Forgot your password?
typodupeerror
Australia Desktops (Apple) Education Government OS X Security Apple IT Linux

Tasmanian Dept. of Education Wants Anti-Virus for Linux, OS X 396

Posted by timothy
from the belt-and-suspenders-and-pants-full-of-glue dept.
An anonymous reader writes "One of Australia's largest government technology buyers, the Tasmanian Department of Education, has gone to market for a security vendor to supply anti-virus software for its 40,000-odd desktop PCs and laptops, as well as servers. But the department's not just running Windows — it runs Mac OS X and Linux as well, and has requested that whatever solution it buys must be able to run on those platforms as well. But have we reached the stage were Mac OS X and Linux even need third-party security software? It seems like most Mac and Linux users don't run it."
This discussion has been archived. No new comments can be posted.

Tasmanian Dept. of Education Wants Anti-Virus for Linux, OS X

Comments Filter:
  • no (Score:3, Insightful)

    by Anonymous Coward on Monday May 02, 2011 @05:36AM (#35997920)

    no.

    • Re:no (Score:5, Informative)

      by rwa2 (4391) * on Monday May 02, 2011 @08:57AM (#35999118) Homepage Journal

      Counterpoint: yes

      The US DoD requires it too. Fortunately, it is available from commercial suppliers (ClamAV is not compliant with something or other), so you just install it and maintain it and pass the bill on to the taxpayers.

      I think it's just standard CYA, so you have someone external to blame if something slips through (which possibly explains why effective roll-your-own measures are deemed insufficient by the policymakers).

      • Re:no (Score:5, Insightful)

        by DrgnDancer (137700) on Monday May 02, 2011 @09:23AM (#35999404) Homepage

        The DoD's reasoning is pretty straightforward. There are few to no "in the wild" viruses or trojans for Linux/Mac (several worms though), but data rarely stays in one platform in an interconnected world. We put virus protection on every platform so that whenever a document or program is introduced on the network it gets scanned. That way if it has malware in it, even Windows malware on a Linux/Mac system, it's caught early. Just because I first put the document on a Linux system doesn't mean it's going to stay on a Linux system.

        • The DoD's reasoning is pretty straightforward. There are few to no "in the wild" viruses or trojans for Linux/Mac (several worms though), but data rarely stays in one platform in an interconnected world. We put virus protection on every platform so that whenever a document or program is introduced on the network it gets scanned. That way if it has malware in it, even Windows malware on a Linux/Mac system, it's caught early. Just because I first put the document on a Linux system doesn't mean it's going to stay on a Linux system.

          Exactly. 99% of what my Linux boxes scan for are Windows malware (viruses, worms, trojans, etc). I prefer to scan for such things on a box that is not succeptible to most things. Since websites, USB keys, and portable media, bittorrent, etc., mean virus can come into almost any system on the network, all machines shoudl be scanning for all viruses, whatever the platform.

          Home users can do what they want, but in any larger networked environment where you don't have absolute control, this is absolutely necc

        • Re:no (Score:4, Insightful)

          by ironjaw33 (1645357) on Monday May 02, 2011 @10:34AM (#36000106)

          We put virus protection on every platform so that whenever a document or program is introduced on the network it gets scanned. That way if it has malware in it, even Windows malware on a Linux/Mac system, it's caught early. Just because I first put the document on a Linux system doesn't mean it's going to stay on a Linux system.

          It's like getting a flu shot -- you're not only protecting yourself from the flu, but others as well.

    • Antivirus scanners provide a false sense of security with no real benefit. We've got pretty nice workstations at my work, but are saddled with McAfee by corporate IT mandate. Which regularly turns them into unresponsive pigs.

      Better to properly lock down user accounts and teach users proper data hygiene. So we can use those resources to accomplish work instead of not-work.
      • by h4rr4r (612664) on Monday May 02, 2011 @10:50AM (#36000270)

        teach users proper data hygiene
        Totally impossible. They don't care and you can't make them care.

  • Passing on Viruses (Score:4, Insightful)

    by Anonymous Coward on Monday May 02, 2011 @05:36AM (#35997922)

    A computer can still pass on a virus even if it cannot directly infect you. It might not be your responsibility but will a child know this? If he forwards an attachment unwittingly or something?

    Linux users and Mac users could accidentally infect a Windows user.

    • by Mouldy (1322581) on Monday May 02, 2011 @05:43AM (#35997966)
      This is exactly why antivirus software for Linux already exists, they probably catch a couple of Linux viruses too, but the majority of their definitions are Windows viruses.

      I've set up ClamAV on my Linux mail server to catch most dodgy stuff before it reaches my Windows PC. I also recently installed it onto my Linux Netbook to scan a friend's external hard drive for a Windows virus. I haven't been following the latest security news, so didn't particularly want to risk plugging it into my friend's or my Windows machine to scan it.

      So I agree, there definitely is a use for Linux-based anti virus software...even if my own uses are mainly concerned with protecting Windows machines.
      • by Compaqt (1758360)

        Do have it set up to receive mail from Postfix, and then pass it on to Dovecot for distribution?

        Or does ClamAV get a crack at mail first before Postfix?

        Is there a way to scan an email as you're receiving it, and then stop in the middle of the process, making it look like you have a bad SMTP server, which hopefully spammers won't bother with again?

        Oh, and, are you running Amavis, and SpamAssasin, too?

        • by memzer (2033838) on Monday May 02, 2011 @07:07AM (#35998380)
          I'm guessing this was meant to be a troll but really things aren't as bad as you make them out to be these days...

          If you're setting up a mail server there are packages available which integrate all of the things you mentioned above into easier to manage / maintain systems. For example one popular one is iRedMail http://www.iredmail.org/features.html [iredmail.org] which can be set up by an intermediate user in around 1 Minute [Video: http://www.youtube.com/watch?v=wi8CF3RKRm4%5D [youtube.com].

          If you are implying it's much more complicated for the end user then you're kidding yourself as well. These days there are guides for most popular distributions and usually it's not much more difficult than installing the software and/or configuring an addon. For example, the Ubuntu community guide has easy to follow instructions for configuring Thunderbird with ClamAV. The process is by no means difficut (install, set ports, install addon) and takes less than a minute to complete for a novice user capable of following some instructions.

          There are of course users who would find following such a guide too difficult but really these users simply lack the experience, confidence, patience or time to do so anway. They're likely the same users who pay somebody else (or come to you, their friend / relative) to install the software for them ;)

          Point I'm trying to make for people thinking of giving it a try is that it is a lot easier to do than the parent implies - even for novice-intermediate users.
      • Re: (Score:2, Interesting)

        by willy_me (212994)
        I have also used ClamAV - but it is horrible for finding most viruses. It is probably great for scanning email but it simply is not reliable enough for detecting viruses in downloaded files. I use Windows in a VM and have found numerous occasions when ClamAV would not detect a virus (scanned by the host machine). Scanning the file with most other free Windows anti-virus products results in the virus being found. So while I would love it if ClamAV did the job, it just doesn't.
        • by Bert64 (520050) <bert&slashdot,firenzee,com> on Monday May 02, 2011 @06:31AM (#35998196) Homepage

          I have found the same thing happen with most other AV engines too...

          I have done a number of incident response jobs whereby a machine has become infected and its my job to work out what happened...

          All machines were windows...
          All machines were running some kind of AV (multiple different vendors).
          Every machine had a persistent piece of malware present on it.
          The AV actually installed failed to detect the malware.
          Testing the malware with other AV engines found that some would find it, i never encountered anything totally new that wasn't detected by anything.

          • by Lennie (16154)

            As many have already figured out, AV is pretty useless.

            It is nowhere near fullproof.

            • by Lennie (16154)

              Maybe I should add why.

              There are more viruses created every hour (automated) than any anti-virus company can handle.

              I actually doubt that if they all worked together really well they would be able to have an up to date list.

              I'm surprised the botnet operators haven't yet used the botnet to create the new variants every few emails/HTML-form-posts/whatever they do.

      • by Yaa 101 (664725)

        Most of the big brands have a virus scanner/remover running on a Linux powered live CD, I used several to disinfect a friends laptop.

        I think they will make them like that for Linux oriented viruses too...

    • by Bert64 (520050)

      There are a number of AV products for linux and mac, and they pretty much exclusively work as you describe... They are typically designed for servers with windows clients.

    • How so? I've run Linux here for well over a decade and there's no way that I'm passing viruses around. What this request for quote from Tasmania demonstrates is how unaware of the technology benefits the requestors really are. With OSX or Linux, viruses can be disregarded. If you want to filter viruses from a mailserver, sure, I can see that. But there are no viruses for Linux. It's like needing an umbrella on a sunny day.

      • by Compaqt (1758360)

        Well, I'm not up-to-date on the latest in Windows malware, but let's say you get a custom-crafted PDF that does "blah" in Acrobat on Windows. You read the PDF. You're unaffected in Linux. You forward it to your Windows colleague.

        He is now affected.

