2

On a non-international forum I was reading a discussion about using an Antivirus on Linux Desktops. There are two opinions:

1. Anti-Virus is best-practise regardless of the OS used
2. Anti-Virus on Linux does more harm than good

Now most of the answers there are primary opinion based. However one argument that keeps getting used is that there is a real danger in having an AV on Linux because it has to run as root. I personally do not really see why this in itself is such a big security risk, assuming you install a 'legit' antivirus. I am having trouble seperating the opinions with 'facts' about the risks of Linux AV.

What are the real risks of installing an AV on a Linux Desktop?

Improve this question
2
  • See also Should I get an antivirus for Ubuntu?
    – Sjoerd
    Commented Jun 21, 2018 at 10:10
  • @Sjoerd feel free to correct me if Im wrong, but this seems to hint more to: Are there virusses for Ubuntu?
    – toom
    Commented Jun 21, 2018 at 10:13

1 Answer 1

Reset to default
11

AV pros:

  • Can detect old viruses
  • Sometimes can detect recent viruses (depending on vendor detection/update time)
  • Sometimes can proactively detect viruses and alert to a suspicious activity

AV cons:

  • Do contain bugs (all software does) and run with high privilege level, sometimes exploitable.
  • Usually consist of megabytes of closed-source, really complex (parsers for tens of file formats, process monitoring, etc...) code that you run as root.
  • Demand trust in vendor, vendor's internal security architecture, vendor-generated SSL certificate for https web AV functionality, ...
  • Slow down your system
  • Do close to nothing against qualified attacker or targeted attack.

I tried to be objective, but my bias is clear. AV can protect against CoolPhoto.jpg.exe email attachments, but if you are advanced enough to run Linux on the desktop then you do not need that protection.

Improve this answer
1
  • 4
    I think this is a fairly objective post. Given that virtually any programmer can write a virus that is not detected by AV in 10 minutes is testament to the fact that AV is only good for known samples or very, very badly written malware. I wrote an answer similar to yours on another post, elaborating on the downsides to antivirus (although it was not specific to Linux). I came to the same conclusions you did.
    – forest
    Commented Jun 25, 2018 at 2:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .