Wayoyin cuta a cikin GNU / Linux: Gaskiya ko Labari?

Duk lokacin da muhawara ta kare virus y GNU / Linux ba a dauki lokaci ba kafin mai amfani ya bayyana (yawanci Windows) me aka ce:

«A cikin Linux babu ƙwayoyin cuta saboda mahaliccin waɗannan ɓarnatattun shirye-shiryen basa ɓata lokaci don yin wani abu don Tsarin Tsarin aiki wanda kusan babu wanda ke amfani da shi »

Abin da koyaushe na amsa:

"Matsalar ba haka ba ce, amma waɗanda suka kirkiro waɗannan mugayen shirye-shiryen ba za su ɓata lokaci wajen ƙirƙirar abin da za a gyara tare da sabuntawar farko na tsarin ba, ko da a ƙasa da awanni 24"

Kuma ban yi kuskure ba, kamar yadda aka buga wannan labarin mai kyau a cikin Lamba 90 (Shekarar 2008) daga Todo Linux Magazine. Jaruminsa David santo samar da mu ta hanyar fasaha (amma mai sauƙin fahimta) bayanin me yasa GNU / Linux rasa irin wannan muguwar manhajar.

An ba da shawarar 100%. Yanzu zasu sami abubuwa masu gamsarwa don rufe duk wanda yayi magana ba tare da tushe mai tushe akan wannan batun ba.

Zazzage Labari (PDF): Labari da Gaskiya: Linux da ƙwayoyin cuta

Edita:

Anan ga rubutaccen labarin, yayin da muke la'akari da cewa yafi kwanciyar hankali karantawa ta wannan hanyar:

================================================== ======================

Muhawarar Linux da virus ba sabon abu bane. Kowane lokaci muna ganin imel a jerin suna tambaya idan akwai ƙwayoyin cuta na Linux; kuma kai tsaye wani ya amsa tabbatacce kuma yayi iƙirarin cewa idan basu fi shahara ba saboda Linux bai yadu kamar Windows ba. Hakanan akwai fitowar manema labarai akai-akai daga masu haɓaka riga-kafi suna cewa suna sakin nau'ikan ƙwayoyin cuta na Linux.

Ni kaina na taɓa tattaunawa lokaci-lokaci tare da mutane daban-daban ta hanyar wasiƙa, ko ta jerin rarrabawa, game da batun ko babu ƙwayoyin cuta a cikin Linux. Labari ne na almara, amma yana da wuyar warware almara ko kuma, ƙaryar banza, musamman idan sha'awar tattalin arziki ce ta haifar da ita. Wani yana da sha'awar isar da ra'ayin cewa idan Linux ba ta da irin waɗannan matsalolin, to ƙananan mutane ne ke amfani da shi.

A lokacin wallafa wannan rahoton na so in rubuta tabbataccen rubutu game da kasancewar ƙwayoyin cuta a cikin Linux. Abin takaici, lokacin da camfi da sha'awar tattalin arziki suka yi yawa, yana da wuya a gina wani abu tabbatacce.
Koyaya, za mu yi ƙoƙari mu kawo cikakkiyar hujja a nan don kwance damarar duk wanda ke son yin jayayya.

Menene ƙwayar cuta?

Da farko dai, zamu fara da bayyana menene kwayar cuta. Shiri ne da yake kwafa kansa kuma yake gudanar da shi kai tsaye, kuma wannan yana da niyyar sauya yadda computer ke tafiya daidai, ba tare da izinin mai amfani ba ko kuma masaniyarsa. Don yin wannan, ƙwayoyin cuta suna maye gurbin fayilolin aiwatarwa tare da wasu waɗanda suka kamu da lambar su. Ma'anar ta daidaitacce, kuma taƙaitaccen layi ne na shigarwar Wikipedia akan ƙwayoyin cuta.
Mafi mahimmancin ɓangare na wannan ma'anar, kuma wanda ya banbanta kwayar cutar da sauran malware, shine cewa kwayar cuta ta girka kanta, ba tare da izinin mai amfani ba ko sani. idan ba ta girka kanta ba, ba kwayar cuta ba ce: tana iya zama rootkit, ko Trojan.

Tushen rootkit ne wanda yake ba ku damar ɓoye wasu matakai daga masarufin yankin mai amfani. A wasu kalmomin, gyare-gyare ne na lambar asalin kernel wanda ma'anar sa shine cewa masu amfani waɗanda ke ba mu damar ganin abin da ke gudana a kowane lokaci baya nuna wani tsari, ko wani mai amfani.

