5

I'm very inexperienced in using Ubuntu. I came to know about this because windows is really slow on my PC. I've heard that I don't need an antivirus on ubuntu, because we install everything from official repositories and all files are by default not executable. Phishing attack will work in all OS.

But, is it possible for a javascript virus in a web page (or any other web site based exploit ) infect an Ubuntu PC, just by visiting and interacting with the web page (no download)?

I'm using Google chrome on Lubuntu 16.04 64 bit with all updates. Does the sandboxing protection of google chrome extend to NTFS partitions mounted on Ubuntu? is the built in chrome/chromium sandbox designed to protect ONLY ext4 partitions? What about other browsers?

8

But, is it possible for a javascript virus in a web page (or any other web site based exploit ) infect an Ubuntu PC, just by visiting and interacting with the web page (no download)?

Yes, but you still will need to execute the script.

Does the sandboxing protection of google chrome extend to NTFS partitions mounted on Ubuntu? What about other browsers?

Sandboxing prevents your system from automatically executing bad code onto your system. It does not prevent you from executing that code and allowing this script to do things you do not want to happen.

  • To the second answer: I was asking about the built in sandbox in google chrome. On windows it will protect from browser exploits on NTFS drives, not FAT 32. Similarly, is the built in chrome/chromium sandbox designed to protect only ext4 partition in ubuntu? or does it cover NTFS? – New to Ubuntu Sep 16 '17 at 19:17
  • Yes it does -unless- you run it with "sudo" or "root". Sandboxing will prevent any automatic execution of code onto your system. Unless you let it (by executing the script yourself). – Rinzwind Sep 16 '17 at 19:27
4

Viruses (virii?) are only part of what is known generally as malware. And yes, you can end up with malware on your system that can, at the very least, do terrible things to your browser because those browser configuration files are yours, not the system's. If written for Linux, they may be able to do much more particularly if there are vulnerabilities (read "always install security patches") or you are sloppy about how you do things and where and how you use the system.

Most, but not all, viruses try to execute code by downloading .exe or .bin or .bat files which tell Windows they are executables. But Linux does not use file extensions to define an executable program and will only execute files that have the execute bit set. Moreover, that can be controlled by allowing downloaded files to restrict having their execute bit set as well as the fact that system and library calls in Linux are mostly not the same as ones in Windows. In addition, most people run with administrator rights in Windows but most Linux systems set users up to have permission to run with administrative rights ONLY IF THEY PROVIDE A PASSWORD EACH TIME.

  • 1
    Actually it's vira, cf. viral. – dessert Sep 16 '17 at 19:39
  • 2
    Acutally, it's not vira either. That may be true if it were virum (plural in latin of neuter nouns end in a, but it's masculine which in theory would be viri except its already a collective noun in latin "poison" and therefore has no plural) The english plural of virus is viruses. english.stackexchange.com/questions/3838/viruses-or-virii – FrostedCookies Sep 16 '17 at 22:03
2

Installing a virus usually requires access to system folders in order to make itself auto-run and auto-propagate By default on ubuntu only root has access to system folders. Thus installing anything requires a user at the terminal to provide a password. This makes it very difficult to install anything without your knowledge.

NOTE: this doesn't prevent browser hijacking or viruses hidden inside something that you willingly install.

  • That is not true. LInux viruses can infect files in $HOME. see help.ubuntu.com/community/Linuxvirus – Panther Sep 16 '17 at 19:06
  • Wrong. For instance a keylogger for X can run as the user - from any location. In addition a local exploit is often a lot easier than a remote exploit. – vidarlo Sep 16 '17 at 19:12
  • It is possible to exploit a browser. But can it cause harm since chrome has built in sandbox? Does the chrome sandbox cover NTFS partitions mounted in ubuntu? or is it just ext4? – New to Ubuntu Sep 16 '17 at 19:23
  • @vidarlo - however, you would have to start the keylogger, you couldn't make it autostart. on boot or login – ravery Sep 16 '17 at 19:24
  • 2
    @ravery sorry but .profile and .bashrc in /home are set to the user. It is possible to add code into those files, and have it send the keys pressed (so that includes sudo password) to a remote system. If I wanted to target a specific system that would be my attack vector. Mind that it is rather difficult to automate it and have it infect millions of systems. And to get onto that system I would still need an entry point (like ssh, ftp, telnet, browser exploit or something similar) to abuse it. – Rinzwind Sep 16 '17 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.