this post was submitted on 19 Nov 2023
704 points (90.6% liked)
linuxmemes
21436 readers
1371 users here now
Hint: :q!
Sister communities:
Community rules (click to expand)
1. Follow the site-wide rules
- Instance-wide TOS: https://legal.lemmy.world/tos/
- Lemmy code of conduct: https://join-lemmy.org/docs/code_of_conduct.html
2. Be civil
- Understand the difference between a joke and an insult.
- Do not harrass or attack members of the community for any reason.
- Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
- Bigotry will not be tolerated.
- These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
3. Post Linux-related content
- Including Unix and BSD.
- Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of
sudoin Windows. - No porn. Even if you watch it on a Linux machine.
4. No recent reposts
- Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.
Please report posts and comments that break these rules!
Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't fork-bomb your computer.
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
https://en.wikipedia.org/wiki/Linux_malware
I fucking hate the mentality that Linux is somehow completely safe.
Just because it isn't attacked as much because of the low adoption rate among users, doesn't mean it has no vulnerabilities.
With SteamOS and ChromeOS now having millions of users, Linux attacks will become more commonplace.
IIRC ChromeOS is either built on or can be configured to run applications like a Linux distro?
Yes, so Linux better be ready, because those attacks will increase.
And sentiments like the one from OP don't help one bit.
Malware for desktop users is the low hanging fruit with little rewards. You just hear about it because it's so rediculous easy.
The real money is on servers, so that's were real money/work is invested to develop malware for much higher gains. How successful are they again?
I think you're right. A single desktop, unless it is either someone in a position of power or access to trade secret files, is not a time effective attack vector.
A server on the other hand can access all of that stuff across an entire organization.
Of course not. There is a market for investing very little for some cheap malware and then putting it out there, waiting for the small amount of people (out of a billion of desptop users) falling for it. Also you go for the weakest link in defense, so scamming random desktop users is rarely a technical feat. It usually exploits the human, not the system.
But we also all know how money is actually distributed. So millions of random users being scammed for some money is still not the high reward scenario a server is. Much more work is invested there because the rewards are so much higher. And yet even then you often target people as the weak link. System security for a company is mainly user security. Teaching them to not fall for for scams as an entry way to the system. And there are a lot of professionals that basically made this their own social science of how I convey those things the best, how I enforce and regularly refresh those lessons, how to make people stick to best practices.
Are you trying to tell me this all happens in parallel to a technical server structure that actually isn't that safe but rarely exploited because nobody could be bothered to check for vulnerabilities as it's just Linux and the adoption rate is low?
Not just that but whenever you hear that company xyz was hacked and their data leaked, what do you think was powering their servers? Most likely Linux. Sure, they usually have more things exposed to the internet, but users install way more apps so the attack surface is vastly bigger in home computers running Linux than servers.
A lot of critical vulns are exploiting cross platform applications, log4j...