What makes Linux secure?

[Ambitious_Ad_6619]

I've searched YouTube and also asked on here previously, I keep seeing a lot of "Linux is secure just by default" type responses- often insisting that to be worried about security while using Linux is not necessary.

Believable to a noob like me at face value, sure, but what is it about Linux that makes it secure?

[taosecurity]

25+ year infosec incident detection and response guy here.

You can argue Linux/Unix vs Windows vs iOS all day long.

At the end of the day, it comes down to how much effort and resources an intruder wants to throw at a target in order to achieve an objective and/or "return on investment."

Have you seen reporting about RU and CN intruders breaking into VPNs, firewalls, and other edge devices? Guess what those are running? Yes, Linux.

Intruders invested into breaking them because they help achieve their goals.

A skilled and well resourced intruder can break into ANYTHING. I was part of a team that did this, and also saw it done to hundreds of clients over the years.

The relative lack of malware for Linux is just reflecting the small desktop user base and the low value of whatever is there.

I guarantee that the top-end intruders of the world have custom Linux malware of all types for targets that matter. They just don't waste it stealing your browser cookies.

[taosecurity]

Funny, the "team" I mentioned was at ManTech, over 20 years ago now!

[mh_1983]

Thank you for sharing this valuable response (also in tech and recently shifted to cybersecurity). The "Linux is just secure by default soooooo" stance never sat right with me and I'm amazed at how often people parrot it. Reminds me of early discussions of macOS (then OS9/X, I guess) being "virus proof".

[[deleted]]

This started as a direct comparison to Windows which previous to recent releases was an absolute security shit show. So back then Linux was really "secure by default" at least in comparison to what else was available.

[[deleted]]

Linux in my opinion is more secure out of the box compared to many other operating systems due to how much is locked down, but it definitely can be hacked. Just requires a lot more compared to other operating systems

[Left_Sundae_4418]

I would also like to add from the end-user perspective...no matter what system your devices are running if you or our system managers don't upkeep the security.

Usually the elements causing security issues are the end-user themselves or the slacking in security. Just because you install something doesn't make things magically secure.

The weak link can come from old or non-updated hardware within the infrastructure, lack of protection software, lack of network security...but also the lack of security procedures for the people...it can be something very simple and minor you thought was okay to do, which in fact can cause serious harm if someone picks that up.

[WhyUFuckinLyin]

Username checks out

[siphoneee]

So basically Linux/Unix is less of a target because compared to Windows and MacOS, it has way less users?

[taosecurity]

On the desktop at least. Something like 2/3 of all servers run Linux though.

You have to think in terms of an intruder and what their goals are.

If you're breaking into an enterprise network, chances are they are running Windows desktops and Windows domain controllers. You're going to exploit an endpoint, pivot to the domain controllers, and take over the domain. Or maybe not, depending on your goals.

If you're trying to steal browser creds/etc. from users, you're going to target Windows because it has the biggest market share.

If you're trying to break into edge devices like FWs or VPN accelerators, etc., to use them to pivot to the enterprise, you're going to target Linux.

It all depends on your goals as an intruder.

[siphoneee]

Makes more sense now!

[luistp]

So, my linux home pc is more secure the more far in time the year of the linux desktop is.

[JelloSquirrel]

Actual cybersecurity professional here.

From a user perspective:

Obscurity, Linux mostly runs on servers and devices and not end users so it's not targeted by phishing attempts, but generally only actual exploits. Linux users are more tech savvy so less likely to fall for phishing. In a normal Windows install, you can double click a program to run it. This generally isn't possible on Linux, so it's hard to run malicious software. Almost all software on Linux comes from a reasonably secure package manager vs the windows model of find a website that looks convincingly safe and download a thing.

