As promised, this is an article about why Linux is inherently more secure than Windows. I don’t promise that it’s 100% accurate down to the last detail; in fact, I have purposely simplified many details, and left out some more complex topics. I apologise about the length, too; it’s rather long, but I hope it’s interesting reading for people who are new to Linux as well as those who have not properly tried the Linux platform yet.
———-
In an earlier article “How to get down off an elephant”, I described why
Windows viruses don’t infect Linux systems, and why you don’t need to
worry about viruses when you move to Linux. Quite rightly I got picked
up on what I didn’t mention: Viruses written for Linux.
In this article, I’ll explain why Linux viruses are so few and far
between, and why they are really not worth worrying about at this time.
There are always people around who will claim that the only reason why
there are so few (no?) Linux viruses is because Linux isn’t particularly
wide-spread. They say that if Linux was as popular as Windows, then
there would be as many Linux viruses as there are currently Windows
ones.
I would combat that allegation. Linux is very widely used on
Internet-facing servers. As such, it is the guardian of credit card
details, passwords, social security numbers, and even industrial
secrets. What would be more valuable: Pulling information from a desktop
computer containing Granny’s shopping list, or intercepting a million
credit card numbers being sent from ATMs to a Linux server? Or finding
the blueprints of Boeing’s latest wing design, to sell to
Lockheed-Martin or Airbus?
The truth is, although the rewards are much higher, it’s much more
difficult to successfully attack Linux servers. As Linux desktop systems
are by-and-large very similar to Linux servers, we can say for the sake
of argument that the Linux desktop shares the strengths of the Linux
server. For now.
But why is this so? There are many reasons, which I’ll explain in no
particular order:
1. Execute permission. On Windows, if you want to run a program that
you’ve just downloaded from a website or e-mail attachment, you just
have to double-click it. On Linux, there is a particular flag that must
be set by the user before the program is allowed to be run. This is
called the “Execute permission”, and it is part of the permissions
system I’ll describe a little later.
Allowing execute permission is usually a command-line procedure:
sudo chmod u+x file.bin
Or it can be accomplished through the GUI on Gnome, KDE or XFCE. But the
point is, the user much actually do some steps in order to run the
program. A user that knows how to give execute permission to a program
will probably know WHY they need to do it, and be cautious.
Microsoft’s attitude toward this is to have their web browser and e-mail
program warn the user if they try to execute some downloaded software
from within IE or OE. This is a step in the right direction, except that
the user can lazily bypass the warning just by pressing Enter or
clicking “Yes”. After a while, it becomes second-nature to just hit Yes
whenever prompted. I have actually experienced this first-hand when
installing lots of software onto a friend’s computer; it became
automatic to dismiss the prompt. And I’m a computer security enthusiast!
2. Permissions system. On Windows XP and below, most people run their
system every day as the administrator user. Any program they run from
the GUI can do almost anything to the operating system that it wants.
Therefore, any program that accepts incoming connections from the
Internet, or that can open user-specified files that the user has
downloaded, could potentially be taken over in a buffer overflow attack
and used to wreak whatever sort of havoc it wishes. Including reading
and writing to other users’ home directories!
By default, on Vista, the user runs as a limited user account, and can
be “elevated” to administrator whenever a program requests it and the
user replies “Allow” to the prompt. Much safer, although this system
(UAC) seems to annoy Windows users to the point where they turn it off
(effectively running as administrator non-stop) or learn to click Allow
automatically as I mentioned in the last bullet point. Windows software
tends to be written with the assumption that the user is running as
administrator, just as they did in Windows XP, and this fires so many
UAC prompts that it becomes annoying. This isn’t Microsoft’s fault, it’s
the fault of Windows-based software developers for trying to do the
kinds of insecure things that require administrator access.
Linux has always been more secure than this. On Ubuntu, by default, the
user runs as a limited user account and can be elevated whenever needed.
This means that software by-and-large runs as the same limited user
account, and if it is taken over it can only write to the user’s own
home directory. It can’t read other users’ home directories either.
Linux software has always been written with the assumption that it is
running as a limited user, so requests for elevation to root are only
given rarely, when it is absolutely needed.
In fact, if you don’t believe that Linux-based developers assume that
we’re all running as limited users, just look at the source code for my
video-encoding program Blacklight2. The program actually crashes if
you are running as root. Fact. (I’ve recently realised this, and fixed
it in the next major release).
Ubuntu actually doesn’t even let you log in as root from the login
screen or from a text terminal login prompt. If you need to elevate a
command to root, you put “sudo” in front of it. You then get asked for
your password. If you want a root terminal, you type “sudo su” and
you are asked for your password. Other Linux distributions do allow root
logins, but then this brings us to the next reason why Linux is really
so secure.
3. User education. Linux and Unix have a culture of security and secure
computing. As a result, basic security ideas are passed down from
experienced users to newbies. If a newbie asks on the Ubuntu Forums
about how to enable the root account, you can bet that half a dozen
people will tell him or her that they should be using ’sudo’ instead,
and the basic reason why.
Linux users have such a strong sense of security that some of them wrote
an implementation of “sudo” for Windows XP so they could run their
Windows desktops as limited user accounts too.
And if a new user reads a HOWTO about setting up SSH on their computer,
there will always be advice in it about making it more secure than the
default configuration. Or if they ask how to install a firewall, they
will inevitably be taught about what a firewall actually does, and why
you should limit the number of internet-facing services you run.
I think it’s great. I can’t begin to tell you how many times I’ve been
sent viruses through MSN from people who know what the virus is doing,
but don’t think it’s common sense to disconnect their Internet to stop
the virus from spreading. I’ve actually been told to mind my own
business; well sorry hun, it became my business when your computer sent
me a virus! If only Windows users educated eachother about security,
other than “Run Xyz Security Suite and Megablah Firewall with the free
trial version of CompuGlobalHyperMeganet Anti-adware”.
4. Written for security. Proprietary operating system
manufactuers STILL DO NOT GET IT. Windows XP ships with ports open by
default. Programs listening to any data that travels to it over the
internet. Mac OS X has an integrated firewall that pretends to block all
ports, but actually doesn’t. Windows has Remote Assistance, a.k.a.
“Automatically allow script kiddies into my computer”, turned on at
first install. There has never been a day when a local user could not
get root access on a fully up-to-date Mac OS X machine by use of some
mouse clicks or a terminal command.
By contrast, Linux distributions mostly ship with no open ports by
default, meaning that no remote computers can initiate communications
with your computer. With their firewalls, “Block All” really does mean
“Block All”. And not only has the whole operating system been designed
to be secure, but anybody can conduct an audit of Linux security,
because the source code is all there; and if a problem is found, it can
be patched by anyone with the necessary skill.
Linux developers take security seriously. So much so that any security
problems that are found are fixed in very little time. Not only that,
but any critical flaws (we’re only human) have multi-layered fixes that
are designed to definitively fix the problem once-and-for-all.
Let’s take two examples. First example: Debian’s SSL key generation code
was found to have a vulnerability. The Debian developers fixed the
actual vulnerability, and implemented a system where if the SSL code
encountered one of the vulnerable keys, it would reject it and warn the
user or administrator. As soon as the patch was finished, it was pushed
to all affected Debian users. Soon afterward, an advisory was published,
advising Debian users of the problem.
I agree, Debian should have released the advisory immediately rather
than waiting until after the patch was ready, but in the proprietary
software world the advisories are usually sketchy and just say something
like “A flaw was found in this program. Update to the latest version to
fix it.”
Second example: Ubuntu developers accidentally introduced a flaw in the
installer, where the first user’s password was written to a log file
that could be read by any local user. They published an advisory as
soon as it was discovered, and less than 24 hours later a new version of the
package was pushed to Ubuntu users. Not only does the new version of the
installer not write the password to a log file, but when the Ubuntu
update system downloads the new installer package it automatically
removes any passwords it finds in the log file, PLUS it makes the log
file readable only to root.
It’s not only developers for the core of the Linux operating system.
Programmers who are used to writing their programs for Linux also become
part of the security culture, and write their programs securely.
Unfortunately, there are a lot of Windows-based programmers who are
charged with the task of porting Windows software to Linux, who cause
needless security problems due to their lack of knowledge. Curiously,
they also tend to be the source of many un-userfriendly installers -
take a look at the Flash Player installer or those of Nvidia or ATI
graphics cards.
Linux and Unix systems are also very good at being compartmentalised. If
possible, any system services that don’t need to be run as root are run
as either “nobody” (a completely unpriviledged user account) or as their
own user account, that uses the permissions system to only have access
to the parts of the system that it needs. The one exception was X (the
graphical display system), which always needed to be run as root.
However, there has been a lot of work going on in conjunction with
Linux, BSD and Solaris developers to remove this dependency and run X as
“nobody” for extra security.
What’s really pretty cool is that there are extensions to Linux that
give finer-grained permissions control to applications. AppArmour and
SELinux both give the system administrator (or desktop user) the ability
to define what functions a program can do, and stop it from being able
to do anything else.
For instance, a web browser should just open connections, read plugins
from its plugin directory, and save files to the user’s home directory. It
should not be able to mount disks, read from incoming connections, or
run shell commands. So, SELinux and AppArmour can be told, or can
learn from, typical web browser behaviour and then disallow anything
that deviates from this behaviour. If an attacker manages to take over
your web browser, they will be unable to do much, because the web
browser itself has been constrained from any potentially dangerous
activity.
Not many desktop users actually configure this ability in their Linux
distributions, but some distributions come with these constraints
already in place out-of-the-box.
Internet Explorer 7 for Windows Vista has a similar sort of
“sandboxing”, but Vista doesn’t seem to support a fine-grained
permissions control for use with other applications.
5. Linux system fragmentation. New users often complain that Linux is
“fragmented” or that there is too much choice. “Why don’t all the
distributions get together and make just one really good distribution,
and call it “Linux 2008?” is what I hear a lot. Well, it’s not going to
happen, and neither would I want it to. Some developers can work on a
distribution for older computers, some can work on a distro for the
latest machines, some can work on a distro for servers or penetration
testing, some can work on a distro for embedded environments, some can
work on a distro for power users who want every last bit of
customisation possible. And it goes on.
Because there is so much choice of software in the Linux ecosystem, it’s
actually an unwittingly good security system. Take the Windows world for
instance, where about 80% of people run Outlook Express as their e-mail
client. If an attacker finds a flaw in Outlook Express that allows a
virus attachment to be run just by clicking on the message, then potentially 80% of Windows users could get the virus. On Linux, people use all sorts of different mailers - Thunderbird, Evolution, Kmail, Claws, Opera Mail, Pine… and a lot of Linux users love their Gmail (which is Google’s web-based mail service). If a flaw was exploited in Evolution, it wouldn’t affect the people using those other apps I mentioned.
Or, if a flaw is found in a core Windows service, all Windows users are
potentially affected. But not all Linux distributions run the same
services in the same configurations. They are released at different
times and have different kernel and library versions. One flaw might
only affect potentially 25% of Linux users, and as security updates get
pushed out, fewer and fewer users.
—–
I know this has been a long article. It has taken me a long long time to
write it. But the amazing thing is that there is a lot of security
design in Linux that has been there since day dot; in fact, a lot of it
has been around since the early days of Unix. There are security
features in Linux that I know about, but I haven’t even mentioned yet.
For instance, the Linux kernel API keeps changing at every major
version, which means that any malicious software that tries to insert itself
into the kernel will only work with a limited set of kernel versions.
No security features are unbeatable, but the design and implementation
of Linux is very sturdy and resistant to crackers or viruses. Viruses on
Windows XP can be accomplished through taking advantage of the insecure
design of the operating system. Viruses on Vista exist because Microsoft
engineers haven’t implemented as much protection as they’d like, usually
because the users would complain about it or it would break backwards
compatibility.
But viruses on Linux are realistically only accomplished through use of
tiny security flaws that get patched quickly. Of course, if Linux
adoption grew to the same marketshare that Windows currently enjoys,
we’d see more crackers breaking through the security and creating
viruses and malware. But it would be nothing like the hell experienced
today on the Windows platform.
Entries (RSS)