    • by mjwx (966435) on Monday May 02, 2011 @06:47AM (#35998288)

      A computer can still pass on a virus even if it cannot directly infect you. It might not be your responsibility but will a child know this? If he forwards an attachment unwittingly or something?

      Linux users and Mac users could accidentally infect a Windows user.

      In my experience, Mac users are even more irresponsible then clueless Windows users. They think they are magically protected, which means they will ignore obvious signs of infection till the very end.

      As we all know, malware is less about doing damage and more about making money these days. Keyloggers, trojans and spambots exist for OSX these days (as well as Linux) but they focus on staying hidden as their job is to make money, not make people annoyed which means they need to stay where they are to collect CC numbers or send spam.

      Linux users should not have a problem with AV. Even if they are smart enough not to need it. Linux users already think with a security focused mind, as an effect using Linux in lieu of a AV client is laziness on our part (granted, we can recognise an infected machine, so we can afford a bit of laziness).

      To use a Zombie virus analogy, Windows users are the ones running about in a mad panic as the Zombie hoard approaches, blocking highways and running to get away. Mac users walk towards them saying, "Zombies dont exist on Mac, I could never get infected". Linux users fled to the hills six months ago with as much fuel, food and porn as they could carry.

      • To use a Zombie virus analogy, Windows users are the ones running about in a mad panic as the Zombie hoard approaches, blocking highways and running to get away. Mac users walk towards them saying, "Zombies dont exist on Mac, I could never get infected". Linux users fled to the hills six months ago with as much fuel, food and porn as they could carry.

        Here, take this imaginary +1 vote...it's all I have at the moment...but that awesome analogy deserves more!

      • by guruevi (827432)

        Mac OS X has a built-in antivirus for the few Mac OS X virusses that actually exist and work, proof is in a patch a little while ago where the signatures got updated. This keeps the overhead to a minimum. Linux has the same thing going on - if a virus exploits the kernel, the kernel gets patched quickly and the virus is no longer a threat.

      • Re: (Score:3, Funny)

        by Anonymous Coward

        Linux users fled to the hills six months ago with as much fuel, food and porn as they could carry.

        Not only that, but in that six months, they've managed to find 6 completely different methods to cure the zombie virus, all of which are tied up in arguments over:
        1) how stupid the name sounds
        or
        2) how "free" the license is.

      • "In my experience, Mac users are even more irresponsible then clueless Windows users. They think they are magically protected, which means they will ignore obvious signs of infection till the very end."

        Considering I could count the number of Mac "viruses" (Trojan horses) in the wild on one hand, I must wonder: how many data points does your "experience" consist of?
    • by mspohr (589790)
      I have to admit that I have done this...

      I work in Africa a lot and Windows viruses are everywhere. I always end up with at least one on my memory stick used to pass around documents.

      Since I run Linux, I don't worry about these on my machine and I usually check the memory stick when I get it back and delete the virus files to prevent passing them on. However, it did happen at least once (that I know) where I didn't check the memory stick and another Windows machine did pop up a virus warning.

      I guess it

  • Last Resort (Score:4, Insightful)

    by iYk6 (1425255) on Monday May 02, 2011 @05:38AM (#35997926)
    Anti-virus is a security last resort. If you've already downloaded or executed malware, then anti-virus might prevent it from running, or might be able to remove it if it already has. But it can't detect everything. It can only detect common malware. Linux doesn't have any common malware, and I'm not sure about Mac. There is clamav, but that's mostly detecting Windows viruses across platforms.
    • There's more OSX and Linux malware out there than you might think. Especially OSX. When it comes to Linux I'd imagine that that is mainly for servers, where being able to e.g. natively run a sweep over all those shared directories that your staff are using to cache their files, or scanning incoming mail on your mail server or the like would be advantageous.

      • There's more OSX and Linux malware out there than you might think.

        Examples?

      • by Ihmhi (1206036) <i_have_mental_health_issues@yahoo.com> on Monday May 02, 2011 @06:32AM (#35998202)

        Linux was created by the finest minds of the last thousand years - truly, men among men. They jacked their brains into the cyberspace, navigating neon green 3-D cities and running their own virtual construction company for ten years to build the Linux kernel. Only after it was finished did they convert it to more mundane code so that the lesser men of the world may bask in its glory.

        I don't know what's more disheartening, the fact that someone believes they can create a virus that can melt cyberspace steel, or the fact that there are companies that are scamming their customers with unnecessary products~!

      • Re: (Score:2, Insightful)

        by timholman (71886)

        There's more OSX and Linux malware out there than you might think. Especially OSX.

        One of the Windows users I work with says the same thing. Like you, he can't provide any examples either.