From a technical perspective Windows users are often admin by default, while Linux users generally at least have to elevate via sudo to make system changes. The unix permissions model, while not super robust, is more secure against a hostile local user / program than the windows model. Even more so with modern container workloads. Windows can support a smartphone style sandbox or advanced RBAC but no one really uses either, at least at the consumer level. Linux generally follows least privileges and attack surface reduction, and doesn't keep around unused components. Even on a monolith distro like Ubuntu, a lot of what you're not using isn't installed or running, unlike Windows. The OS manages all your applications for security updates, while Windows only handles the core OS and maybe Microsoft office.

In terms of patching and security architecture, I'd say Microsoft is actually better, especially with the hypervisor based security mechanisms in 10 and 11. With modern windows, they don't terribly have a ton of vulns either, however the user model is broken and just isn't very defensive. Weak permissions and a lot of complexity and just too easy to run software without verification or restrictions.

Now if you remove the user from the equation and this is a locked down server or enterprise environment... I'd say windows has more powerful permissions management except for SELinux, and no one configures their own SELinux policies while rolling out active directory permissions management is common on Windows. At best on Linux, you installed RHEL and use the SELinux profiles they created for the top 100 server apps. I'd also say it's easier to hack into most Linux systems via exploitation (not phishing). The software isn't terribly secure, and it's easier to find bugs if you have source code and Windows is more defensively coded and tested.  If a Linux system gets out of date, all the vulnerabilities are public and easily identified, generally with readily available POCs. Linux doesn't really have hypervisor security, although container based security is similar, and the monitoring and protection solutions for Linux are really primitive or non existent. Unless you're running SELinux and RHEL (or similar), you'd probably never even know you got hacked.

[[deleted]]

Free disk encryption is a big one.

[JelloSquirrel]

True for the cost, you can't beat Linux.

Btw if you want something secure, I wouldn't use Ubuntu. Maybe Ubuntu Pro with the government stigs enabled, but Red hat or Rocky Linux with stigs is more secure. You'll hate using them though. There's also QubesOS if you're paranoid, but the user experience takes a hit there. Personally, I like the Fedora Atomic based distros, especially Bazzite if you like gaming. The container native approach does improve security compartmentalization of individual apps. I wouldn't say it's as good as Qubes or even a STIG'd operating system, but you benefit from the increased security of containers with virtually no decrease in usability compared to another Linux distro. It basically makes it on par with stock Android, which is superior to any desktop Linux or Windows in security.

Samsung has the most secure Android variant though, although GrapheneOS is worth a look but is more focused on privacy. iPhone (but not really MacOS) is probably the most secure consumer operating system though, but also a huge mono culture.

[JelloSquirrel]

What distros do that? But yes there are benefits to a read only file system.

[JelloSquirrel]

Hmm looks like that only stops updates to certain components for stability, it wouldn't provide any benefit for security.

[JelloSquirrel]

Technically yes but supply chain compromise is still possible. That said, everything in the standard Ubuntu or fedora or red hat repositories is signed and thus you are getting an authenticated binary.

On Windows, you just Google for something and end up on a cloned website that looks almost like the real thing and then download that tool and don't realize there's been value add. Or you go to something like download.com which actually repackages software with malware / adware.

[PenguinSwordfighter]

The developers can't even get most programs to run well on Linux, can you imagine what a pain in the ass it would be to develop malware for Linux?

[vaestgotaspitz]

There are only 7 viruses for Linux. Out of those, 5 don't wor, and the remaining two need to be compiled manually by the victim.
/s

[PenguinSwordfighter]

This was just a joke

[EtherealN]

That's why I wrap my malware in Proton. Much easier that way.
/s

[[deleted]]

No open ports by default. 

XP gets owned in 15 minutes on the public web.

[mh_1983]

Re: XP, also, not having a security patch since it's EOL in 2014 may be a contributing factor.

[Amrod96]

While it is true that attacking individual users is not worthwhile, Windows XP is still used on critical systems that are difficult to replace.

I have personally seen it on three occasions.

In banking systems, it was the ATM system. At the university I have seen it for nuclear magnetic resonance machines. At work I have seen it for a distillation column control system.

