Android adware

Zscaler ThreatLab has a interesting report on adware in Android, and the discrepancy in detection rates between AV companies.

Google has plenty of incentive to allow apps with aggressive advertising practices. AV vendors on the other hand have no such incentive but are instead under pressure to show that they are adding value by identifying malicious/suspicious/unwanted content. As such, there is a big gap between Google and AV vendors when it comes to adware. Ultimately, end users are stuck in the middle as they are left to decide if they will keep or delete the apps being flagged.

Zscaler reference Lookout in creating a definition of unacceptable behaviour in adware:

• Harvests excessive personally identifiable information
• Performs unexpected actions in response to ad clicks without appropriate user consent (appropriate user consent entails providing a clear alert in the application that the user can accept or decline before any behavior takes place)
• Collects IMEI numbers, UDIDs or MAC addresses
• Initiating phone calls and SMS messages
• Changing wallpaper and ringtones
• Leaks location information
• Leaks email addresses
• Leaks personal information such as contacts, birthdays, calendar appointments, etc

At the moment, as the Zscaler report highlights, Google may be allowing apps that exhibit unacceptable behaviour on Google Play, but AV companies are not consistent in their definition of what constitutes unacceptable behaviour, and it is left to the user to make a decision about what to install.

In relevant other news, Google has acquired VirusTotal, which, coincidentally or not, is now available as an Android app, so the paranoid Android user may check to see if any AV company detects their apps as adware or other malware.

Hat tip: GOT2.ME

Linux Banking Trojan

With Windows computers beset with banking Trojans, and Linux seen as a secure alternative, it was never going to be long before similar malware appeared for Linux: the user base may be small, but with those users doing their banking on Linux, the reward was likely to be worth the effort.

The RSA blog has the story of the Hand of Thief Linux banking Trojan.

The Trojan's sales agent (yes, there is such a person) has very kindly let Linux users who bank online know what to watch out for.

[I]n a conversation with the malware’s sales agent, he himself suggested using email and social engineering as the infection vector.

I suppose the usual suspects will claim that this shows the need for an anti-virus program on Linux (again), but I still don't believe that is necessary. Not installing Linux executables from untrusted sources remains the key to security, and I have no information yet about detection rates for this Trojan.

Update: the avast! Blog has an analysis of the Trojan,  with links to a VirusTotal analysis, showing which AV programs detect the malware (avast! being one , of course).

Trojan Horse for Linux?

I came across this post on the avast! forum recently. Trojan Horse for Linux, it declares. OK, it's Symantec that called it a Trojan Horse, but wrong: it's a malicious Apache Module.

Yes, Linux malware does exist. Who should be worried? In this case, administrators of Linux servers, as the attack vector of this malware is unknown, and it seems to have been placed on servers with good security.

This is not a Trojan Horse that desktop users of Linux are going to have to worry about downloading from the internet.

I recently wrote that Desktop Linux needs anti-virus like a fish needs a bicycle. I'm glad I put that "Desktop" in there. Virus programs like Symantec and ESET do detect this malware. This VirusTotal result I found suggested that the detection rate among anti-virus programs is pretty good. An anti-virus scan of a server may pick up a hack like this.

But I'm writing for users of Desktop Linux. The existence of a targeted hack against Linux servers or the existence of Linux malware on servers is not reason for desktop Linux users to worry.

When it is time to worry, you'll read it here.

Desktop Linux needs anti-virus like a fish needs a bicycle

You don't need an anti-virus program on Linux: I've said it before, but Don't Surf in the Nude started because of an interest in internet security, so I can't resist trying out anti-virus programs in Linux.

I noticed today that Comodo has produced a Linux anti-virus program with real-time scanning. Files are checked as they are accessed or created- for example as they are downloaded from the Internet.

I couldn't resist trying it out. They've created the Windows AV experience on Linux, but like crime in multi-storey car parks, it's wrong on so many levels.

When you install the package, you're faced with a long User License Agreement in the Terminal. If, like me, you're tempted to scroll through the I-agree-to-sell-my-soul-to-the-devil script by pressing enter, you find you've accepted and the installation program is running.

Run the installation script as requested and you see various kernel modules installed. As I found out later, they are not removed by uninstalling the package.

After downloading the 100MB of virus definitions, the Windows AV experience is complete. A lengthy scan of system files (Linux AVs usually only scan user space) found no viruses.

Real-time scanning works: I tried downloading the Eicar test virus only for Comodo to warm me that it was a virus.

This is actually a very well made bicycle, but that doesn't alter the fact that fish don't need bicycles. Why? Because I'm not downloading suspect files form the internet and trying to install them. The thing is to make this switch to being an aquatic craniate rather than buying a bicycle because you think you still have limbs.

Now to try and remove those kernel modules.

Do I need an Anti-virus program on Linux?

This is a question often asked by new users of Linux. (See here.) The short answer often given is no, but that answer often stirs controversy. (See here.)
I haven't used an anti-virus program in Linux for years (although I've tried all the free ones). My answer to the question, as a home user of Linux only computers who doesn't share files with Windows users is also no. Obviously I've caveated that answer, and there are plenty more caveats, so here are some points to beware.

• Saying that you don't need an anti-virus doesn't mean that Linux malware doesn't exist. It does.
• Saying that you don't need an anti-virus doesn't mean that you don't need to be careful about security in Linux. You do.
• For new users of Linux, that attention to security means getting software from the distributions digitally signed software repository, or trusted sources. (For example, I have installed software from Opera and HP in addition to software from the Debian repository.) This guide is not intended for or likely to be useful to more advanced users of Linux.
• Linux malware exists, but Linux users are very unlikely to encounter it. Don't go downloading packages form the internet and you won't. (Obviously, with so much free software available in distribution repositories, Linux users won't be on crack sites or peer-to-peer networks downloading dodgy executables that claim to unlock Windows programs.)
• Most Linux anti-virus programs don't do the background scanning of files that Windows anti-virus programs do. If you want to scan a file, you have to do it manually.
• Why use one installed scanner to scan a file when you could send it to Virustotal and have 30 or so scanner check it? (And please see the point above about not downloading packages from untrusted sources in the first place.)
• Linux users are simply not affected by the web-borne exploits that install software willy-nilly on Windows systems.
• Most Linux anti-viruses are primarily intended for file servers, not desktop environments. Yes, an anti-virus is recommended in that situation- beyond the scope of this simple guide. But if you have a dual partition with Windows, or share files with Windows users, yes, an anti-virus is useful- but you'll be looking for Windows viruses.
• There is no certainty that anti-virus programs will detect a malicious file, as I demonstrated here and here.
• Linux anti-virus programs are meant as file scanners, not system scanners- scanning the /root (system) directory is likely to result in a lot of frightening warnings (for the new user) which actually don't indicate any sort of infection. See here and here.
• Institutional network users running Linux may well be asked to use an anti-virus program- I'm not here to contradict your system administrator. Mostly the concern is that Linux users will pass Windows malware around. But there is also the possibility that these users will have valuable information and may be targeted by criminals- and receive a Linux Trojan in their email inbox, for example.
• Where untrusted and possibly malicious people have physical access to a computer, there is the possibility that they may try to run malicious software. This area is outside my experience. Untrusted people don't use my computer. In institutional situations like this, the answer may be yes, an anti-virus might be a good idea. Listen to your system administrator or consult a more advanced guide.
• Most of the people advising that home users of Linux need an anti-virus program are Microsoft shills spreading FUD. The idea that you can run a computer connected to the internet without anti-virus protection or risk of infection tempts users away from Windows, and Microsoft has never been above a little black propaganda. More importantly, these people don't actually look at the evidence when they tell you it's not safe to run Linux without an anti-virus.

Secure that PC!

