How secure is Linux really?

[Der tüddelige Fußgänger]

So i know that everyone says that the linux Kernel is very lightweight and secure. But how true is that?
I currently run Manjaro with the latest Linux 5.14.2-1 kernel.
I mainly worry because, in Germany where i live, there is a new law out since a few weeks, which gives our secret services the right to load a staatstrojaner (government trojan in english) on our devices. Of course it is for the security of our nation and to protect the people (no ♥♥♥♥ sherlock).

So that raises the question, now that the german government tries to keep security holes open for as long as possible, how secure is Linux / Manjaro (which has a german lead developer)
against trojans and spyware?
I know that it is already much more secure than windows or macOS, because Microsoft and apple both work with secret services. But what about something free and open like Linux?

And outside of my government, how secure is Linux against a trojan by a real hacker?
Sorry if this sounds weird. But this can't get our of my head for days.
thanks

[Omega]

The weakest links is still the user. Keep your OS up-to-date, do not download software from untrusted sources, and the chance of getting infected with malware or effectively none.

Modern operating systems and web-browsers are much more secure then they used to be ~10 years ago. You no longer have to worry about ending up on the wrong website which then installs malware on your computer.

Unix-like systems are by design very secure. A normal user is incapable of harming the system. Unix was originally a multiple user time sharing system, meaning many people used the same computer and often at the same time. The system was designed in such a way that one user could not influence the sessions and personal environments of others.

However, if you download trash on the internet and run it with root privileges then it is your responsibility. With root access you can install malware or destroy your system, the system will allow it all and not question anything. Luckily softwaredistribution on Linux is very secure, you should never have to download shady crap off the internet, you can instead rely on trusted and centralized repositories, or an "App store" as people usually call it.


The main benefit Linux would have over Windows would be that it is free software. Everyone can look at the source code and check it for bugs and issues. Windows is non-free, and through it being non-free they can install and hide mallicious functionality on your machine such as backdoors or leave known issues unpatched.
https://www.gnu.org/proprietary/proprietary-back-doors.html

[WarBucks]

Yup the user is the weakest link, and always will be.

You could spend a billion dollars on antivirus and firewall development. But when the user clicks "download and install anyway", well nothing can help that.

I honestly believe if you stuck people (the users I have supported over my carreer) in front of a linux computer as their primary workstation, theyd be virus ridden a month after they learned how to use it.

Im primarily a windows user but I have a DIY NAS and linux based network equipment. Linux is great but I keep it task specific

[Haruspex]

引用自 WarBucks：

I honestly believe if you stuck people (the users I have supported over my carreer) in front of a linux computer as their primary workstation, theyd be virus ridden a month after they learned how to use it.

Part of what makes Linux less virus-prone to the layman is the sheer overwhelming popularity of Windows. If some clueless Linux user downloads a trojan, chances are it just doesn't work because it was written for Windows, not that there aren't Linux viruses out there. It's just most are for Windows. Your average tech-support scammer will be extremely lost trying to scam grandma on her Linux machine.

Of course as Linux gains popularity, this becomes less and less of benefit, because the more people are out there using Linux, the more viruses and scams will be written with Linux in mind. The user is the weak link, and most average users don't even think twice when giving an application privileges. One password prompt and your whole system is now compromised.

[emoticorpse]

I generally think os doesn't matter so much as a person using it. So if your question is how likely is it you'd win a cyberbattle against someone who actually dedicates his life to penetrating systems for whatever reason, you'd probably lose. You'll probably never find out though, since what reason does a serious/real hacker have to actually target you out of everybody out there?. They're probably busy actually trying to gain access to a system that matters.

[Electric Cupcake]

As far as Government-sanctioned cracking goes,
https://xkcd.com/538/

[[N]ebsun]

It depends on the user and setup. Linux is generally more secure due to strict file permissions and separation of accounts.

Open source software allows everyone to see how it works and what it does, and a lot of software for Linux is open source.

Package managers mitigate the chance of a user installing software from unknown sources (though there is no guarantee that all packages in your package manager are safe).

Use antivirus, firewall, and system security auditing tools like lynis or SELinux if you really need better control of security.

If you aim to reach something like pci-dss then you will have very good security.

Linux is as secure as you make - YOU have the control.

[plat]

引用自 emoticorpse：

...a serious/real hacker have to actually target you out of everybody out there?. They're probably busy actually trying to gain access to a system that matters.

Exactly! I looked on the net--Windows market share is 75% versus all Linux at 1.93%. So as a rough idea, the amount of threats are proportionate to the amount of users for any given operating system. Not saying Linux is bullet proof b/c it isn't. It's just rarer to come across any but like Windows, risks are higher in an Enterprise environment with a vulnerable network system.

For general home users, it just ain't profitable.

[Si]

The Government will have seemingly unlimited resources, a very powerful adversary. Linux can’t protect against them forever unfortunately, it does have security holes and zero day exploits are the kind of things a government will have.

Just keep your system up to date and only download from trusted sources. The chances of you getting hit with any government created malware are incredibly low, they save the zero days for the most wanted. Of course the problem is that governments are useless at keeping this under wraps and secure, like when one of those US alphabet agencies got hacked and had all their exploits stolen, which then spread like wildfire across windows systems. That’s what you need to watch out for and that’s why these laws are dumb they only end up making law abiding citizens less secure but some would argue that’s the entire point behind them.

[[N]ebsun]

引用自 plat：

引用自 emoticorpse：

...a serious/real hacker have to actually target you out of everybody out there?. They're probably busy actually trying to gain access to a system that matters.

Exactly! I looked on the net--Windows market share is 75% versus all Linux at 1.93%. So as a rough idea, the amount of threats are proportionate to the amount of users for any given operating system. Not saying Linux is bullet proof b/c it isn't. It's just rarer to come across any but like Windows, risks are higher in an Enterprise environment with a vulnerable network system.

For general home users, it just ain't profitable.

Every android phone runs Linux
Many servers run Linux
Amazon services pretty much all run Linux
POS systems almost all Linux
IoT devices - almost all Linux
Routers, Switches, Datacentres - nearly all Linux
Remote weather stations, lightning detectors

Your smart fridge, washing machine, smart x... probably run Linux

I don't know where you get that 1.93% figure from, but it sounds a bit off.

[Haruspex]

引用自 Nebsun：

引用自 plat：

Exactly! I looked on the net--Windows market share is 75% versus all Linux at 1.93%. So as a rough idea, the amount of threats are proportionate to the amount of users for any given operating system. Not saying Linux is bullet proof b/c it isn't. It's just rarer to come across any but like Windows, risks are higher in an Enterprise environment with a vulnerable network system.

For general home users, it just ain't profitable.

Every android phone runs Linux
Many servers run Linux
Amazon services pretty much all run Linux
POS systems almost all Linux
IoT devices - almost all Linux
Routers, Switches, Datacentres - nearly all Linux
Remote weather stations, lightning detectors

Your smart fridge, washing machine, smart x... probably run Linux

I don't know where you get that 1.93% figure from, but it sounds a bit off.

It's something like that percentage for desktop PC users. If you were to count phones and routers and smart toasters or whatever, it would probably be much, much higher.

[plat]

In this context, only desktop share. Here is a snip I took from Sept. 2021 Statista--the page contains an embedded ad so no link here.

https://i.imgur.com/oSh5od0.png