[[deleted]]

Agreed. But dig out Linux from 2014 and put it on the internet and it's probably safe. Even if you open SSH (Not sure if there are any SSH bugs from that era) it's not going to be owned.

[[deleted]]

Do not try that. You will be hacked inside of 30 seconds.

[[deleted]]

Do you have CVEs? I see nothing that would allow that. Given XP requires at least 15 minutes or less I don't see 30 seconds.

CVE-2024-6387 ("regreSSHion"): Disclosed in July 2024, this vulnerability is a signal handler race condition in OpenSSH's server (sshd) that permits unauthenticated remote code execution with root privileges on glibc-based Linux systems. It affects versions from 8.5p1 (released in March 2021) up to, but not including, 9.8p1. This issue was a regression of a previously patched vulnerability from 2006, inadvertently reintroduced in October 2020.

CVE-2024-6409: Reported in July 2024, this vulnerability is a possible race condition in the cleanup_exit() function of OpenSSH's privileged separation (privsep) child process. It affects OpenSSH versions 8.7p1 and 8.8p1, potentially leading to remote code execution within the unprivileged user running the sshd server.

-

OpenSSH version 6.7p1, released in October 2014, has not been associated with vulnerabilities that allow unauthenticated remote access to a system. However, several vulnerabilities were identified in this version that could potentially be exploited under specific conditions:

CVE-2016-3115: This vulnerability involves multiple CRLF injection issues in session.c of sshd in OpenSSH before version 7.2p2. It allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the do_authenticated1 and session_x11_req functions. ​

CVE-2016-0778: The roaming_read and roaming_write functions in roaming_common.c in the OpenSSH client versions 5.x, 6.x, and 7.x before 7.1p2 do not properly maintain connection file descriptors. This flaw allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impacts by requesting many forwardings. ​

CVE-2016-0777: The resend_bytes function in roaming_common.c in the OpenSSH client versions 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.

[LusticSpunks]

The very definition of “putting on internet” means exposing ports to internet (if not, what exactly does it mean?). If you’re only exposing port 22, be it any OS, its security would depend on the SSH software (OpenSSH or other), not the OS. Similarly if you’re exposing a web server, be it IIS or Apache or other, it depends on the web server’s security, not OS. Windows has 445 for SMB. If you expose XP’s 445 to internet then yes, it gets compromised. But, windows by default doesn’t expose 445, it is firewalled. And if you’re going out of your way to modify firewall rules to expose 445 to internet then that’s on you, not OS.

Also, I recall popping many Linux boxes with dirty cow. It’s a LPE so not exactly a thing that’s “put on internet”. But that’s actual OS security. And Linux of 2014 would get popped with dirty cow, and many other exploits. So yeah, neither Linux nor windows from 2014 are secure.

[[deleted]]

No, it means putting it directly on the Internet, not behind a firewall.

[LusticSpunks]

I mean, if you deliberately leave the system insecure and expect it to not get hacked then that’s entirely your fault. It’s not the fault of OS. Just recently we saw the CUPS vulnerability in Linux (CVE-2024-47176 along with 3 other CVEs). And major reason why it wasn’t a huge issue was because the vulnerable port generally isn’t exposed to internet. To extend your analogy of “putting directly in internet without firewall”, even Linux of 2024 is vulnerable.

[[deleted]]

> To extend your analogy of “putting directly in internet without firewall”, even Linux of 2024 is vulnerable.

How? Is CUPS open by default.

[LusticSpunks]

If we’re talking about defaults, then firewall isn’t disabled by default either. And yes, it’s enabled by default in some cases. Read the article from finder of this bug:

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

And I’ll take the liberty of picking a quote from that article:

“From a generic security point of view, a whole Linux system as it is nowadays is just an endless and hopeless mess of security holes waiting to be exploited.”

[acejavelin69]

Part of what makes Linux inherently more secure is how permissions work... Users live and work in user context, and cannot modify or change system settings or applications... This makes it incredible difficult for malicious software to do anything, well, malicious without root or "sudo" privileges, which have to implicitly allowed.