I really should change the title of this blog, as the title refers to computer security. Since buying a router and switching to Linux, I really haven't been that interested in the topic- my PC sits behind the router firewall and it's not vulnerable to Windows malware.
But today a couple of web pages caught my eye. The first was this page, a collection of anti-virus tests and and an attempt to collate the results. How useful the exercise is, is moot, but this test caught my eye. Partly because it's a review sponsored by Norton in which Norton comes out top (dubious) but mainly because it tests AV products on Windows XP SP2 with Internet Explorer 6 (even more dubious). That not even SP2 updated, that's SP2 as it was when it came out without any updates- by now as full of security vulnerabilities which can be levered to install malware as Swiss cheese is full of holes.
I would like to have seen the results obtained if the testers had used XP SP3 fully updated with IE8 or an alternative browser. My guess is that the system wouldn't have been infected even without any AV present, but that's not what Norton or any other AV company want you to hear.
Krebs on Security, the second page to catch my eye today, makes the point that it's often the non-Windows applications that are a security threat on Windows PCs:

A study released earlier this year found that the average Windows user has software from 22 vendors on her PC, and needs to install a new security update roughly every five days in order to use these programs safely.

Linux has the advantage here, because the popular Linux distros check most applications the user is likely to install on the computer to see if they are up to date; windows leaves third-party software unchecked- a nightmare until applications like Secunia came along.
(The main point of the article is that vulnerability counts don't mean anything by themselves- a very sensible point.)
The first line of defence on a Windows computer is ensuring that applications are kept up-to-date and secure, and , if necessary, avoiding applications with a poor security record, as Krebs has suggested in the past.
The second is probably ensuring users don't have admin rights, as Krebs has again suggested several times.
An AV is probably a good third line of defence. This is where those comparative tests come in. If the collation above has any merit, Panda, Avira, Avast! and AVG are the best free options.

How useful is anti-virus in Linux? (Part 2)

In Part 1 I wrote about Linux malware found in a screensaver. In this post, I'm going to talk about a more recent story of a Trojan horse found in a Linux distribution. The story was picked up with glee by Ed Bott:

Every time I write about Windows security software, I get a predictable flood of responses from Linux advocates who claim that they don’t need any such protection. Today comes a shining example of why they’re wrong.

Then Adrian Kingsley-Hughes jumped on the FUD wagon. So should Linux users all be installing anti-virus software? I decided to investigate. With a bit of searching, I found an analysis of the malware script concerned. Submitting the script to VirusTotal produced no detections, but I'd found this blog post from Sophos describing how they detect the malware as Troj/UnIRC-A. Another analysis suggested the malicious package was still available for download. I checked, and it was. The file had already been submitted to VirusTotal in February 2010, when there had been four detections. (A reanalysis didn't produce any more.)



Despite the rather gloating blog from Sophos above, they only added their detection for this malware on the day the story broke. F-Secure added their detection the day after. I don't know when Comodo and Panda added their detections, but I'm guessing they too added their detections after the story broke.

So should Linux users be installing anti-virus products, and combing their systems for malware? There are two points to make here:

• There's no evidence that any anti-virus product would have detected this malware before it was discovered and reported.
• Well over a month after the malware was discovered, it's detected by a tiny minority of anti-virus programs.

The real moral of the story seems to be (as the Sophos blog points out) for administrators to check signatures and checksums of files when using a distro like Gentoo. [Some background I picked up reading the comments sections of various articles about the story: Gentoo is a far from mainstream distro which requires users to compile everything from tarballs.]
In more mainstream distros, software in repositories is digitally signed by the developer, so it is not possible for a package to be replaced with malware. When enabling additional repositories, or trusted third-part repositories, always may sure the appropriate key is installed so software can be authenticated. The following warning means the appropriate key has not been installed, and you are at risk of installing a possibly insecure passage:

You are about to install software that can’t be authenticated! Doing this could allow a malicious individual to damage or take control of your system.

See here for an example.

How useful is anti-virus in Linux? (Part 1)

In almost three years of using Linux, I've never come across any Linux malware.
I have come across two tales of Linux malware. I'm revisiting them now to ask: do these stories suggest that using anti-virus software is necessary or advantageous?
In December 2009, malware was found inside a screensaver on gnome-look.org. The malware was a "script with elevated privileges designed to perform a DDoS attack as well as keep itself updated via downloads".
The moral of the story was clear: don't install software packages from untrusted sources.
The malware script can be found in the Ubuntu forum post linked to in the story above, so I decided to save the script as a text file and send it to VirusTotal, to see how many if any anti-virus programs detect it. I found that somebody had already done this, a couple of days after the malware was discovered, and that no anti-virus program at VirusTotal had detected the script at that time.

I then hit the 'Reanalyse' button to see what the result would be seven months later.


This time, eight anti-virus programs detected the script as malicious.
The two points that can be made here are:

• None of the anti-virus products on VirusTotal (which is most of 'em) would have detected this script as malware during the time it was available to download.
• Even seven months later, only a small number of anti-virus programs would detect this malicious script.

To answer the question: is using anti-virus software necessary or advantageous in Linux? In the case of new Linux malware at least, the answer seems to be that anti-virus software has nothing to offer- caution remains the key.

I've got a fever- it must be a virus!

I used to be an anti-malware expert when I used Windows- I could tell you the relative merits of anti-virus programs, anti-spyware programs, anti-Trojan programs, rootkit detectors and firewalls.
I now run Linux with no anti-virus, or indeed any sort of security suite, scanner or intrusion detection program.
This is not actually because I discovered Linux is much more secure, rather because, coincidentally around the time I started using Linux, I realised that anti-malware programs aren't really necessary in Windows, or perhaps more accurately, aren't that effective.
I was reminded of this by a post on KrebsonSecurity, written by one of the best reporters on malware and cybercrime. The gist of the report is: don't rely on anti-virus software to protect you from Windows malware. There are lots of comments on the page questioning the value of the research cited in the post, but I have to say it jibes with my experience of Windows malware: any anti-virus has only about a 20-60% chance of catching new malware, and only a 40-90% chance of catching old malware. The graphic below doesn't reveal the best and the worst of anti-virus programs, but honestly, it doesn't matter that much.














There are also several comments on the blog post about how malware can now persist even after an operating system reinstall, so basically, if you get a "virus", you're going to be buying a new computer, which, although they carry a grain of truth, are basically tin-foil hat paranoid nonsense.
There's no guarantee that an anti-virus program will protect you from malware, indeed, a 10-80% chance that it won't. What you need to do in Windows is learn to recognise and avoid viruses. Now a long article on how to do this is beyond the scope of this post, but for a start, make sure all web-facing software is up to date. (Secunia can help here.) Honestly, armed with up-to-date software and a knowledable user, your computer is going to laugh in that face of malware!
This is not to say that I wouldn't use an anti-virus program in Windows- I'd always have one running. My personal choice would be avast!, Avira, maybe Panda- because they are free. I wouldn't pay for an anti-virus (for private use) because they are really only a second or third line of defence. (Of course, in a commercial/institutional environment, where you have all and sundry using your system, this doesn't apply.)
Linux can have a big advantage here, in that assuming your distro of choice has a package manager, it will tell you about any web-facing software that needs updating for security reasons. A old version of Flash, Adobe or Firefox allowing a drive-by download is less of a risk. (Not to mention zero-day exploits in Internet Explorer.)
Malware is not an issue Linux users can ignore, as this report proves. But Ed Bott's report also illustrates how the paranoia of Windows users tries to infect Linux users. Are Linux repositories infected? Should Linux users now be scouring their machines for malware? No. This was an issue with one distro. Most Linux distros insist on package signing, which would have prevented this attack.
Relax! Don't panic! It's still possible to connect a computer to the internet without getting pwned, Linux or Windows.

Anti-virus in the cloud

My anti-virus solution has long been in the cloud. When I suspect I have found a virus, I upload it to Virustotal for analysis. For example, when I transferred a file from a colleague's laptop to my own at work, a quick look in the target directory revealed some files that were pretty obviously viruses. As my laptop was running Ubuntu, I wasn't concerned about infection. Later on, I checked out the files at Virustotal and they were indeed malware. There are anti-virus scanners for Linux, but Virustotal indicated that none of these (Antivir, avast!. AVG, Clam) would have picked up all the infected files- and of course, Linux can't be infected by Windows malware, so the best place for malware analysis for me is in the cloud.
But this is not really what anti-virus in the cloud means. In the cloud anti-virus model, files are analysed by multiple anti-virus engines at a remote location on a network (the "cloud"), but this is done without sending every file across the network. Computer files may be many megabytes in size, and sending each file across a network would be prohibitive in time and bandwidth. Instead the cloud anti-virus creates a hash of each file (just a few Kb in size) and sends that to the remote site. If the hash is recognised by the remote scanning system, it is reported as safe; if it is not recognised, the file is sent across the network and analysed. If it is found to be a virus, the hash is added to the database and any subsequent computer sending the same hash will know the file is malicious almost instantaneously.








