositories, but for people with the bad index finger habits, it WILL happen.
People who have escaped malware in Windows by going to Linux have merely postponed the effect of their filthy habits. They have worked around the problem and not solved it. And we can loud the effort of moving over to Linux, it does not change the fact there's something fundamentally wrong with their computing skills and patterns.
The single best way to avoid potential damage to the system is to learn not to click. It's the most important thing and it goes a long way, regardless of the operating system. The biggest problem is that people when want to run something, they will.
Claim 2: Linux is malware free
This depends what you classify as malware. Is malware something written by people who want to control your machine, wean your wallet - or both? Is malware software designed to work one way and it happens to do something else, either intentionally or by mistake? Is malware anything that makes you feel better and safer while it merely bleeds your budget in between annual subscriptions?
The main reason why Linux desktop has less popularity among - let's call them - malware writers is the financial impact. Linux servers are hammered day and night, because they offer a significant return on investment. Conversely, Linux desktop is not a valid target. The variety, the stability and the longevity of Linux distributions makes investment as predictable as elections in Angola. In other words, not.
I am playing into the hands of Linux critics by claiming popularity as a reason for Linux being malware free, however my angle is different. It's not the lack of effort on behalf of malware writers that keeps Linux clean, it's too much effort on behalf of Linux distributions at being new, innovative and with a ferocious release cycle that makes malware business so unripe. This same reason that keeps Linux divided and struggling.
Windows XP has not changed since it has been released in 2001 or so. And there's the backward compatibility all the way to good ole 16-bit DOS, as evident in the recent 17-year-old vulnerability found. Now, try running a Fedora 12 package on Fedora 10, a mere year apart. Good luck. Think about it. Even the official packages break between releases because of so many dependencies! Take PulseAudio for example. Now, how can you expect malware to work?
But you should take into account the indirect malware. For example, selling anti-virus software to Linux users is a white crime. Because such software is unneeded and unnecessary. While it does not harm per se, users end up with less money at the end of the day than they intended. It left their pockets. Theft? No, not really. Maybe. You have a bunch of lawyers to mystify all that in huge tomes of small-letter print.
Let's be serious for a moment. Linux malware exists. It's any software that does not work as intended - or as intended - and causes damage to the system and the user. The scope and the nature of malware is different. The exposure is different. Which means that the only thing you can depend on is what you keep at your end. Your data. Please see point below.
The most important thing: backup (and restore)
I have had my various 20-30 operating systems restored or fixed some 20-30 times in the last two years. Not a single time because of a malware infection. In Windows, I had to deal with ugly and unfriendly updates. In Ubuntu, for instance, it was a case of a badly rebuilt initrd image. All of the damage was caused by errors in software code, introduced by accident by the developers. Things like that happen. You just need to be prepared to recover quickly and painlessly, losing as little time and data as possible.
If you ask me, statistically, the chances of your system getting damage due to normal usage are infinitely higher than getting hit by malware. For all practical purposes, malware is a combination of money greed and scaremongering, no different than any other swindle pulled on the general populace. But while we had centuries to learn not to let traveling salesmen step into our homes, we've only had a few years to get used to the rapidly shifting e-scenery of the Internet.
So you should not bank on your skills as a computer guru or your prudence as a freshly converted Linux user to avoid system damage. It will come, by accident, by design, through hardware problem, by spilling coffee on the keyboard. You can't really control these, but you can make sure your data is always safe and secure. That's what security is all about.
Very importantly, a restore that not been tested does not exist! You must make sure your backup solution works, both ways, before you can rest assure that you will not your data should a problem strike.
If you're interested in learning more about backup & restore of data, please read my CloneZilla tutorial, a powerful, friendly and free imaging software, usable both for Windows and Linux alike. Likewise, do take a look at Unison and Grsync file-oriented backup solutions.
Linux does not cure cancer. It's not a solution to all your Windows problems. For that matter, Windows can be enjoyed just as any other operating system. Slow updates, a promiscuous default behavior and the sheer common denominator of its user base speak against it, but it will work well with some small attention to details and a bit of conservative habits.
Abandoning Windows woes starts with Windows. Before you can migrate to Linux, you need to get a grip of the
system you're working on. Once you figure that, your behavioral patterns will become universal. Moving on to
Linux, you will learn a new language, a new syntax, but the underlying cornerstones remain identical. And
that's all there is to it.