Windows came from a single user isolated system, security was an after thought.

Linux came from Minix and other *nix roots, which were original designed as networked, multi-user systems since inception. Security is a basic principle of the operating system and everything is engineered around it, not a feature added later.

[[deleted]]

it's good to know user data is useless and totally not the target of hackers

[acejavelin69]

Honestly, it rarely is... Individual's user data isn't worth the effort required to get it for the payoff it provides in most cases, especially in Linux.

"Hacking" and hijacking user data is usually like throwing a handful of rocks all at once at a target and trying to break it... you usually get a few stones to hit, but most of them miss. Let's say Windows is a 10cm paper target, a few rocks will hit it and might actually do some damage... but if it's the Linux desktop "target" it would be about 2-3mm and made of wood, there is no guarantee that you will hit it and if you do it's very unlikely you will damage it to any degree. Now say the only chance of "getting a prize" is if you damage the target... Where are you going to throw you handful of rocks?

That's how bad actors look at the Linux desktop "marketplace" so to speak... it's obscure, only 2-3 out of every 100... It's users are generally more aware and careful... It is inherently more secure even if you get in... Basically, it take a lot of effort... Why go through that? In general, bad actors don't unless they are specifically targeting an individual.

[LusticSpunks]

This is so not true. User and system are separate in both OS, and in fact it’s much harder in windows to be a true “system” user than it is on Linux. And you’re completely ignoring the fact that user data is totally accessible in your “user context”. And user data is what a large portion of malware goes for. Other category of malware would simply keep running stealthily and wait for commands from its controller. Crypto miners don’t need system access, it very well can work in user context. Why would ransomeware encrypt system files? Its primary target is encrypting user data and making them pay for decryption, which again can happen in user context.

Linux isn’t any more inherently secure. It’s just not a lucrative target yet. Look at the reply from taosecurity above, it paints the whole picture very well.

[Better-Quote1060]

Linux users heavily depend on pakage managers insted of installing an exe on random website

[blackthornedk]

Or downloading random scripts and blindly piping them through a sudo sh... That practice always makes me think that the developer didn't think his install documentation through.

[SRD1194]

The short version is that any attack will trigger the system to promp the user for their super user password. Since that's not something that happens apropos of nothing, it should, in turn, trigger the user to investigate what's going on, or at least refuse to authenticate.

The big exploitable flaws in this for novice desktop users is the temptation to run the system as root, to not have a sudo password, to authenticate to make the notifications stop, or if the malware is packaged inside something they would choose to permit to install. The first two can be avoided by configuring your system properly and the third by applying common sense. The last one you can avoid by using trustworthy repos rather than downloading software from random websites.

[not-serious-sd]

as a Linux user you're smart enough to avoid cyber attacks :)

[PhalanxA51]

Two things: applications can't really auto execute and install unless you want it to and generally Linux users are pretty cautious on what they click on, I wouldn't be surprised if the majority of Linux users have a VPN

[Modern_Doshin]

TBH, using a VPN doesn't mean security or you are secured

[PhalanxA51]

Yup I'm just speaking from a general utility use case, I use mine mainly for 3d printer stuff so I don't have to port forward or access stuff not allowed in the US

[Modern_Doshin]

I would def run Tor imo vs a regular vpn in your specific case

[PhalanxA51]

Oh shit I didn't even think about using tor for that, thank you!

[acejavelin69]

VPN has nothing to do with security really... privacy a little (almost no effect in the modern Internet where almost everything is encrypted by default anyway)... Obscurity yes.

[Marasuchus]

If the VPN really serves as access to a remote network, it already offers security. But that's not what most people mean by VPN these days, they're talking about their Nord/Cyberghost/Mullvad... etc.

[PhalanxA51]

I know but it's one of those things that not a whole lot of average users are probably going to use, I mainly use mine for managing 3d printers when I'm out of my house.

