this post was submitted on 08 Oct 2025
36 points (95.0% liked)
Linux
58969 readers
928 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 6 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I think most Linux distros will be fine. As of today desktop marketshare is still small, the governments mostly work within custom business applications. And to this date Linux malware and viruses for the desktop are practically unheard of. The common attacks are against the browsers, not the underlying operating system (so do timely updates and install an adblocker) or we'd expect phishing or phone scams and that's against the human in front of the computer, again not the operating system. That makes me say they're about all alright. Of course they're not all equal. Immutable distros and sandboxing will help here. But the real deal is other countermeasures, like be aware how phishing works and try not to mix online banking and pirating games from shady websites. That belongs on separate user accounts or even installed operating systems. And use password managers, 2 factor authentication and these things. (And don't use Edge, or some browser from some random third-party repository.)
This is dangerously false.
edit: I'm sorry to see I have disturbed a few people here, downvoting the truth without a comment. Explains a lot of contemporary politics, I think.
Can I get some list or a reference to educate myself? As far as I know it still holds true. There's rootkits, a lot of old stuff and exploits of webservers or embedded devices, supply chain attacks towards developers and the one day the Mint ISO file got compromised. But I'm completely unaware of desktop computer malware with high risk or actually spreading?! And the list on Wikipedia seems to confirm what i said...
Okay, let's assume for fun that there's highly developed Linux malware that exclusively infects servers and leaves desktops alone. What exactly is a server? Is it a server as soon as a web server service is running? A DNS service? An SMTP service? Some of these are also included with Linux desktops.
But that's not the point. There's no specific "Linux server malware". There's Linux malware. It targets the Linux kernel (current data point), not any web stuff.
For example it's something that has an Apache webserver installed and that Apache is accessible from outside... So the Apache exploit can do something. Do you have both conditions met on your laptop/desktop computer? I'm pretty sure that won't be the case, and that's the difference here. And yes, that's specific.
Let me repeat my last paragraph, as you seem to have stopped reading after the first question mark:
You're wrong. How would an Apache exploit "hack" your Steam or online banking app? That's just not possible.
How would something that exploits the default password on a router infect my machine with a different password?
Malware uses specific attack vectors and specific vulnerabilities.
The "specific vulnerabilities" are usually in the Linux kernel, quite present on every single Linux system. Please follow the link I posted above. This is not about Apache or any other arbitrary user-facing software.
Thanks for the link. But that's not a vulnerability or malware. It's academic research how to hide malicious syscalls. But it can't infect anyone's computer. And there isn't any vulnerability to let it in.
The RingReaper malware is literally a malware, using known vulnerabilities in the Linux kernel...?!
I'm sorry. Most I can find about "RingReaper" is that single blog post or people who rephrased it into their own articles. There seems to be zero information on how it spreads through the internet? And if anyone contracted RingReaper. And I can't even discern how that'd get on someone's computer unless they install it themselves (which is a form of malware, though not very pronounced on linux due to the distributions and central package repositories). There are no other methods highlighted in the post. And it can't do privilege escalation either, just scan for other vulnerabilities. So is this a thing in reality and how can I find out? It seems like valid research to me, but I can't see how it's more than that... What I mean is, I can see how someone put the word "malware" in the title. But that in itself doesn't really threaten my (or OP's dad's computer).
It is one of several things in reality. Linux malware, spreading through the (mostly) same paths as Windows malware does, has been real for quite some time now.
Linux malware threatens Linux computers. It might be important to keep that in mind if you use Linux.
Did you read the article? This Ringreaper thing is a method to hide something. It doesn't have any means to infect a system. And it doesn't really do anything except hide itself. It doesn't delete your files, it doesn't steal your passwords... It doesn't spread... It's not really what you think it is.
Edit: And congratulations for going back and appending your first comment with the wild claim you own the truth. I'm pretty sure people here downvote you because there's almost no truth in what you spread here. I'd be willing to listen, but you don't have any example to back it up. Instead you ramble on how servers are supposed to be desktop computers and attacks target the kernel instead of userspace applications... None of that is true. Sorry I'm not deliberately trying to be mean or hostile. But that's how it is.
Can you explain how its mailware and spreads? The article doesn't say anything except how it hides its calls.
I guess the problem is not “the truth” but a claim without sources combined with a short communication style for a really complex matter.
Even the link you posted just reporte of one malware instead of the current state or perception of the problem. Like a general threat assessment instead of one incident.
This is dangerously unspecific.
https://linuxsecurity.com/features/ringreaper-linux-malware
Thank you!
I add this overview article https://www.geeksforgeeks.org/ethical-hacking/what-is-linux-malware/
I don't think OP's dad will host a misconfigured cloud service on their computer or set an insecure password, enable ssh and then also open a port in the router. Most attacks on that list are specific to how internet servers are set up. And well, insecure old embedded devices. And we in fact have those systems targeted regularly. My servers gets bombarded with malicious traffic trying to get in.
Yes. That is part of the insight. But the auto upgrade is a good practice for Desktop PCs, too. And the article shows, that there are vectors and counter measures. Root kits are known for ages.
Sure. We get security vulnerabilities in Chrome and Firefox all the time. Sometimes the libraries handling images are vulnerable and that's a big issue. And zero-days are a small fraction of actual attacks, most likely you're getting hacked because of old, vulnerable software. So updates are the first priority. And backups is something people also frequently forget to set up.
Good point. To get back to the original question, I wouldn't change the distro unless they are known to be slow with security updates. Anything debian and ubuntu based should work just fine.
Regarding your edit:
Having read through the comment chains here, your source is a relatively new malware called RingReaper.
This article from cybersecurity news seemed nice and they linked to the actual PICUS security report which first identified the malware, I think.
I'm not sure whether this malware is actually used to infect Linux desktops or if it's mostly used for infecting servers, or whether it is used at all. I agree that people shouldn't let their guard down with malware on Linux. Anti-malware programs on Linux are a good idea and it seems there are already projects tracking and combating malware on Linux. I do agree that Linux malware is not unheard of.
Nonetheless you seem to over exaggerate a bit. There is malware attacking servers running Linux but I doubt that many of those would work on desktop Linux. Furthermore, desktop share of Linux is still low, so there won't be a big incentive for malicious actors to target Linux desktops specifically. The comments you posted here seem more like paranoia to me and do not seem useful, and your single example of a Linux kernel virus seems more like a derailment of the conversation. With that I can understand the downvotes. Don't take it too harsh either, no need for your witty comment:
lol
Linux kernel malware works just well on desktop Linux kernels, and that's the majority of Linux malware.
Honestly, when it comes to computer security, "paranoia" is a harsh word for being aware of possible risks. (It's been 12 years "since Snowden", and people have already forgot, it seems.) Even Windows desktops are not under constant attack, but still there are reasons to maybe take security measurements on them before you can call them "secure". And that applies just as well to Linux.