9

Which file formats are used to make viruses in Ubuntu? For example, most Windows viruses are written in .exe format, but I can’t identity the usual format in Ubuntu.

  • 3
    There are no virus for Linux in the wild. – user589808 Sep 29 '16 at 10:31
  • 20
    @CelticWarrior Of course there is Viruses for Linux and quite a lot too en.wikipedia.org/wiki/Linux_malware Eshan: Viruses are not limited to a file type, on Ubuntu or Windows, there is not a certain type of file to avoid or anything like that, read the link in this comment for some information – Mark Kirby Sep 29 '16 at 10:39
  • @MarkKirby that is an answer (and a good one), not a comment. – don.joey Sep 29 '16 at 10:48
  • 1
    I am not voting to close this question as it is a fair question: are there specific file formats that would contain viruses in linux. Also @MarkKirby has answered it. – don.joey Sep 29 '16 at 10:48
  • 5
    Biggest issue I have: where are these virusses suppose to originate from? The official repo's? (I really am skeptic that will happen) Launchpad? (possible, but doubtful since their track record is good on this. The again it is easy to live with a system sticking to the official repo's.). Random scripts? We don't do that ... we are not the average windows users ... When a virus can't reach a system or is limited to 1 system it is malware not a virus ;-) – Rinzwind Sep 29 '16 at 12:53
27

Contrary to popular belief there are Viruses for Linux and quite a lot too. While they are much less common on Linux and require you to allow them into the system most of the time, they still exist.

Viruses are not limited to a file type, on Ubuntu or Windows. There is not a certain type of file to avoid or anything like that, just be careful. Linux is secure, as long as you are careful.

Some things you can do to be safe are:

  1. Don't download from 3rd parties unless you trust what you're downloading.
  2. Use apt or Launchpad (Ubuntu's code hosting service) and similar services to get software from the source.
  3. Avoid copying and pasting terminal commands you find online, especially if you don't understand them.

You can also use an anti virus like clamav if you want to scan your system for any threats.

sudo apt-get install clamav

Install clamtk for a gui.

Here is some reading on common linux viruses and how to deal with them.

  • 5
    They just never have the impact on Linux as on Windows and almost all (if not all) require you yourself to install them. – Rinzwind Sep 29 '16 at 11:22
  • 3
    @Rinzwind Most viruses on any OS require the user to install them; they just trick the user into thinking they're doing something else. Alternatively, they exploit bugs in specific software (e.g. browsers, mail clients) to acquire elevated privileges. – IMSoP Sep 29 '16 at 17:49
  • 1
    "Linux is secure as long as you are careful" - so is Windows (since Microsoft started caring about security) – user253751 Sep 29 '16 at 20:53
  • 1
    @MarkKirby UAC doesn't accomplish much on a single-user system; a program can still encrypt all your important files without triggering a UAC prompt. It does prevent it from hooking into the system and making itself unremovable, so that you can remove it, but by that point your files are already encrypted. – user253751 Sep 29 '16 at 21:13
  • 1
    @Rinzwind It doesn't make a lot of sense to say "Linux is more secure because Linux users are more educated". If your education is what's providing the protection, then Windows with you using it would also be secure. Viruses exploit bugs, and bugs are everywhere. A macro-based virus could be entirely resident in one application's settings and file formats, and happily spread across multiple platforms. – IMSoP Sep 29 '16 at 21:32
13

Extensions mean nothing. While windows cares about em, there's non .exe viruses. In linux, your extension matters little. "What kind of file" is a little more elemental.

Essentially in linux, its likely to be some flavour of ELF binary, perhaps as a static or shared object.

It might even hook into the kernel as a module or otherwise as a rootkit, or simply replace a core operating system tool or component with its own one.

Not all of them are though - there's java viruses, as class files, assembly based shellcode exploits or even the possibility of malware written in bash (though how it would be run to start with would be interesting).