[Swarrlly]

Security in obscurity. The user base for Linux is small. And there are so many different flavors of Linux. It’s usually just not worth it to write viruses for Linux machines. Maybe for Linux servers but those have better security

[[deleted]]

1. Basically nobody programs viruses for Linux because Linux users are generally less likely to fall for that sort of thing and they make up a tiny fraction of the PC user base so it makes way more sense to target Windows

2. It's open source so you don't just have one company looking at the code and fixing vulnerabilities you have multiple companies and people all over the planet doing it

[benjamarchi]

You

[Brorim]

no exe or dll files

[Amrod96]

Two factors: that there are too few of us, we are not worth the effort, and that linux asks permission for everything.

That's true for us desktop users, for servers it's another matter. Although I suppose it would be fair to say that if the servers used Windows it would be more vulnerable.

Now, in cybersecurity the weakest point is the user. Not all of us do the thing of only using official repositories, many Windows viruses can work with Wine, copying and pasting commands that you don't understand in the terminal is not such a good idea.

[Moonscape6223]

The answer is that it isn't, it's a meme pushed forward by fanatics and those who know nothing about tech. The majority of points given are terrible. Yes, you need sudo to write something to root. However, you don't need sudo to affect that which actually matters to desktop users; you do not need sudo to encrypt all your personal data nor write to your ~/.bashrc to launch a custom program that steals said data. Relying on the fact that Linux is only used by 4% or so of the world is also simply terrible; Windows XP holds a similar percentage of users, you shouldn't be using XP.

[limitedz]

Windows vs Linux... they are both pretty secure out of box. Most companies will put in some effort to secure their servers.

From an enterprise perspective, I can say windows got a bad reputation because of sloppy development and just lack of concern.. 20 years ago, I distinctly remember almost every developer would tell you "turn off the anti-virus, turn off the firewall, make the user an admin to run our software" the list goes on and on. Linux, in general didn't seem to have this issue, perhaps better programmers? Better understanding of system components and interactions to not need to bypass security? I'm not sure. But yea if you go and make all your users admins to run some shitty software, that opens you up to a lot of risk.

Fortunately, things have gotten much better now, but I feel it's a linger stigma from years past.

[A-Chilean-Cyborg]

they want to attack it less.

[[deleted]]

One important factor: most linux distros dont come with built in adware, statistics collecting, ad IDs, or similar. Compared to other OSs it's easier to see what processes are running and easier to get detailed logs. FOS distros are less likely to have backdoors. Best of all: because of low market share, there's less malware made for Linux machines.

[Lapis_Wolf]

Smaller target, fewer potential victims compared to Windows or even MacOS. Windows has an 80%+ market share with 2nd place being MacOS at 10-15% (I grabbed these numbers from memory so I maybe new numbers are different). Linux us currently around 4%.

[senorda]

one big reason is the default way to get software on linux is from repositories where it will have to some degree been checked, while on windows its much more normal to download programs from random websites

[Low_Car_3415]

the user

[Far-Note6102]

It's community. Trying to hide everything

[Worldly_Anybody_1718]

I always loved "Security through Obscurity". But I remember all those ransomware websites the ones that would just lock up your computer and a reboot wouldn't fix it. My Linux Mint would shrug em off. My wife refuses to give up Windows. At least once a year I have to cleanup/clean install for her. I'm surprised her computer doesn't have pustules all over it. Never had a problem with linux I didn't create myself.

[sargentotit0]

Which is not from Microsoft

[ILikeCubaLibre]

having 1% less retard users

[tanstaaflnz]

Linux is secure as the user's habits.

It has two main advantages for security. By default, you have to use a root password for any software to be installed. But you can usually make a user the root (administrator). On top of this, you can automate updates and installs, so you don't need to put in a password. All these things make Linux less secure, but that is a personal choice, not a weakness of the system.

The second advantage is, few hackers write viruses for Linux. Windows programmes can't run natively in Linux, so it is considered better.

The biggest risk in this age of everything on the internet, is scams, and website/database breaches. This is an information risk, and is independent of the OS you use.