        And if you're talking about those instances of trojans that rely on social engineering, what anti-virus program can defend against a user who willingly types in an administrative password and installs the malware on his own?

        • Exactly. I bet the same user, if he had an anti-virus app running, would disable it to be able to run the malware.
        • Re: (Score:3, Insightful)

          by mjwx (966435)

          There's more OSX and Linux malware out there than you might think. Especially OSX.

          One of the Windows users I work with says the same thing. Like you, he can't provide any examples either.

          And if you're talking about those instances of trojans that rely on social engineering, what anti-virus program can defend against a user who willingly types in an administrative password and installs the malware on his own?

          Well if we are excluding those...

          There's 90% of Windows malware wiped out. The user is, always has been and will always be the biggest source of infection. Even in the Windows world and especially today when a patched Win 7 and Office suite aren't vulnerable to drive by infections.

          I love how Mac fanboys need to move the goal posts to justify their positions. But here you go anyway.

          http://about-threats.trendmicro.com/Search.aspx?language=us&p=OSX [trendmicro.com]

          No doubt you have some wonderfully convenient

          • Re:Last Resort (Score:5, Insightful)

            by John Betonschaar (178617) on Monday May 02, 2011 @08:32AM (#35998892)

            There's 90% of Windows malware wiped out. The user is, always has been and will always be the biggest source of infection. Even in the Windows world and especially today when a patched Win 7 and Office suite aren't vulnerable to drive by infections.

            What does Windows have to do with anything, the statement was that there's "more OS X and Linux malware around then you might expect", which (at least to me) implies that this amount of malware is substantial enough to care about.

            I love how Mac fanboys need to move the goal posts to justify their positions. But here you go anyway

            Great, ram your point across by throwing stereotypes around, that's really going to help your argument /s

            No doubt you have some wonderfully convenient excuse to ignore this.

            No wonderfully convenient "excuse" is necessary here, because your 'list of OS X threats' is laughable and does nothing but disproving your own argument. In 10 years of OS X history, apparently only 43 pieces of malware have been identified, most of which are Trojans, which -in your own words- depend on the user as 'the biggest source of infection', and for which antivirus software completely unnecessary. If anything, that list proves that OS X is more or less immune to viruses and malware, and that a fully patched OS X install does not need antivirus, just common sense.

            From your own signature:

            Calling someone a "hater" only means you can not rationally rebut their argument.

            And what does calling someone a 'Mac fanboy' make you?

        • by jimicus (737525)

          If you look at the latest threats for Windows, probably 70% of them are trojans of some sort.

          Looking at Symantec's website, the remainder are all variants on the exact same application - VirusDoctor. So the true percentage of trojans (as opposed to viruses) is probably much higher than 70%.

        • by drsmithy (35869)

          And if you're talking about those instances of trojans that rely on social engineering, what anti-virus program can defend against a user who willingly types in an administrative password and installs the malware on his own?

          Er, that's pretty much the whole *point* of AV software - the last ditch effort to protect the user trying to shoot himself in the foot.

          A massive proportion of malware uses the trojan horse model. The reason we have AV software at all, is because OS-level security can't defend against i

    • by Compaqt (1758360)

      Even though that might be true, I think they want to scan all email to prevent viruses being passed around to Windows users, say from a Linux user whom it doesn't affect.

    • Re:Last Resort (Score:5, Interesting)

      by fuzzyfuzzyfungus (1223518) on Monday May 02, 2011 @07:53AM (#35998642) Journal

      Anti-virus is a security last resort. If you've already downloaded or executed malware, then anti-virus might prevent it from running, or might be able to remove it if it already has. But it can't detect everything. It can only detect common malware. Linux doesn't have any common malware, and I'm not sure about Mac. There is clamav, but that's mostly detecting Windows viruses across platforms.

      One additional advantage(in institutional setups, home users are screwed) is that the presence of AV requires the designers of viruses to make a choice: Either you attempt to lay low, and take the risk that a future update of the AV package will detect your virus, or you go all cyber-AIDS on the system and attempt to throw a spanner in the AV system or its update mechanism. In the latter case, the client generally stops responding to the AV management server, which throws up a major red flag. At that point, you either pull the system aside for a more detailed chat, or nuke it, depending on your priorities.

      It's like trying to scare off ninjas by deploying mall cops. The mall cops are hopelessly outmatched; but they will, on occasion, stumble across a ninja, which forces the ninjas to either passively risk detection or actively start killing the mall cops, which alerts you to their presence.

      • by RogerWilco (99615)

        This is more insightful then one would think a post about ninjas could be.

      • Re:Last Resort (Score:4, Interesting)

        by SanityInAnarchy (655584) <ninja@slaphack.com> on Monday May 02, 2011 @10:45AM (#36000198) Journal

        It's like trying to scare off ninjas by deploying mall cops. The mall cops are hopelessly outmatched; but they will, on occasion, stumble across a ninja, which forces the ninjas to either passively risk detection or actively start killing the mall cops, which alerts you to their presence.

        That is a beautiful analogy, and you deserve a +5 for that alone.

        Still...

        Wouldn't a ninja be able to take the mall cops out one at a time, hide the body, steal the uniform, and pretend to be a mall cop, thus avoiding alerting anyone to their presence? That seems like the obvious solution -- completely take over the AV system, continue receiving updates, but rather than implement them, send them back to your botnet's command-and-control so the botnet operator can stay one step ahead.

    • Re:Last Resort (Score:5, Informative)

      by AtomicJake (795218) on Monday May 02, 2011 @08:04AM (#35998718)

      Anti-virus is a security last resort. If you've already downloaded or executed malware, then anti-virus might prevent it from running, or might be able to remove it if it already has. But it can't detect everything. It can only detect common malware.

      This is too true. On our Windows machines is a self-updating AV installed. From time to time it deletes an email with a virus (or suspicious) attachment - we would never opened it in any case (you know those lame emails, where you can smell the virus already in the subject line). Nevertheless, over ten years in corporation, we had two outbreaks: one was the slammer worm brought in from an executive with a laptop and a bad firewall config (in the Windows 2000 days), the other was a very well crafted social engineered email with a PDF attachment that was not yet known by the AV. So, in both cases, the AV did not help and I assume that all the other viruses would not have the chance to run either, since the humans would not execute them (opening rotten attachments).

      On the other hand the AV got multiple times in the way of the business by disabling remote login software, network analyzers, etc.

      I think that it make sense to have an AV software on the email server to filter all those typical attacks, but I am not convinced about the need of an AV on each desktop, laptop etc. It makes sense to have AN AV to test each downloaded file or USB stick when connected, but to have it always running might be overkill.

      And, btw: we also had Linux machines, which were successfully attacked. However, those were network attacks against security holes in Internet servers. Maybe an intrusion detection system would have helped, but clearly not a typical anti-virus.

      • by Tom (822)

        but I am not convinced about the need of an AV on each desktop, laptop etc.

        There are several papers out there describing malware spreading in corporate networks (full disclaimer: I wrote one of them). I'll give you a hint towards why you want AV on each and every machine: Because once your perimeter has been penetrated, the worst-case scenario for a well-crafted malware to infect your entire corporate network is measured in seconds. Give it the usual caveats because the worst-case scenario rarely happens in the real world, but even if you give it two orders of magnitude - can you

  • by Mattsson (105422) on Monday May 02, 2011 @05:38AM (#35997934) Homepage Journal

    If you exchange documents and files with other users, having anti-virus and anti-malware software or not is not only an issue for your own protection.
    Even if you run on a system that you believe to be safe from those kinds of infections, you might spread it to other users if you ever pass on files that you get from others.
    This might not be of any importance to you personally, but in a large organization it might be of vital importance that malicious software can't "hide" in unprotected systems of other flavours that it was designed for.

  • by macraig (621737) <mark DOT a DOT craig AT gmail DOT com> on Monday May 02, 2011 @05:38AM (#35997936)

    I run Windows and I still don't use that stuff... I'm totally open source - err, open-minded - and I don't mind sharing my computer with a botnet and my credit card with poor Russkis, Nigerians, and Chinamen. All for one and one for all, I say!

  • There already exist both commercial and non-commercial anti-virus applications that run on Linux (Wikipedia has a list [wikipedia.org]) which mainly target Windows viruses passing through corporate networks. Some anti-virus solutions target native viruses (virii?), but most are quickly obsoleted via updates anyways. I suspect this is what the Dept. of Education is asking for, and it's not unreasonable.

    • I suspect this is what the Dept. of Education is asking for, and it's not unreasonable.

      They want the same solution to run on all platforms. That's as reasonable as wanting the same tyre to fit a bike and a bus.

  • by BoogeyOfTheMan (1256002) on Monday May 02, 2011 @05:39AM (#35997942)

    I use clamav. I'm currently running a dual boot setup with Win7, but its only used for gaming (once a month or so) and for a few programs that I've only gotten to run without a hiccup in windows. Since I dont use it all that often, I also dont update it all that often, so having an AV run from outside the OS seems like its not a bad idea.

