imported>Explicit: Removing link(s) Wikipedia:Articles for deletion/Comparison of computer viruses closed as delete (XFDcloser)

2025-09-11T14:06:10Z

Removing link(s) Wikipedia:Articles for deletion/Comparison of computer viruses closed as delete (XFDcloser)

← Previous revision		Revision as of 14:06, 11 September 2025
Line 24:		Line 24:

	===Viruses and trojan horses===		===Viruses and trojan horses===
			{{No citations section\|date=July 2025}}
	The viruses listed below pose a potential, although minimal, threat to Linux systems. If an infected binary containing one of the viruses were run, the system would be temporarily infected, as the Linux kernel is memory resident and read-only. Any infection level would depend on which user with what privileges ran the binary. A binary run under the root account would be able to infect the entire system. [[Privilege escalation]] vulnerabilities may permit malware running under a limited account to infect the entire system.		The viruses listed below pose a potential, although minimal, threat to Linux systems. If an infected binary containing one of the viruses were run, the system would be temporarily infected, as the Linux kernel is memory resident and read-only. Any infection level would depend on which user with what privileges ran the binary. A binary run under the root account would be able to infect the entire system. [[Privilege escalation]] vulnerabilities may permit malware running under a limited account to infect the entire system.

	~~It is worth noting that this~~ is true for any malicious program that is run without special steps taken to limit its privileges. It is trivial to add a code snippet to any program that a user may download and let this additional code download a modified login server, an [[open mail relay]], or similar program, and make this additional component run any time the user logs in. No special malware writing skills are needed for this. Special skill may be needed for tricking the user to run the ([[Trojan horse (computing)\|trojan]]) program in the first place.		This is true for any malicious program that is run without special steps taken to limit its privileges. It is trivial to add a code snippet to any program that a user may download and let this additional code download a modified login server, an [[open mail relay]], or similar program, and make this additional component run any time the user logs in. No special malware writing skills are needed for this. Special skill may be needed for tricking the user to run the ([[Trojan horse (computing)\|trojan]]) program in the first place.

	The use of [[Software repository\|software repositories]] significantly reduces any threat of installation of malware, as the software repositories are checked by maintainers, who try to ensure that their repository is malware-free. Subsequently, to ensure safe distribution of the software, [[checksum]]s are made available. These make it possible to reveal modified versions that may have been introduced by e.g. hijacking of communications using a [[man-in-the-middle attack]] or via a redirection attack such as [[ARP poisoning\|ARP]] or [[DNS poisoning]]. Careful use of these [[digital signature]]s provides an additional line of defense, which limits the scope of attacks to include only the original authors, package and release maintainers and possibly others with suitable administrative access, depending on how the keys and checksums are handled. [[Reproducible builds]] can ensure that digitally signed source code has been reliably transformed into a binary application.		The use of [[Software repository\|software repositories]] significantly reduces any threat of installation of malware, as the software repositories are checked by maintainers, who try to ensure that their repository is malware-free. Subsequently, to ensure safe distribution of the software, [[checksum]]s are made available. These make it possible to reveal modified versions that may have been introduced by e.g. hijacking of communications using a [[man-in-the-middle attack]] or via a redirection attack such as [[ARP poisoning\|ARP]] or [[DNS poisoning]]. Careful use of these [[digital signature]]s provides an additional line of defense, which limits the scope of attacks to include only the original authors, package and release maintainers and possibly others with suitable administrative access, depending on how the keys and checksums are handled. [[Reproducible builds]] can ensure that digitally signed source code has been reliably transformed into a binary application.

	===Worms and targeted attacks===		===Worms and targeted attacks===
			{{No citations section\|date=July 2025}}
	The classical threat to Unix-like systems are vulnerabilities in network [[Daemon (computer software)\|daemon]]s, such as SSH and web servers. These can be used by [[Computer worm\|worms]] or for attacks against specific targets. As servers are patched quite quickly when a vulnerability is found, there have been only a few widespread worms of this kind. As specific targets can be attacked through a vulnerability that is [[Zero-day attack\|not publicly known]] there is no guarantee that a certain installation is secure. Also servers without such vulnerabilities can be successfully attacked through [[password strength\|weak passwords]].		The classical threat to Unix-like systems are vulnerabilities in network [[Daemon (computer software)\|daemon]]s, such as SSH and web servers. These can be used by [[Computer worm\|worms]] or for attacks against specific targets. As servers are patched quite quickly when a vulnerability is found, there have been only a few widespread worms of this kind. As specific targets can be attacked through a vulnerability that is [[Zero-day attack\|not publicly known]] there is no guarantee that a certain installation is secure. Also servers without such vulnerabilities can be successfully attacked through [[password strength\|weak passwords]].

Line 37:		Line 39:

	===Buffer overruns===		===Buffer overruns===
			{{No citations section\|date=July 2025}}
	Older Linux distributions were relatively sensitive to [[buffer overflow]] attacks: if the program did not care about the size of the buffer itself, the kernel provided only limited protection, allowing an attacker to execute arbitrary code under the rights of the vulnerable application under attack. Programs that gain root access even when launched by a non-root user (via the [[setuid]] bit) were particularly attractive to attack. However, as of 2009 most of the kernels include [[address space layout randomization]] (ASLR), enhanced [[memory protection]] and other extensions making such attacks much more difficult to arrange.		Older Linux distributions were relatively sensitive to [[buffer overflow]] attacks: if the program did not care about the size of the buffer itself, the kernel provided only limited protection, allowing an attacker to execute arbitrary code under the rights of the vulnerable application under attack. Programs that gain root access even when launched by a non-root user (via the [[setuid]] bit) were particularly attractive to attack. However, as of 2009 most of the kernels include [[address space layout randomization]] (ASLR), enhanced [[memory protection]] and other extensions making such attacks much more difficult to arrange.

Line 150:		Line 153:
	* [[Bliss (virus)\|Bliss]] – requires root privileges		* [[Bliss (virus)\|Bliss]] – requires root privileges
	* Brundle<ref>{{cite web\|url=http://www.roqe.org/brundle-fly/ \|title=Brundle Fly 0.0.1 - A Good-Natured Linux ELF Virus \|access-date=2008-03-08 \|last=Rieck \|first=Konrad and Konrad Kretschmer \|date=August 2001 \|url-status=dead \|archive-url=https://web.archive.org/web/20080514013935/http://www.roqe.org/brundle-fly/ \|archive-date=May 14, 2008 }}</ref>		* Brundle<ref>{{cite web\|url=http://www.roqe.org/brundle-fly/ \|title=Brundle Fly 0.0.1 - A Good-Natured Linux ELF Virus \|access-date=2008-03-08 \|last=Rieck \|first=Konrad and Konrad Kretschmer \|date=August 2001 \|url-status=dead \|archive-url=https://web.archive.org/web/20080514013935/http://www.roqe.org/brundle-fly/ \|archive-date=May 14, 2008 }}</ref>
	* Bukowski<ref>{{cite web \|url=~~http~~://sourceforge.net/projects/bukowski/ \|title=Project Bukowski \|access-date=2008-03-08 \|last=de Almeida Lopes \|first=Anthony \|date=July 2007 \|archive-date=2013-05-14 \|archive-url=https://web.archive.org/web/20130514093707/http://sourceforge.net/projects/bukowski/ \|url-status=live }}</ref>		* Bukowski<ref>{{cite web \|url=https://sourceforge.net/projects/bukowski/ \|title=Project Bukowski \|access-date=2008-03-08 \|last=de Almeida Lopes \|first=Anthony \|date=July 2007 \|archive-date=2013-05-14 \|archive-url=https://web.archive.org/web/20130514093707/http://sourceforge.net/projects/bukowski/ \|url-status=live }}</ref>
	* Caveat<ref>{{cite web\|url=http://www.vxheavens.com/lib/vhe06.html\|title=Caveat virus\|last=herm1t\|date=February 2008\|access-date=2010-01-17\|archive-date=2018-12-23\|archive-url=https://web.archive.org/web/20181223030443/http://www.vxheavens.com/lib/vhe06.html\|url-status=live}}</ref><ref>{{cite web\|url=http://vx.netlux.org/lib/apf29.html \|last=Ferrie \|first=Peter \|title=Can you spare a seg? \|date=July 2009 \|url-status=dead \|archive-url=https://web.archive.org/web/20120117122655/http://vx.netlux.org/lib/apf29.html \|archive-date=2012-01-17 }}</ref>		* Caveat<ref>{{cite web\|url=http://www.vxheavens.com/lib/vhe06.html\|title=Caveat virus\|last=herm1t\|date=February 2008\|access-date=2010-01-17\|archive-date=2018-12-23\|archive-url=https://web.archive.org/web/20181223030443/http://www.vxheavens.com/lib/vhe06.html\|url-status=live}}</ref><ref>{{cite web\|url=http://vx.netlux.org/lib/apf29.html \|last=Ferrie \|first=Peter \|title=Can you spare a seg? \|date=July 2009 \|url-status=dead \|archive-url=https://web.archive.org/web/20120117122655/http://vx.netlux.org/lib/apf29.html \|archive-date=2012-01-17 }}</ref>
	* Cephei – Linux.Cephei.A (and variants)<ref>{{cite web \|url=http://www.virusradar.com/en/Linux_Cephei.A/description \|title=Linux.Cephei - ESET Virusradar \|date=January 2019 \|last=TMZ\|archive-url = https://web.archive.org/web/20180705173356/http://www.virusradar.com/en/Linux_Cephei.A/description\|archive-date =5 July 2018}}</ref>		* Cephei – Linux.Cephei.A (and variants)<ref>{{cite web \|url=http://www.virusradar.com/en/Linux_Cephei.A/description \|title=Linux.Cephei - ESET Virusradar \|date=January 2019 \|last=TMZ\|archive-url = https://web.archive.org/web/20180705173356/http://www.virusradar.com/en/Linux_Cephei.A/description\|archive-date =5 July 2018}}</ref>
Line 162:		Line 165:
	* Rike – Virus.Linux.Rike.1627<ref>{{cite web \|url=http://www.viruslist.com/en/viruses/encyclopedia?virusid=21733 \|title=Virus.Linux.Rike.1627 \|access-date=2008-03-08 \|last=Kaspersky Lab \|date=August 2003\|archive-url = https://web.archive.org/web/20120302072359/http://www.securelist.com/en/descriptions/old21733 \|archive-date =2 March 2012}}</ref>		* Rike – Virus.Linux.Rike.1627<ref>{{cite web \|url=http://www.viruslist.com/en/viruses/encyclopedia?virusid=21733 \|title=Virus.Linux.Rike.1627 \|access-date=2008-03-08 \|last=Kaspersky Lab \|date=August 2003\|archive-url = https://web.archive.org/web/20120302072359/http://www.securelist.com/en/descriptions/old21733 \|archive-date =2 March 2012}}</ref>
