Ubuntu frequently asks for credentials when downloading updates. What is to stop malware from just producing a pop-up that mimics the same behaviour?


Nothing stops a program from creating a dialog that asks for your password. It's your responsibility as a user to only enter your password into trusted programs. However, all of this assumes an attacker cares about becoming root, which it may not care about.

For the most part an attacker can do most everything they want without becoming root in the assumption you will login to the same user again at a later time. If they want to fire up their botnet or start encrypting your files they can do that without being a super-user.

The most effective tool in Linux that stops malware is the trusted repository and package signature system. In Windows you typically download .exe files from arbitrary websites, at any layer they can be infected from hosting to transmit etc. In Linux most software is found from the central repository of software which has been signed by the Ubuntu team. If the package is modified the signature will not match and the infected package will not run.

Overall if you only install software from trusted sources and never run random binaries you find from the web you will have a secure system. Linux just provides the user tools to accomplish this better.

  • >It's your responsibility as a user to only enter your password into trusted programs. How do I know which program launches the request? – Drawninpictures Dec 20 '16 at 10:53
  • Whichever program you clicked on. For example, if you download a random Linux binary from some server you have to first give it executable rights and then open it. Most honest programs are written in a way to show an error if the libraries they need are not installed, they don't typically ask to become root to automatically install packages, and if they do they typically open the system's choice of terminal and show the command that will be ran. – Kristopher Ives Dec 20 '16 at 11:22
  • Contrast that to a package that is installed from the trusted repository that may ask to become root such as gnome-system-monitor when you attempt to change the priority of a running process. – Kristopher Ives Dec 20 '16 at 11:24
  • Also likewise if a program is supposed to be ran as root and is not it usually spits out "run me as root" and then exits, and it's the users responsibility to become root somehow (like using sudo) and then run that program. – Kristopher Ives Dec 20 '16 at 11:25
  • Could an attacker conceivably not create a popup to 'install updates' that looks identical to the one Ubuntu provides, and when I click to go ahead, ask for credentials? Is that far-fetched paranoia or reasonable paranoia? – Drawninpictures Dec 21 '16 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.