  • by Gunstick (312804) on Monday May 02, 2011 @05:43AM (#35997968) Homepage

    #!/bin/sh
    echo "stating scan..."
    n=`find / -type f | wc -l`
    echo "scan completed of $n files"
    exit 0

  • But have we reached the stage were Mac OS X and Linux even need third-party security software? It seems like most Mac and Linux users don't run it.

    In todays world it is not a matter of whether the OS requires it, its more and more a matter whether the User/Admin requires it.

  • prophecy (Score:5, Insightful)

    by greenfruitsalad (2008354) on Monday May 02, 2011 @05:46AM (#35997984)

    1 group will claim GNU/Linux doesn't need anti virus software.
    2nd group will claim they use antivirus on their GNU/Linux already, but only to clean emails destined for MS Windows machines or to look after their Samba exported storage.
    3rd group will say GNU/Linux needs AV software because it's only a matter of time before viruses (virii?) appear.
    4th group will say viruses for GNU/Linux already exist and provide links to some sensationalist articles on the interwebs where researchers published some concepts.
    5th group (partially composed of group 1 and 2) will claim they're not real viruses, but worms/snakes/butterflies/etc...
    6th group will claim the threat aren't viruses but PPAs in ubuntu.
    3rd/4th group will return saying it's all about users and not the OS. And because they're careful users, they've never in their life needed AV on their MS Windows.
    Does that about cover that? Let the holy war begin...

  • Well, does a Mac or Linux require Anti Virus?

    Let me ask you a question, do you hand out your credit card number to anyone who asks? Of course you don't because you have some common sense and realise that some people would take that information and use it for malicious purposes. Mac's and Linux can be compromised, of course, there are not as often targeted as if you are going to write a virus/malware you will pick the most popular platform, but if you are a Mac/Linux user and you don't run AV or expect that

    • Re: (Score:2, Insightful)

      by sydneyfong (410107)

      You must work in IT support.

      My personal experience is:

      #1. For a technically sane, and security aware user, most antivirus software only exists to make the system hog slow.

      #2. Antivirus software is used as a placebo to make users feel they are safer. If anything, I suspect it would make users feel less responsible for their own actions because some AV software is supposedly protecting them.

      #3. How is a Linux user supposed to run AV? With WINE? I know there is clamav, but it's not intended for those "active m

      • Re:Of Course (Score:5, Informative)

        by mjwx (966435) on Monday May 02, 2011 @07:07AM (#35998382)

        You must work in IT support.

        My personal experience is:

        #1. For a technically sane, and security aware user, most antivirus software only exists to make the system hog slow.

        #2. Antivirus software is used as a placebo to make users feel they are safer. If anything, I suspect it would make users feel less responsible for their own actions because some AV software is supposedly protecting them.

        #3. How is a Linux user supposed to run AV? With WINE? I know there is clamav, but it's not intended for those "active monitoring/scanning" things you have on Windows. Maybe the "shell script" placebo* will work equally well at "educating users" if that's what you want. No point in making a system slow.

        * http://apple.slashdot.org/comments.pl?sid=2119134&cid=35997968 [slashdot.org]

        You must work in sales, because you have no experience in the real world.

        #1. Actual, technical users understand that AV is important, they just recognise the signs of infection as well as any AV does and will take steps when they detect them. For us, AV clients are just a way to be lazy.

        #2. Just because AV will not protect against some 0-days does not make it useless. It's a method of protecting against old threats which are still quite prevalent thanks to people who dont use or ignore AV. Not to mention that many viruses are simply minor variations of old ones, the W32.Foo.F virus looks quite similar to W32.Foo.E.

        #3. Umm... You do know that there are a variety of Linux clients out there. Clam AV, Trend Micro, AVG, Kaspersky and others have clients. Any AV vendor in the Enterprise space has a client as Enterprises use Linux servers quite a bit. Do a google search for "Linux Anti Virus" before launching on an ill informed rant.

        • by Svartalf (2997)

          Just because AV will not protect against ALL 0-days does make it nearly useless.

          Fixed that for you. If it's a 0-day exploit, typically nobody knows about the virus that uses it execpt the jokers that wrote it. Seriously. That's why it's called a 0-day in the first place. That means it won't find the thing for you- ever.

          It's a method of protecting against old threats which are still quite prevalent thanks to people who dont use or ignore AV. Not to mention that many viruses are simply minor variations

        • by batwingTM (202524)

          #1. Actual, technical users understand that AV is important, they just recognise the signs of infection as well as any AV does and will take steps when they detect them. For us, AV clients are just a way to be lazy.

