View Single Post
ndi's Avatar
Posts: 2,050 | Thanked: 1,425 times | Joined on Dec 2009 @ Bucharest
#4
There are no monitoring tools for Unix machines mainly because (and please don't feed the trolls) Linux and the like have centralized distribution of software. There is no point in having client-side protection when you can have server-side.

That is, if a program from Maemo repositories is found to be malicious, it's much easier to keep it back or remove it than to have walls on the phone.

On Windows, for example, each program is its own repository, so server-side is unavailable. Also, because many software systems implement their own fancy installer it's impossible to know what's inside. Kits can (and do) encrypted archives inside and are unscannable.

Also, Linux is less of a target because, by default, users aren't root. Root is reserved and you only get to be root if needed be. Older Windows (especially home OS editions) have a default-admin account system, meaning that the OS is directly accessible.

On later OS editions, as well as non-consumer editions, accounts are non-admins and a su system is used (RunAs). Also, on later editions, some features were removed due to user IQ, like autorun. Newer OS versions also feature self-healing.

Finally, the vast majority of Windows-based malware exploit the user, not the OS. Windows has a finer (arguable better) file system security implementation (beyond RWX), combined with file system file-level strong encryption and is more than capable of resisting infections. This, however, requires that a user stays non-administrator, just as a Linux system requires you to stay non-root.

This argument, however, doesn't keep people from screaming bloody murder. I'd like to see a Linux (or any other) system be "secure" if a user upgrades to root and manually downloads and executes arbitrary code received by mail.

No condom is effective if you take a pin and puncture it "for ventilation" as that chain email said.

Oh, and, to cap off the problem this far, people think anti-virus systems are really effective, which they aren't. First, only a select few products are actively researched and maintained (none free or cheap). Second, AV products recognize KNOWN threats. Meaning that, by definition, they will NOT detect the latest. As a result of this belief, they do risk compensation by clicking on stuff they would not otherwise click.

And heuristics are useless if the user keeps hammering "allow".

So, to close this long-winded response, no, there aren't any anti-virus products because Linux doesn't work like that. While it's not immune, as some flamboyant posters believe, it's more resistant out of the box and any infection (if the need arises) can be fixed via repositories.

Sound advice works on any decent platform: Don't be root/admin when running unknown software, have a backup handy and you're golden.
__________________
N900 dead and Nokia no longer replaces them. Thanks for all the fish.

Keep the forums clean: use "Thanks" button instead of the thank you post.
 

The Following 2 Users Say Thank You to ndi For This Useful Post: