World Library  
Flag as Inappropriate
Email this Article

Linux malware

Article Id: WHEBN0000370083
Reproduction Date:

Title: Linux malware  
Author: World Heritage Encyclopedia
Language: English
Subject: Malware, Comparison of computer viruses, Linux malware, Devnull, Spyware
Collection: Linux, Linux Malware
Publisher: World Heritage Encyclopedia

Linux malware

Linux malware includes viruses, trojans, worms and other types of malware that affect the Linux operating system. Linux, Unix and other Unix-like computer operating systems are generally regarded as very well-protected against, but not immune to, computer viruses.[1][2]

There has not yet been a single widespread Linux virus or malware infection of the type that is common on Microsoft Windows; this is attributable generally to the malware's lack of root access and fast updates to most Linux vulnerabilities.[2]


  • Linux vulnerability 1
    • Viruses and trojan horses 1.1
    • Worms and targeted attacks 1.2
    • Web scripts 1.3
    • Buffer overruns 1.4
    • Cross-platform viruses 1.5
    • Social engineering 1.6
  • Anti-virus applications 2
    • For Microsoft Windows-specific threats 2.1
    • For Linux-specific threats 2.2
  • Threats 3
    • Botnets 3.1
    • Rootkits 3.2
    • Trojans 3.3
    • Viruses 3.4
    • Worms 3.5
  • See also 4
  • References 5
  • External links 6

Linux vulnerability

Like Unix systems, Linux implements a multi-user environment where users are granted specific privileges and there is some form of access control implemented. To gain control over a Linux system or to cause any serious consequences to the system itself, the malware would have to gain root access to the system.[2]

In the past, it has been suggested that Linux had so little malware because its low market share made it a less profitable target. Rick Moen, an experienced Linux system administrator, counters that:

[That argument] ignores Unix's dominance in a number of non-desktop specialties, including Web servers and scientific workstations. A virus/trojan/worm author who successfully targeted specifically Apache httpd Linux/x86 Web servers would both have an extremely target-rich environment and instantly earn lasting fame, and yet it doesn't happen.[3]

In 2008 the quantity of malware targeting Linux was noted as increasing. Shane Coursen, a senior technical consultant with Kaspersky Lab, said at the time, "The growth in Linux malware is simply due to its increasing popularity, particularly as a desktop operating system ... The use of an operating system is directly correlated to the interest by the malware writers to develop malware for that OS."[4]

Tom Ferris, a researcher with Security Protocols, commented on one of Kaspersky's reports, stating, "In people's minds, if it's non-Windows, it's secure, and that's not the case. They think nobody writes malware for Linux or Mac OS X. But that's not necessarily true,"[4]

Some Linux users do run Linux-based anti-virus software to scan insecure documents and email which comes from or is going to Windows users. SecurityFocus's Scott Granneman stated:

...some Linux machines definitely need anti-virus software. Samba or NFS servers, for instance, may store documents in undocumented, vulnerable Microsoft formats, such as Word and Excel, that contain and propagate viruses. Linux mail servers should run AV software in order to neutralize viruses before they show up in the mailboxes of Outlook and Outlook Express users.[1]

Because they are predominantly used on mail servers which may send mail to computers running other operating systems, Linux virus scanners generally use definitions for, and scan for, all known viruses for all computer platforms. For example, the open source ClamAV "Detects ... viruses, worms and trojans, including Microsoft Office macro viruses, mobile malware, and other threats."[5]

Viruses and trojan horses

The viruses listed below pose a potential, although minimal, threat to Linux systems. If an infected binary containing one of the viruses were run, the system would be temporarily infected; Linux kernel is memory resident and read-only. Any infection level would depend on which user with what privileges ran the binary. A binary run under the root account would be able to infect the entire system. Privilege escalation vulnerabilities may permit malware running under a limited account to infect the entire system.

It is worth noting that this is true for any malicious program that is run without special steps taken to limit its privileges. It is trivial to add a code snippet to any program that a user may download and let this additional code download a modified login server, an open mail relay, or similar program, and make this additional component run any time the user logs in. No special malware writing skills are needed for this. Special skill may be needed for tricking the user to run the (trojan) program in the first place.