	* RST – Virus.Linux.RST.a<ref>{{cite web \|url=http://www.viruslist.com/en/viruses/encyclopedia?virusid=21734 \|title=Virus.Linux.RST.a \|access-date=2008-03-08 \|last=Kaspersky Lab \|date=January 2002 \|url-status=dead \|archive-url=https://web.archive.org/web/20071107040802/http://www.viruslist.com/en/viruses/encyclopedia?virusid=21734 \|archive-date=2007-11-07 }}</ref> (known for infecting Korean release of [[Mozilla Suite]] 1.7.6 and [[Mozilla Thunderbird\|Thunderbird]] 1.0.2 in September 2005<ref>{{cite web\|url =http://www.linux-magazine.com/w3/issue/62/Viruses_in_Linux.pdf\|archive-url=https://web.archive.org/web/20140517132434/http://www.linux-magazine.com/w3/issue/62/Viruses_in_Linux.pdf\|archive-date=2014-05-17\|title=The ways of viruses in Linux HOW SAFE? \|access-date=2009-08-21}}</ref>)		* RST – Virus.Linux.RST.a<ref>{{cite web \|url=http://www.viruslist.com/en/viruses/encyclopedia?virusid=21734 \|title=Virus.Linux.RST.a \|access-date=2008-03-08 \|last=Kaspersky Lab \|date=January 2002 \|url-status=dead \|archive-url=https://web.archive.org/web/20071107040802/http://www.viruslist.com/en/viruses/encyclopedia?virusid=21734 \|archive-date=2007-11-07 }}</ref> (known for infecting Korean release of [[Mozilla Suite]] 1.7.6 and [[Mozilla Thunderbird\|Thunderbird]] 1.0.2 in September 2005<ref>{{cite web\|url =http://www.linux-magazine.com/w3/issue/62/Viruses_in_Linux.pdf\|archive-url=https://web.archive.org/web/20140517132434/http://www.linux-magazine.com/w3/issue/62/Viruses_in_Linux.pdf\|archive-date=2014-05-17\|title=The ways of viruses in Linux HOW SAFE? \|access-date=2009-08-21}}</ref>)
	* [[Staog]]		* [[Staog]], the first computer virus on Linux
	* Vit – Virus.Linux.Vit.4096<ref>{{cite web\|url=http://www.viruslist.com/en/viruslist.html?id=3135&key=00001000050000200003 \|title=Virus.Linux.Vit.4096 \|access-date=2008-03-08 \|last=Kaspersky Lab \|date=March 2000 \|url-status=dead \|archive-url=https://web.archive.org/web/20071107040844/http://www.viruslist.com/en/viruslist.html?id=3135&key=00001000050000200003 \|archive-date=November 7, 2007 }}</ref>		* Vit – Virus.Linux.Vit.4096<ref>{{cite web\|url=http://www.viruslist.com/en/viruslist.html?id=3135&key=00001000050000200003 \|title=Virus.Linux.Vit.4096 \|access-date=2008-03-08 \|last=Kaspersky Lab \|date=March 2000 \|url-status=dead \|archive-url=https://web.archive.org/web/20071107040844/http://www.viruslist.com/en/viruslist.html?id=3135&key=00001000050000200003 \|archive-date=November 7, 2007 }}</ref>
	* Winter – Virus.Linux.Winter.341<ref>{{cite web \|url=http://www.viruslist.com/en/viruses/encyclopedia?virusid=21756 \|title=Virus.Linux.Winter.341 \|access-date=2008-03-08 \|last=Kaspersky Lab \|date=October 2000 \|url-status=dead \|archive-url=https://web.archive.org/web/20071110002308/http://www.viruslist.com/en/viruses/encyclopedia?virusid=21756 \|archive-date=2007-11-10 }}</ref>		* Winter – Virus.Linux.Winter.341<ref>{{cite web \|url=http://www.viruslist.com/en/viruses/encyclopedia?virusid=21756 \|title=Virus.Linux.Winter.341 \|access-date=2008-03-08 \|last=Kaspersky Lab \|date=October 2000 \|url-status=dead \|archive-url=https://web.archive.org/web/20071110002308/http://www.viruslist.com/en/viruses/encyclopedia?virusid=21756 \|archive-date=2007-11-10 }}</ref>
Line 191:		Line 194:
	==See also==		==See also==
	*[[Botnet]]		*[[Botnet]]
	*[[Comparison of computer viruses]]
	*[[Computer virus]]		*[[Computer virus]]
	*[[Computer worm]]		*[[Computer worm]]

imported>Middypedia: /* growthexperiments-addlink-summary-summary:3|0|0 */

2025-05-27T15:41:13Z

growthexperiments-addlink-summary-summary:3|0|0

Show changes

Linux malware - Revision history

imported>Explicit: Removing link(s) Wikipedia:Articles for deletion/Comparison of computer viruses closed as delete (XFDcloser)

imported>Middypedia: /* growthexperiments-addlink-summary-summary:3|0|0 */