(Image from usenix.com)

This method has the advantage that a large definition file does not have to be stored on the local computer, that new detections are added to the central virus definitions database instantly, and that any virus scanning is done on the remote system and does not use processing power on the local computer. In the original cloud anti-virus system, described in the paper CloudAV: N-Version Antivirus in the Network Cloud, unknown files were analysed on the remote system by multiple anti-virus engines: Avast, AVG, BitDefender, ClamAV, F-Prot, F-Secure, Kaspersky, McAfee, Symantec, and Trend Micro- as well as a couple of 'behavioural engines'.
This must be the ideal system for detecting viruses- utilising the power of the best anti-virus engines together- but of course there's a problem. This system was only built to test an academic model and was not a commercial anti-virus solution. Individual anti-virus companies would never licence their engine to work for a rival's cloud anti-virus.
A commercial cloud anti-virus would still have the advantage of not relying on a local virus definitions database which can take hours or days to update, but would have to rely on the virus detection rate of the anti-virus engine on the central system.
How to have the advantages of an anti-virus without local definitions and harness the power of multiple anti-virus engines?
Immunet has a clever answer: have your cloud anti-virus program sit alongside other anti-virus programs and report to you when they make a detection! That file is then available to you and can be added to your database of detections. This is not to say Immunet does not add its own detections- it claims to use web crawling, honeypots, generic and contextual detections, and has recently teamed up with Clam for Windows to add Clam's engine and detections database to its system. (More on Imuunet here.)
I have no information on detection rates yet, but Immunet/Clam for Windows seems to run well alongside other anti-virus products and may even be good enough to run alone- its small footprint will certainly appeal to users whose systems have been 'bogged down' by traditional anti-virus programs. I'm currently trialing it on my Windows partition (which admittedly doesn't get much use) as sole anti-virus protection. There seems to be some possibility that cloud technology may be added to the Linux version of Clam.

We are currently investigating the possibilities for using Immunet’s Cloud technology in the *nix version of ClamAV. Once ClamAV 0.96 releases and is integrated into the ClamAV for Windows distribution for offline scanning we will begin planning the next phase of integration. This will hopefully include some integration of the Cloud technologies in the *nix version of ClamAV.

Another cloud anti-virus product is available from Panda Security. It apparently has excellent detection rates, but I'm wary of trying it after hearing of alleged links between the company and the cult of Scientology.
More information about Immunet/ClamAV for Windows cloud anti-virus and links to comparisons with Panda CloudAV can be found on the avast! forum.
UPDATE: Panda has apparently distanced itself from Scientology.

Control of Panda Security was transferred to a group of investment funds led by Investindustrial in 2007, since when the firm has embarked on a plan of expanding its international footprint outside its traditional sales base in continental Europe. Panda's founder and former chief, Mikel Urizarbarrena, stepped down at that point and sold 75 per cent of the business, allowing the firm to distance itself from Urizarbarrena's controversial faith in Scientology.

UPDATE2: An interesting comment from a developer of a 'traditional' AV program:

My specific objection against these "new" in-the-cloud AV's is that they shamelessly parasite on the existing AV vendors who spent decades of R&D on getting where they are.

I mean, what most of these home-grown clouds do is basically run each of the files through a dozen of AV scanners (in the cloud) and if at least some of them detect something, report the file as infected.

UPDATE3: Brian Krebs writes on Immunet.

UPDATE4: Immunet no longer picks up the detections of anti-virus programs it runs alongside, according to a post on the avast! forum which purports to be from an Immunet representative.