The use of software repositories significantly reduces any threat of installation of malware, as the software repositories are checked by maintainers, who try to ensure that their repository is malware-free. Subsequently, to ensure safe distribution of the software, checksums are made available. These make it possible to reveal modified versions that may have been introduced by e.g. hijacking of communications using a man-in-the-middle attack or via a redirection attack such as ARP or DNS poisoning. Careful use of these digital signatures provides an additional line of defense, which limits the scope of attacks to include only the original authors, package and release maintainers and possibly others with suitable administrative access, depending on how the keys and checksums are handled.

Worms and targeted attacks

The classical threat to Unix-like systems is vulnerabilities in network daemons, such as SSH and web servers. These can be used by worms or for attacks against specific targets. As servers are patched quite quickly when a vulnerability is found, there have been only a few widespread worms of this kind. As specific targets can be attacked through a vulnerability that is not publicly known there is no guarantee that a certain installation is secure. Also servers without such vulnerabilities can be successfully attacked through weak passwords.

Web scripts

Linux servers may also be used by malware without any attack against the system itself, where e.g. web content and scripts are insufficiently restricted or checked and used by malware to attack visitors. Some attacks use complicated malware to attack Linux servers, but when most get full root access then hackers are able to attack by[6] modifying anything like replacing binaries or injecting modules. This may allow the redirection of users to different content on the web.[7] Typically, a CGI script meant for leaving comments, could, by mistake, allow inclusion of code exploiting vulnerabilities in the web browser.

Buffer overruns

Older Linux distributions were relatively sensitive to buffer overrun attacks: if the program did not care about the size of the buffer itself, the kernel provided only limited protection, allowing an attacker to execute arbitrary code under the rights of the vulnerable application under attack. Programs that gain root access even when launched by a non-root user (via the setuid bit) were particularly attractive to attack. However, as of 2009 most of the kernels include address space layout randomization (ASLR), enhanced memory protection and other extensions making such attacks much more difficult to arrange.

Cross-platform viruses

An area of concern identified in 2007 is that of Badbunny.

Stuart Smith of Symantec wrote the following:

What makes this virus worth mentioning is that it illustrates how easily scripting platforms, extensibility, plug-ins, ActiveX, etc, can be abused. All too often, this is forgotten in the pursuit to match features with another vendor... The ability for malware to survive in a cross-platform, cross-application environment has particular relevance as more and more malware is pushed out via Web sites. How long until someone uses something like this to drop a JavaScript infecter on a Web server, regardless of platform?[8]

Social engineering

As is the case with any operating system, Linux is vulnerable to malware that tricks the user into installing it through social engineering. In December 2009 a malicious waterfall screensaver was discovered that contained a script that used the infected Linux PC in denial-of-service attacks.[9]

Anti-virus applications

The ClamTk GUI for ClamAV running a scan on Ubuntu 8.04 Hardy Heron

There are a number of anti-virus applications available which will run under the Linux operating system. Most of these applications are looking for exploits which could affect users of Microsoft Windows.

For Microsoft Windows-specific threats

These applications are useful for computers (typically, servers) which will pass on files to MS Windows users. They do not look for Linux-specific threats.

For Linux-specific threats

These applications look for actual threats to the Linux computers on which they are running.

  • chkrootkit (free and open source software)[19]
  • Comodo (proprietary) [20]
  • ESET (proprietary) (detects OS X, Windows malware as well)[21][22][23][24]
  • rkhunter (free and open source software)[25]
  • Sophos (proprietary) (detects Windows malware, too)[26][27]

Linux malware can also be detected (and analyzed) using memory forensics tools, such as the following.

  • Second Look (proprietary)[28]
  • Volatility[29] (free and open source software)[30]


The following is a partial list of known Linux malware. However, few if any are in the wild, and most have been rendered obsolete by Linux updates or were never a threat. Known malware is not the only or even the most important threat: new malware or attacks directed to specific sites can use vulnerabilities previously unknown to the community or unused by malware.


  • Mayhem - 32/64 bit Linux/FreeBSD multifunctional botnet[31]


  • Snakso-A - 64-bit Linux webserver rootkit[32]


  • Effusion - 32/64-bit injector for Apache/Nginx webservers, (7 Jan 2014)[33]
  • Hand of Thief - Banking trojan, 2013,[34][35]
  • Kaiten - Linux.Backdoor.Kaiten trojan horse[36]
  • Rexob - Linux.Backdoor.Rexob trojan[37]
  • Waterfall screensaver backdoor - on[38]
  • Tsunami.gen — Backdoor.Linux.Tsunami.gen[39]


  • 42 [42][43]
  • Arches [44]
  • Alaeda - Virus.Linux.Alaeda[45]
  • Binom - Linux/Binom[46]
  • Bliss - requires root privileges
  • Brundle[47]
  • Bukowski[48]
  • Caveat [49][50]
  • Coin [51][52]
  • Diesel - Virus.Linux.Diesel.962[53]
  • Hasher [54][55]
  • Kagob a - Virus.Linux.Kagob.a[56]
  • Kagob b - Virus.Linux.Kagob.b[57]
  • Lacrimae (aka Crimea) [58][59]
  • MetaPHOR (also known as Simile)[60]
  • Nuxbee - Virus.Linux.Nuxbee.1403[61]
  • OSF.8759
  • PiLoT[62][63]
  • Podloso - Linux.Podloso (The iPod virus)[64][65]
  • RELx [66]
  • Rike - Virus.Linux.Rike.1627[67]
  • RST - Virus.Linux.RST.a[68] (known for infecting Korean release of Mozilla Suite 1.7.6 and Thunderbird 1.0.2 in September 2005[69])
  • Satyr - Virus.Linux.Satyr.a[70]
  • Staog
  • Vit - Virus.Linux.Vit.4096[71]
  • Winter - Virus.Linux.Winter.341[72]
  • Winux (also known as Lindose and PEElf)[73]
  • Wit virus[74]
  • Zariche - Linux.Zariche.A (and variants)[75]
  • ZipWorm - Virus.Linux.ZipWorm[76]


  • Adm - Net-Worm.Linux.Adm[77]
  • Adore[78]
  • Bad Bunny - Perl.Badbunny[8][79]
  • Cheese - Net-Worm.Linux.Cheese[80]
  • Devnull
  • Kork[81]
  • Linux/Lion
  • Linux.Darlloz - Targets home routers, set-top boxes, security cameras and industrial control systems.[82][83]
  • Linux/Lupper.worm[84]
  • Mighty - Net-Worm.Linux.Mighty[85]
  • Millen - Linux.Millen.Worm[86]
  • Ramen worm - targeted only Red Hat Linux distributions versions 6.2 and 7.0
  • Slapper[87]
  • SSH Bruteforce[88]

See also


  1. ^ a b
  2. ^ a b c
  3. ^
  4. ^ a b
  5. ^
  6. ^
  7. ^
  8. ^ a b
  9. ^
  10. ^
  11. ^
  12. ^
  13. ^
  14. ^
  15. ^
  16. ^
  17. ^
  18. ^
  19. ^
  20. ^
  21. ^
  22. ^
  23. ^
  24. ^
  25. ^
  26. ^
  27. ^
  28. ^
  29. ^
  30. ^
  31. ^ Kovalev et al (17 July 2014), Mayhem – a hidden threat for *nix web servers, Virus Bulletin
  32. ^ Leyden, John ( 21 November 2012), Evildoers can now turn all sites on a Linux server into silent hell-pits, The Register, retrieved 21 November 2012
  33. ^ Kovalev et al Effusion – a new sophisticated injector for Nginx web servers, Virus Bulletin
  34. ^
  35. ^
  36. ^
  37. ^
  38. ^
  39. ^
  40. ^
  41. ^
  42. ^
  43. ^
  44. ^
  45. ^
  46. ^
  47. ^
  48. ^
  49. ^
  50. ^
  51. ^
  52. ^
  53. ^
  54. ^
  55. ^
  56. ^
  57. ^
  58. ^
  59. ^
  60. ^
  61. ^
  62. ^
  63. ^
  64. ^
  65. ^
  66. ^
  67. ^
  68. ^
  69. ^
  70. ^
  71. ^
  72. ^
  73. ^
  74. ^
  75. ^
  76. ^
  77. ^
  78. ^
  79. ^
  80. ^
  81. ^
  82. ^
  83. ^
  84. ^
  85. ^
  86. ^
  87. ^
  88. ^

External links

  • Linuxvirus on the Official Ubuntu Documentation
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.

Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.