I would like to make sure it's safe to download software using sudo apt-get install. Are the packages scanned somewhere? Are all packages downloaded using this command virus free?

If there is no guarantee that they are not virus free, after installing a package that contains virus, would the attacker be fully able to control my machine? Is there any way I can check all the packages that were installed on my computer by me? (not by the system automatically. I would like to filter them to see all the packages that were installed by me manually, not by the system.)

  • 8
    The question is valid, but contains misconceptions about viruses. A blacklist as the only means of avoiding infection is a very bad method, despite its ubiquity thanks to Windows' inverted security model. "Scanning" a software package is a horrible way to prevent malicious actions. – Wildcard Aug 31 '16 at 6:41
  • 2
    Tomas, your comment was removed by a moderator. Please do NOT post it over and over again. – jokerdino Sep 2 '16 at 10:55
up vote 106 down vote accepted

apt on a default Ubuntu system will be very unlikely to get viruses. However, it doesn't mean it isn't possible:

  • Malicious PPA
    One of the features of APT is the ability for admins to add Personal Package Archives (PPAs) or other software sources to the APT cache. These third-party APT sources are not necessarily trusted, and may carry viruses. However, it would take an intentional action of the machine's admin to add one of these infected sources, making it rather hard for one to add itself.
  • Hacked Repository
    In theory, a software repository may be hacked by a malicious party, causing downloaded .deb files to potentially carry malicious payloads. However, official software repositories are very carefully watched and security for these repositories is pretty tight. A hacker would be hard-pressed to take down one of the official Ubuntu software sources, but third-party software sources (see above) may be compromised a lot easier.
  • Active MITM/Network Attacks
    If a network is compromised higher up (by, say, your ISP), it is possible to get a virus from official software sources. However, an attack of this caliber would require an extreme amount of effort and the ability to Man-In-The-Middle many sites, including GPG key distribution servers and the official repos.
  • Poorly Written/Malicious Code
    Vulnerabilities do exist in open source, peer-reviewed, and maintained code. While these things aren't technically considered "viruses" by definition, certain exploits hidden or never revealed in the code could allow a malicious attacker to place a virus on or pwn your system. One example of this type of issue would be Heartbleed from OpenSSL, or the much-more-recent Dirty CoW. Note that programs from the universe or multiverse repos are potential threats of this caliber, as explained here.

apt (due to its importance on Linux systems) is pretty heavily guarded against almost all of these types of attacks on both the client and server side. While they are possible, an admin who knows what they're doing and knows how to read error logs will be able to prevent any of these attacks from taking place.

Additionally, apt also enforces signature verification to ensure that the files downloaded are legitimate (and are downloaded correctly), making it even harder to sneak malware through apt, as these digital signatures cannot be faked.

As for responding to a malware infection incident, the absolute easiest path is to burn the system to the ground and start again from a recent (and known-clean) backup. Due to the nature of Linux, it can be very easy for malware to manifest itself so deep in the system that it can never be found or extracted. However, packages like clamav and rkhunter can be used to scan a system for infections.

  • 6
    "burn the system to the ground" - for a really well-written virus, this is almost literally true. Physical destruction of the hardware is going to be safe; anything less is going to be hard work (eg, if the hard disk firmware has been rooted). – Martin Bonner Aug 29 '16 at 7:40
  • 2
    It's worth noting that those three examples are not mutually exclusive. You could add third party PPA which has been hacked by means of MITM. – el.pescado Aug 29 '16 at 8:30
  • 11
    How is (3) even possible? The packages are signed, and the public key for the Ubuntu official repos comes from the Ubuntu installation media. I don't think you can get infected unless you start from a fake installation media. – Federico Poloni Aug 29 '16 at 8:36
  • 6
    You should add option number 4: Underhanded Code in an official package. Bugs like heartbleed show, that severe bugs can exist for years even openly in heavvily maintained open source software. So there is always a possibility for an attacker to inject malicious code into a repository in a way which may survive peer-reviewing. In this case you would just download the backdoor as a fully signed package from the original server. – Falco Aug 29 '16 at 13:59
  • 22
    Note that the situation is certainly no better that this on non-Linux systems. Quite the opposite, really. The standard way of getting software on Windows is quite literally download it from some random site and hope nothing bad has happened. What you describe is about the best you can do in terms of securely installing software. (I think this is worth explicitly mentioning in the answer, as someone who asks this question is at the novice level and may not realize that.) – jpmc26 Aug 29 '16 at 23:46

apt-get will only install from the official Ubuntu repositories which are checked or from repositories you've added to your sources. If you add every repository you come across, you might end up installing something nasty. Don't do that.

  • 1
    There are instances when you need to install *.deb from other websites but they also have check sums / hash sums I believe. There are times you need to add a ppa to download from other repositories but apt-get command is still used. It would be nice to check ppa's against a list of known "bad websites" if that was possible... – WinEunuuchs2Unix Aug 29 '16 at 0:24
  • 8
    A checksum protects against accidental corruption, but not intentional tampering -- it's the OpenPGP signatures that protect against tampering. – Charles Duffy Aug 29 '16 at 16:43
  • 1
    Assuming you trust the person who signed the package and you can check the key in a trustworthy way. Honestly though, every person sometimes downloads software from the web. The repositories are big but not infinite. Perfect security and trust is a bit of a dream. – Andrea Lazzarotto Aug 30 '16 at 22:49
  • But can you not add additional repositories? – Jeremy Nov 29 '17 at 22:39
  • "If you add every repository you come across, you might end up installing something nasty. Don't do that." – Marc Nov 30 '17 at 2:11

Files downloaded by sudo apt-get are compared to a check sum / hash sum for that file to ensure it hasn't been tampered with and is virus free.

Indeed the problems people have encountered when you google "sudo apt get hash sum" is too much security against viruses.

Linux is not completely virus free by any means however incidents are probably 1000 times less than windows.

Then again judging by my screen name I might be biased :)

Comment on November 28, 2017 mentions how Windows has 1,000 more workstations than Linux so why bother hacking Linux. It brings up the fact Linux is running on all 500 of the faster Super-Computers now and most Webservers are running Linux which makes it the best way to hack all the Windows workstations that attach to the internet.

Google Chrome, Android and Windows 10 gives users ample opportunity to give away their privacy and probably some security at the same time.

  • 4
    Eh? Checksum issues aren't so much about avoiding intentional modification as accidental corruption -- unless there's a signature on it (and yes, Debian packages do also have OpenPGP signatures), a checksum can be modified just as much as the raw data itself can be. If a checksum on a package doesn't match what was present at build time, there's no reasonable expectation that that package could be extracted to get the desired original contents. – Charles Duffy Aug 29 '16 at 17:11
  • @Jeremy Yet Linux is running the top 500 super-computers and most of the web servers which is a great way to hack all the Windows clients attached. – WinEunuuchs2Unix Nov 30 '17 at 0:02

Although apt-get will only install from the official Ubuntu repositories, it does not guarantee 100% the packaged you got is clean.

If the repository is hacked, hacker may inject harm code into packages. Linux Mint server as an example was hacked, and hacker injected malware into their ISO files. http://www.theregister.co.uk/2016/02/21/linux_mint_hacked_malwareinfected_isos_linked_from_official_site/

  • 3
    Even NSA, DNC and bitcoin exchanges have been hacked recently. I think it's safe to say Ubuntu repositories are 99.99999% virus free which is the spirit of the question and our answers. Indeed no one has actually come forth with a Ubuntu virus in this Q&A. There is the long standing Linux virus/malware which KASLR fixes that most people don't even know about and I only read about on a non-MSM alternate website that is non-Linux based and solely global news based. I would like to say Linux has far fewer viruses than Windows and Ubuntu Update is secure. However as always be careful of websites. – WinEunuuchs2Unix Aug 29 '16 at 2:08
  • 2
    There's a big difference between injecting malicious code into an ISO and into the apt servers. The ISOs aren't fully signed -- there's modern tooling available that could be used for such signing (EFI signing to protect the bootloader, GRUB OpenPGP validation to protect the kernel and initrd, dm-verity to protect the root filesystem), but dm-verity isn't widely used outside ChromeOS yet. The contents of the apt servers, on the other hand, all have OpenPGP signatures -- you'd need to break into the workstation of one of the trusted developers to forge them. – Charles Duffy Aug 29 '16 at 16:46
  • 1
    Injecting ISO and serving infected apt packages are completely different. A server can be hacked and infected iso can be served, but apt can't be distributed this way. there are signatures that will prevent it – Anwar Aug 30 '16 at 20:38

depends on what your sudo permissions are. root access? all bets are off - you are ipso facto placing your trust in the apt-get ecosystem which may or may not be secure. I think its a terrible idea but I do it all the time because it's the only choice. If you're running a sensitive installation where security is at a premium then running sudo on anthing you do not entirely controll is probably insane. if you're just a regular schmoe then you're probably ok.

  • The question here is whether and to what extent the apt-get ecosystem is in fact secure, which I'm not sure this answer addresses head-on. As for "terrible idea" -- beyond distributing OpenPGP keys owned by trusted developers with the operating system (as is already done), and requiring explicit user action to enable additional keys (as when adding a PPA), what additional measures would or could you add if you were building your own software distribution system? – Charles Duffy Aug 30 '16 at 21:56
  • no, the question is very explicit. just read the op. "Can I get a virus?" yes, unequivocally. building your own software distribution system is a completely different question. – mobileink Aug 30 '16 at 22:17
  • ps. I said "I think" it is a terrible idea, which cannot be challenged. I do in fact it is a terrible idea for software distribution systems to require sudo. – mobileink Aug 30 '16 at 22:19
  • 6
    I'd argue that it's an even more terrible idea to allow an unprivileged user to install software in locations where it's in the default PATH for other unprivileged users. Homebrew is a severe offender here -- as soon as it's performed its setup, any compromised process running under the relevant uid can install software under /usr/local/bin without requiring the user to affirm that they intend to permit administrative activity. – Charles Duffy Aug 30 '16 at 22:21
  • 3
    Theoretically possible, but much less likely. And this isn't Security SE where we're in the business of the theoretical -- it's Ask Ubuntu, focused on end-users with questions grounded in practice. – Charles Duffy Aug 30 '16 at 22:44

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.