So essentially, if you arn't sure, don't trust it ;)

  • 1
    Viruses in bash? Certainly. It'd be easy to make a bash keylogger. – Nonny Moose Sep 29 '16 at 12:19
  • @NonnyMoose easy, assuming you have root permission – random_clyde Sep 29 '16 at 12:38
  • 1
    Social engineering is a pretty common way to get malware into systems. – Journeyman Geek Sep 29 '16 at 12:39
  • @Jean-LouisBonnaffe why? you need root for editing a ./bashrc in your own home? – Rinzwind Sep 29 '16 at 12:49
  • @RinzWind Exactly. You'd only need root to install it for all users. – Nonny Moose Sep 29 '16 at 12:54
6

I'm going to address malware in general for this answer, not just viruses.

Viruses on Linux are not restricted to a particular file extension / type.

To better understand what we're talking about, we first need to understand the link between extensions and file types and how viruses actually work.

In Windows, .exe files contain files in a PE (Portable Executable file format, which is a format that contains binary executable data. This executable data gets loaded into memory and is then executed by interpreting the instructions in that data.

This means that the easiest way to run your code is to package it into an .exe. There's other ways as well, however. PDF files are notoriously insecure because they contain parts that can be interpreted by the reader. This means that an embedded script can abuse weaknesses in the reader's security and for example search for and modify other PDF files on the system.

It can get even worse. You can abuse programming mistakes in applications to inject malicious code directly into the computer's memory. Once it's there, those instructions can be run as native code and often with high privileges, with devastating results.

So how does this work under Linux?

Linux, like Windows, has a binary executable format. Windows has the PE format, Linux the ELF format. Unices in general have a much less pronounced file extension requirement, so ELF files usually are extension-less. Linux uses Magic Numbers to identify those files, which is why it doesn't need the extensions.

Binaries are, however, not at all popular as a malware distribution method under Linux. This is because end-users very rarely actually manually open binaries they receive. Binaries are installed and managed by the package manager, not the end-user. So the malware needs other attack vectors to inject its code onto the victim.

This means that those other methods (code injection, scripting) are much more popular as malicious code carriers.

2

The distinction here is not done by file extension, but by a file property set by a command

chmod +x filename

This way you can make executable from a binary file as well as from a script file.

With

ls -l

you can list the file properties by a safe manner before execution.

Also, you can run:

file filename

to display more detailed data about a file.

  • 4
    I get what you are saying here, "permissions are important to security, more than file types" and that is a very good point but perhaps you could explicitly state that. Always assume anyone reading has no prier knowledge of the the subject :) Make a simple edit to just clarify that and I will vote this up. – Mark Kirby Sep 29 '16 at 11:13
1

Extensions and executables have little or nothing to do with each other on Windows or Linux, and extensions have nothing at all to do with virus's. When given an explicit file to act on, both operating systems look at the file's header to decide what to do with it. When there is ambiguity in the file name, the two OS's use slightly different strategies to identify the intended target. For example, if you type "echo hello" into the windows run box, the windows terminal or a linux terminal, both will look in each directory in the PATH environment variable for a file called "echo" that has execute permission and attempt to execute it with the argument "hello". Windows will also look for the file "echo.com", "echo.exe", "echo.bat", "echo.cmd", "echo.vb" and a bunch of other extensions that I can't remember off hand, plus any extensions mentioned in the PATHEXT environment variable, before it moves on to the next directory and if it finds a match, it will attempt to execute that.

  • 1
    Windows never looks at the file header. It uses only the extension. – UniversallyUniqueID Sep 30 '16 at 0:55
  • Sorry @BharadwajRaju but you are mistaken. As I explained, in windows the extension is used to 'improve' the path search but once a suitable candidate is found, it is passed to the loader which examines the 'header' of the file to determine what to do with it. On more recent versions of Windows, that loader is a set of functions contained in ntdll.dll (another executable extension). – Paul Smith Sep 30 '16 at 9:08
  • It changed? I see... So can Windows now open files without extensions? – UniversallyUniqueID Sep 30 '16 at 16:10
  • There have been changes but this has been the basic behavior since the days of MS_DOS and CP/M before it. – Paul Smith Oct 3 '16 at 13:56
  • @PaulSmith Although windows can open a file without an extension, windows typically won't know what to do with the file that has no extension unless you tell it to open with such and such an application. – mchid Oct 5 '16 at 19:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.