          You know, in relation to that point, back in 1999 the most effective Virus detection software I had was "Need For Speed 3: Hot Pursuit". Back in the days of the rapidly spreading Win.CIH virus as soon as that got into my system it would end up in that executable (because I used it so often I guess) and that would cause the game to hang. When that occurred it was time to break out the trusty command line removal tool.

  • by Blade (1720) on Monday May 02, 2011 @05:50AM (#35998008) Homepage

    This is probably just a policy issue. "We've put your AIX / HP-UX / Solaris server in". "What AV does it run?" "Er, it's running AIX / HP-UX / Solaris , we've not installed AV". "But our policy says we have to use product X or product Y to AV protect all our servers". "Yes, but you're not understan....." "Just install AV".

  • F-prot and a long list of others have linux versions. It's useful for email gateways and I've got a spare licence to use the antivirus with knoppix to do malware removal on the laptops that come in with various infections (although a full wipe and reinstall is the only way to be sure).
    It really depends upon whether they want software which CAN run on the platform or whether they actually want it deployed on every desktop. There is actual merit in one or two per site - if nothing else they can scan incomin
  • every major vendor has a linux version for MTA's

    have a look at a mavisd.conf

  • You can't (Score:5, Informative)

    by bmo (77928) on Monday May 02, 2011 @06:19AM (#35998150)

    http://technet.microsoft.com/en-us/library/cc512587.aspx [microsoft.com]

    >>You can't clean a compromised system by patching it.

    >>You can't clean a compromised system by removing the back doors.

    >>You can't clean a compromised system by using some "vulnerability remover."

    >>You can't clean a compromised system by using a virus scanner.

    >>You can't clean a compromised system by reinstalling the operating system over the existing installation.

    >>You can't trust any data copied from a compromised system.

    >>You can't trust the event logs on a compromised system.

    >>You may not be able to trust your latest backup.

    >>>>>The only way to clean a compromised system is to flatten and rebuild.

    Jesper M. Johansson, Ph.D. [YES, HE'S A DOCTOR], CISSP, MCSE, MCP+I

    Security Program Manager
    Microsoft Corporation

    • The only thing a positive scan tells me, is that it is time to rebuild which is a pain in the ass and I have skimped on it before.
    • A very brilliant article, however :

      You can't clean a compromised system by using a virus scanner.

      Theoretically, it should be possible to boot the system from an other OS (say, a rescue Linux on an USB media) and then clean the system.

      The only way to clean a compromised system is to flatten and rebuild.

      And if the system was compromised at BIOS level ? Any possibility that even a rebuild could be fooled ?

    • by jimicus (737525)

      Which is why you don't run AV on a compromised machine. You boot from a rescue CD such as that provided by Avira [avira.com] or F-Secure [f-secure.com].

      Even that's not a perfect solution, of course, because it assumes your scanner can detect secondary vulnerabilities injected by the infection itself - or that no such vulnerability exists. Both of which seem rather optimistic assumptions. Ideally you'd have some sort of boot CD that can run checksums against every file on the system - but by the time you get to this point, it's pro

    • >Jesper M. Johansson, Ph.D. [YES, HE'S A DOCTOR], CISSP, MCSE, MCP+I

      Even more impressively, he's A MICROSOFT CERTIFIED PROFESSIONAL ;).

  • by djsmiley (752149) <djsmiley2k@gmail.com> on Monday May 02, 2011 @06:38AM (#35998232) Homepage Journal

    Wait, so we bash the govement for using windows, for using faulty antivirus software, for not using any antivirus software, for not using open source, for spending too much......

    Now we bash them for asking for something SENSIBLE? Just because most linux/os x users dont run it doesn't mean its s a good idea -> Most windows users don't run antivirus software and use I.E. 6......

    Now... if they want one. ClamAV does both linux and windows, not sure about OS X though.

  • Linux and Mac users risk being victims of phishing attacks and foolishly handing out passwords, just like the rest of us. It's been a long time since corporate antivirus was just about stopping malicious software being installed on a computer.

  • At least, both Symantec Antivirus and CA ETrust have honest to god linux and mac os x versions - they both use kernel modules/kexts to do realtime scanning, and actually catch linux threats. Sophos does at least linux too.

  • I seriously tried to contribute something useful to an earlier thread, no chance.
    Then I was looking for some politically incorrect snide remark about ex-convicts, no chance.

    Here comes my serious take, then: I read TFA, and what I can read into it, with only some interpretation, is that when you buy/install OSX or Linux, you can do so only, when there is a cross-platform AV. If your Windows Anti-Virus also finds the viruses in OSX/Linux.