Trojan yana da kwatankwacinsa: gyara ne ga lambar tushe na takamaiman sabis don ɓoye wasu ayyukan zamba. A duka lokuta biyun, ya zama dole a sami lambar tushe na ainihin sigar da aka sanya a kan injin Linux, facin lambar, sake tattara ta, samun gatan mai gudanarwa, shigar da facin aiwatarwa, da kuma fara aikin –a batun Trojan– ko tsarin aiki. cikakke - a yanayin
rootkit -. Tsarin, kamar yadda muke gani, ba ƙaramin abu bane, kuma babu wanda zai iya yin wannan duka “bisa kuskure”. Dukansu suna buƙatar shigarwar su cewa wani tare da gatan mai gudanarwa, da hankali, ya aiwatar da jerin matakan yanke shawara na yanayin fasaha.

Wanne ba abu ne mai mahimmanci ba: don kwayar cutar ta girka kanta, duk abin da zamu yi shine gudanar da shirin kamuwa da cuta azaman gama gari. A gefe guda kuma, don girka na rootkit ko Trojan, yana da mahimmanci mutum mai ƙeta da kansa ya shiga tushen asusun inji, kuma ta hanyar da ba ta atomatik ba, ya aiwatar da wasu matakai waɗanda za a iya gano su. kwayar cuta tana yaduwa cikin sauri da inganci; rootkit ko Trojan yana buƙatar su don su keɓance mu musamman.

Watsa ƙwayoyin cuta a cikin Linux:

Tsarin yaduwar kwayar cuta, saboda haka, shine ainihin abinda yake bayyana shi a matsayin haka, kuma shine asalin kasancewar su. tsarin aiki ya fi kulawa da ƙwayoyin cuta mafi sauƙi shine haɓaka ingantaccen hanyar watsawa ta atomatik.

Ace muna da kwayar cutar da take son yada kanta. A ce wani mai amfani na yau da kullun ne ya ƙaddamar da shi, ba tare da laifi ba, yayin ƙaddamar da shirin. Wannan kwayar cutar tana da hanyoyin watsawa guda biyu ne kawai:

• Maimaita kanta ta hanyar taɓa ƙwaƙwalwar wasu matakai, haɗa kansu zuwa gare su a lokacin aiki.
• Bude fayilolin aiwatarwa masu aiwatarwa, da kuma kara lambar su -payload-- zuwa mai aiwatarwa.

Duk ƙwayoyin cuta waɗanda zamu iya la'akari da su suna da ɗayan ɗayan waɗannan hanyoyin watsawa guda biyu. Ya biyu. Babu sauran hanyoyin.
Game da kayan aikin farko, bari mu tuna da tsarin ƙwaƙwalwar ajiya na Linux da yadda masu sarrafa Intel ke aiki. Wadannan suna da zobba guda hudu, adadi daga 0 zuwa 3; ƙananan lambar, mafi girman gatan da lambar da ke gudana a cikin wannan zobe ke da su. Waɗannan zobba suna dacewa da jihohin mai sarrafawa, sabili da haka, tare da abin da za'a iya yi tare da tsarin kasancewa cikin keɓaɓɓen zobe. Linux yana amfani da zobe 0 don kwaya, kuma ringi 3 don aiwatarwa. babu lambar aiwatarwa wacce take gudana akan ring na 0, kuma babu lambar kernel da ke gudana akan ring 3. Akwai hanyar shigarwa guda ɗaya zuwa kwaya daga zobe 3: katsewar 80h, wanda ke ba da damar tsalle daga yankin inda yake lambar amfani ga yankin da lambar kwaya take.

Ginin Unix gabaɗaya da Linux musamman bai sa yaduwar ƙwayoyin cuta ya yiwu ba.

Kernel ta amfani da ƙwaƙwalwar ajiya ta sa kowane tsari yayi imani cewa yana da dukkan ƙwaƙwalwar ajiyar kanta. Wani tsari - wanda ke aiki a ring 3 - zai iya ganin ƙwaƙwalwar ajiya wacce aka saita ta domin ita, don zobe da yake aiki a ciki. Ba wai an tuna da sauran ayyukan ba; shi ne cewa don tsari ɗaya ƙwaƙwalwar ajiyar wasu a waje da sararin adireshin. Idan wani tsari zai doke duk adiresoshin ƙwaƙwalwar, to ba zai ma iya yin tsokaci ga adireshin ƙwaƙwalwar na wani aikin ba.

Me yasa baza'a iya yaudarar wannan ba?
Don gyara maganganun - alal misali, samar da wuraren shigarwa a cikin ring 0, gyara katsewa vectors, gyara ƙwaƙwalwar ajiya, gyara LGDT ... - yana yiwuwa ne kawai daga ring 0.
Wato, don tsari don samun damar taɓa ƙwaƙwalwar wasu matakai ko kwaya, yakamata ya zama kwaron da kansa. Kuma gaskiyar cewa akwai ma'ana guda ta shigarwa kuma cewa ana wuce sigogi ta hanyar masu rijista yana rikitar da tarkon - a zahiri, ana ratsa ta cikin rijistar har zuwa abin da za ayi, wanda kuma aka aiwatar dashi azaman shari'ar kulawa. katsewar 80h.
Wani yanayin shine yanayin tsarin aiki tare da ɗaruruwan kira mara izini don ringi 0, inda wannan zai yiwu - koyaushe ana iya samun kiran da aka manta da shi wanda za'a iya ƙirƙirar tarko - amma game da tsarin aiki tare da irin wannan sauki mataki inji, shi ne ba.

