How to Write a Linux Virus in 5 Easy Steps

It's easy for people to pick at Windows for being prone to virus and malware attacks. It's almost a given belief that if you're running a PC with a Windows operating system, you're much more susceptible to attacks than users with other operating systems.

But let's quickly look at the reasons for this. First, it isn't really Microsoft's fault. It isn't that Windows is technically inferior, it's that the majority of the world runs on Windows. This fact alone is very attractive for any virus coder or exploiter. As a virus writer, you'd want to attack the majority, not the minority.

Secondly, because the vast majority of the world's computers runs on Windows, everyone from very tech savvy users to the greenest of novices is included in this pool. There are many who are just not as educated--for various reasons--about software and Internet safety. So here we have a huge pool of people, many of which aren't informed. These are two main reasons why a Windows desktop is the prime target for attacks.

In recent years however, the popularity of the Linux operating system has shot up tremendously. Ubuntu for example, is a favorite among enthusiasts. Linux is revered for many industrial strengths, but it too has security issues. A Linux computer that's improperly configured, can also take a beating from malware, hackers, and the like. Thankfully, popular builds like those from Ubuntu, are distributed pre-locked down. At the local environment however, Linux is by nature, significantly stronger than Windows in terms of user and multi-user security.

Despite its strong underpinnings, Linux has become too popular to ignore. Now, a blogger by the name of "foobar" has written a guide on how to efficiently infect a Linux user's system, stating even not to "underestimate the ignorance of a Linux user." A snippet from foobar's guide:

There is this rumor going around that Linux is virus free. It is said that the old-fashioned multi-user heritage of Linux (and other *nix OSs) prevents malware, since users are not normally running their programs in admin mode (as root user). We are reminded that execute bits are needed to run anything – contrary to Windows – and that execute bits aren't set on any attachments or files saved from emails or from a web-browser.

Therefore, we are told, the very architecture of Linux is so much more superior to Windows that it's just not possible to successfully spread malware. Of course – it is acknowledged – a low-level bug, a buffer overflow or other issue is exploitable. But nevertheless, users can't just catch a virus by email or downloading malware from the Internet, contrary to “those Windows users”. Linux will protect them from their own stupidity.

foobar is setting out to prove that Linux is no more secure to malware than Windows is. Despite writing up the how-to guide on writing a virus for Linux, foobar doesn't actually point out the actual malware coding part, and instead instructs a would-be malware coder on how to infect a Linux system.

In a related playing field, Apple is famous for claiming that its computers are bullet proof from malware and viruses too, often indicating so in advertisements that show how "sick" a PC can get versus a Mac. Because of its relatively low usage rate compared to Windows computers, Macs have traditionally been more secure only because no one really wanted to spend time to attack a small minority group. The landscape however, is changing too for Macs. With popularity increasing, viruses and attacks are becoming more popular, with the most recent infection spreading through a torrent of Apple's iWork '09 office suite.

Do you believe that the security of a system lies on the technical aspects of the operating system in use? Or do you firmly believe that the security lies soley on the sholders of the user? Do you think foobar's claims are correct?

Create a new thread in the US News comments forum about this subject
This thread is closed for comments
Comment from the forums
    Your comment
    Top Comments
  • SAL-e
    There is no away to idiot-prove any system. If the user don't know what he/she is doing, he/she will be victim of social-engineering attack. For that you don't need to write any viruses. Just ask them for their username and password and they happily will give them to you.
    Even if some one writes a virus for Linux that some how runs automatically or by users action the worst damage would be to the users profile, not the core of the system. You need to spend really great time and effort to misconfigure the Linux in order to have the same level of problems like Windows. I think MS is taking notice of that and the new Windows Server 2008 is much better. Who is going to take on the task to teach the users?!
  • mitch074
    @Mr Pink: Old News (most recent is dated 2005).

    Slapper: Apache bug, not Linux specific; at the same time, 25% of the Windows machines in the world were taken down, neutered and made unrecoverable by Win32.Tchernobyl, using a core system component abused through a drive-by attack on an on-by-default useless system service.

    New Apache worm: not Linux-specific, it could run on any Apache-enabled machine. At the same time, IIS 5.0 (installed, run as a system service and running by default on all Windows 2000 Server machines) was hacked and created a botnet strong of dozens of thousands.

    Linux hacked more often than Windows: following the inquiry, it appears that the compromised Linux servers hadn't been set up properly and were basically unpacked, run as-is (by default, most services in a distro are set into test- and developer-mode, with instructions on how to lock them down for production use) and left alone. At the same time, more than half of attacked Windows machines (which are supposed to have an administrator behind them) successfully got hacked. As such: Linux server where the admin RTFM was safe.

    Worm attacks: needs 2 things, unpatched (that's 1) web server/page generator running as root (that's 2) instead of its own user. The first took 9 years to solve under Windows, the second still isn't solved.

    Mystery Infestation: weak admin password in large hosting farms at fault. Solution: use stronger password. Valid on any OS.
  • batkerson
    I sincerely believe that the security any computer system is primarily the responsibility -- i.e., the result of design and implementation -- of the OS. The dept. of justice dropped the ball a few years back when, ultimately, it did not require the breakup of MS into operating system and applications companies. If MS truly would concentrate on the efficiency, and security, of the OS rather than on bells and whistles that few people need and even fewer actually want, then, oh, what a Windows we would (probably) have. MS is so intent on adding "functionality" or appearance that their security division (or whatever it's called internally) has a moving target to protect. To MS: stop adding functionality for an OS cycle or two and pour all your money into efficiency and security THEN, when the OS is ready, move forward with the other "stuff".

    My 2 cents.
  • Other Comments
  • jsloan
    oh, poor babies, welcome to the real virus ridden world.
  • tipoo
    As a vrius writer, i'm offended at being included in an article about viruses!

    lol, more typo's.
  • ogre9001
    To all of the brilliant Linux virus writers....Why is it that you keep making these claims, but nothing ever comes of them?
    I have read for the past decade about all of these threats that will show linux to be just as vulnerable as windows to viruses.
    Did I miss some news?
    I don't remember hearing about the massive virus attack that took down thousands of linux servers and turned linux workstations into spambot networks numbering in the hundreds of thousands.
    I look at this the same as I look at the annual threat of an attack that will completely lock down the internet.
    Deleted by Moderator