    For Christ's sake, the question here isn't if OSX/Linux need AV or not.

  • A lot of compliance audits have requirements that are not OS specific and one of them is having anti-virus (among other things). So a lot of large companies just find it easier to have something that supports all their systems so they don't have to get into an argument on every audit.

    Whether it is right or wrong, or a system needs it, isn't the point. Audits can be very expensive and sometimes having those boxes checked can be an easier route to go.

  • This scene on Slashdot is sad. It's funny how people on here say "Antiviruses are useless." and "Linux does't need an antivirus."

    Antiviruses are but one part of a defense-in-depth system and while aren't the be-all-end-all of security for a user, it is indeed a very useful item. Patching security vulnerabilities doesn't get rid of the trojans/viruses after the fact.

    And it's entirely possible a piece of malware could get on to your system through a zero-day, unless I assume you're running a fully managed SEL
  • worms and spam bots (Score:5, Interesting)

    by mathfeel (937008) on Monday May 02, 2011 @07:17AM (#35998420)
    I was embarrassed recently when the IT department claim a Linux computer in my office was taken over by the Rustock BOT. After checking the ssh log, I realized it was a coworker who uses it for code repository and SOCK5 Proxy as he works abroad from China. He has a compromised Windows machine. To the best of my knowledge, AV doesn't really catch these stuff which are more and more common now a day. Anyone has recommendations?
  • by Kanel (1105463) on Monday May 02, 2011 @07:49AM (#35998612) Journal

    Android smartphones run on linux.
    Android smartphones are used by office workers and integrated with the company IT system.
    Android smartphones are vulnerable to malicious apps

    Therefore, antivirus or 'anti-malware' for linux is badly needed

  • by mauriceh (3721) <maurice@@@harddata...com> on Monday May 02, 2011 @08:31AM (#35998882) Homepage

    The best way to deflect the idea that it is only Windows that has the basic vulnerability is to ensure that Linux and OSX users are forced to run AV too.
    That way they can claim that the total cost of ownership on these platforms is ( artificially) higher.

    It is also likely a case of the person working that factor then adding support to the lie by persuading his/her colleagues with the classic FUD:
    "What if you omit this, and a virus that attacks these other OS infect us? Do you want the blame?"

    What is actually needed is some education to users about best practices, detection of infections and how to establish a safety and testing regimen.

  • by wcrowe (94389) on Monday May 02, 2011 @09:13AM (#35999312)

    We recently went through a PCI audit. The auditor wanted to make sure that we had antivirus software for our IBM System i. At first we thought he was crazy, but we discovered that such software DOES exist. However, it does not work quite the same way as on a Windows machine. The idea is that infected files, transferred from Windows PCs, can still reside on the System i, even though they cannot do any harm to that system. So they still need to be scanned. The same holds true for Linux and OS X machines. Those systems may not be subject to infection from viruses, but they can still store infected files, and these need to be scanned.

  • by Tom (822) on Monday May 02, 2011 @10:18AM (#35999958) Homepage Journal

    Read up on immunology and specifically the term "herd immunity".

    It's not just whether or not you are resistant to a virus, it is also if you help or hinder the spread. It takes surprisingly few non-vaccinated people in a population for an epidemic to get started. Because the spread of viruses, both biologically and in IT, is a numbers game. If the virus finds > 1.0 victims in its lifetime, it will spread and the number of infected hosts will steadily increase. Only if you manage to push down the infection rate to not even on hosts that are immune.

  • by Tom (822) on Monday May 02, 2011 @10:21AM (#35999988) Homepage Journal

    Read up on immunology and specifically the term "herd immunity".

    It's not just whether or not you are resistant to a virus, it is also if you help or hinder the spread. It takes surprisingly few non-vaccinated people in a population for an epidemic to get started. Because the spread of viruses, both biologically and in IT, is a numbers game. If the virus finds > 1.0 victims in its lifetime, it will spread and the number of infected hosts will steadily increase. Only if you manage to push down the infection rate to < 1.0 can you eliminate it.

    Anti-virus on a Mac or Linux system does not only protect the system itself, its purpose also is to protect other, for example windows, systems. You Linux may be immune to the Word macro virus, but if it can detect and kill it, that windows system you send it to doesn't get infected.

    If you know anything about how stuff spreads in a population, you positively don't want the stuff in your environment, not even on hosts that are immune.

    (edit: posting a 2nd time because /. stupid "plain old text" eats everything after the "lesser than" sign if you don't escape it...)

Are you having fun yet?

Working...