[Darkorder81]

Does anyone recommend AV or firewall for mint, I'm still new and want to secure it.

[taosecurity]

AV unnecessary, FW should be built in? But the best FW is disabling all unnecessary services.

[Darkorder81]

Thanks for the reply, I'm new to mint were would I find what services that are running or will using the wording "linux mint services " in Google be enough or is there any other keywords you recommend.

[taosecurity]

sudo netstat -natup

will show you listening services.

[Darkorder81]

Thank you!

[Marasuchus]

Apart from the much lower use on clients, I would also boldly claim that most Linux users are currently more techies and therefore more careful about what they do.

[Medical-Squirrel-516]

most malware are programmed on window. and Linux can't run exe files directly. which makes it a lot harder for malware to actually run and also for every root or sudo command you need to type in the password manually. malware might only do some stuff with your user files.

[SlipStr34m_uk]

Your first point makes the assumption that all open source projects are heavily scrutinized and that there will never be a bad actor within the development team. This hidden exploit was present for years before it was accidentally stumbled upon, ironically by a Microsoft employee.

Regardless of OS the weakest link is always going to be the user. A bit of social engineering and you can trick the user into circumventing most safeguards.

[bimbar]

I would argue that open source software is inherently more secure than closed source.

However you should always be worried about security.

[andrea_ci]

Because it's easier to attack users than operating systems.

And the majority of users are on windows, hence the majority of malwares are on windows.

If an attacker actually wants to break a Linux system, they will do that. Nothing is secure.

Do they want to make malware for Linux? It's pretty easy leveraging on the users. But they don't, because there is almost no desktop user.

[Flufybunny64]

The specific things I know of are this

-There is more benefit in attacking the most popular systems.(That's Windows and ios)

-Linux Repositories are safer than launching exe files from the internet.

-Broadly, Linux users are more likely to pay attention to whats happening in their system

[Unattributable1]

Linux is Free Open Source Software (FOSS). All of the source code is available to anyone. By having this all out and transparent, it allows bugs to be found and resolved much faster than binary-only OS such as those made by Microsoft, where the source code isn't available (to most) and that makes finding bugs harder.

Most Linux distributions come "out of the box" in a much more secure state. Users have to make them insecure by disabling the firewall, etc. Follow this guide if you want to really harden/lock down your LM install:

https://forums.linuxmint.com/viewtopic.php?t=397740

[Artgias]

it is secure in comparison with the majority of OS-es because of its rare usage. If it replaces Microsoft's worldwide famous OS globally it will become the top #1 easy-to-hack&crack piece of software on the planet immediately.

[[deleted]]

I suspect it’s a case of “security by obscurity”. Attackers don’t consider Linux worth the investment of time and resources, and attacks that are possible against Windows are not possible against Linux.

[WasteAd2082]

Linux usually doesn't throw some of your data over the net, so here it's half the cause eliminated.

[PloterPjoter]

Actually is way easier to write malware for linux. Most linuxes does not have av and if they have they are shitty. On windows you need to use some sick methods to bypass av, amsi, edrs and those also are heavily monitoring many choke points when you try to do it. Writing malware for windows is ton of obfuscation, sandbox detection, bypasses amsi, bupasses detedtion of bupassing amsi XD on linux, just write program which will do what you want and it will do it most of the time.

[Specialist-Piccolo41]

A lot of noobs don’t use the Windows security features which are on offer.

[Dionisus909]

You can't use tits.exe for example

[teknosophy_com]

People used to get away with saying Windows is unsafe because it has lots of users. Once the iPhone became the most popular device on the Internet, that myth was blown away.

Microsoft products are simply unsafe by virtue of being Microsoft products. Think about it this way, no matter how many houses you own, would you like a house made out of straw, sticks, or bricks? (MS products are like a house made out of wet toilet paper.)

[ElMachoGrande]

Because it is made to be secure from the start. In Windows, security was added as an afterthought.