Saboda wannan, tsarin ƙwaƙwalwar ajiyar ƙwaƙwalwar ajiya yana hana wannan aikin watsawa; babu matakai - har ma wadanda ke da gata na asali - suna da hanyar samun damar kwakwalwar wasu. Zamu iya jayayya cewa tsari na iya ganin kwayar; tana da shi a taswira daga adreshin ƙwaƙwalwar da ke daidai 0xC0000000. Amma, saboda zoben processor da yake aiki a kansa, ba za ku iya gyaggyara shi ba; zai haifar da tarko, tunda sune wuraren ƙwaƙwalwar ajiya waɗanda suke cikin wani zoben.

"Maganin" zai zama shiri ne wanda ke canza lambar kwaya yayin fayil. Amma gaskiyar cewa waɗannan an sake buga su ya sa ba zai yiwu ba. Ba za a iya facin binary ba, tunda akwai miliyoyin kernel na duniya a duniya. A sauƙaƙe lokacin da suke sake sarrafa shi sun sanya ko cire wani abu daga kernel wanda za'a iya aiwatarwa, ko kuma sun canza girman ɗayan tambarin da ke gano sigar tattarawa - wani abu da akeyi koda ba da gangan ba - ba za'a iya amfani da facin binary ba. Madadin zai kasance shine zazzage lambar tushe daga Intanet, sanya shi, saita shi don kayan aikin da ya dace, tara shi, girka shi, da sake yin inji. Duk wannan yakamata ayi ta shirin, ta atomatik. Aalubale ne ga fagen ilimin ɗan Adam.
Kamar yadda muke gani, ba ma wata kwayar cuta kamar yadda tushe zata iya tsallake wannan shingen ba. Iyakar abin da ya rage shine watsawa tsakanin fayilolin aiwatarwa. Wanne ba ya aiki ko dai kamar yadda za mu gani a ƙasa.

Kwarewata a matsayin mai gudanarwa:

A cikin fiye da shekaru goma da nake kula da Linux, tare da girke-girke kan ɗaruruwan na'urori a cibiyoyin bayanai, dakunan gwaje-gwaje na ɗalibai, kamfanoni, da dai sauransu.

• Ban taɓa samun "ƙwayar cuta" ba
• Ban taba saduwa da wani ba
• Ban taba saduwa da wani wanda ya hadu da wani da ya faru da shi ba

Na san mutane da yawa waɗanda suka ga Loch Ness Monster fiye da ganin ƙwayoyin cuta na Linux.
Da kaina, Na yarda da cewa na yi sakaci, kuma na ƙaddamar da shirye-shirye da yawa waɗanda masu kiran kansu "ƙwararru" ke kira "ƙwayoyin cuta na Linux" - daga yanzu, zan kira su ƙwayoyin cuta, ba don yin rubutun ba - Asusun da na saba a kan mashina, don ganin idan kwayar cuta ta yiwu: duka kwayar cutar bash wacce ke zagayawa a wurin - kuma wacce, a kan hanya, ba ta cutar da kowane fayiloli - da kwayar cutar da ta shahara sosai, kuma ta bayyana a cikin manema labarai . Nayi kokarin girka shi; kuma bayan mintuna ashirin na aiki, na daina yayin da na ga cewa ɗaya daga cikin buƙatunta shine a sami kundin tmp ɗin a ɓangaren nau'in MSDOS. Da kaina, ban san kowa ba wanda ya ƙirƙiri takamaiman bangare don tmp kuma ya tsara shi zuwa FAT.
A zahiri, wasu da ake kira ƙwayoyin cuta waɗanda na gwada wa Linux suna buƙatar babban matakin ilimi da tushen kalmar shiga da za a girka. Zamu iya cancanta, aƙalla, a matsayin "mahaukaciyar ƙwaya" ta ƙwayoyin cuta idan tana buƙatar sa hannunmu don cutar da na'urar. Bugu da ƙari, a wasu lokuta suna buƙatar cikakken ilimin UNIX da tushen kalmar sirri; wanda yake nesa da shigarwa ta atomatik wanda yakamata ya kasance.

Kamuwa da masu aiwatarwa akan Linux:

A kan Linux, tsari zai iya yin abin da mai amfani da izini mai amfani ke bayarwa kawai. Gaskiya ne cewa akwai hanyoyin musayar ainihin mai amfani da kuɗi, amma kaɗan. Idan muka kalli inda ake aiwatarwa, za mu ga cewa tushen ne kawai ke da gatan rubutu a cikin wadannan kundin adireshi da cikin fayilolin da ke ciki. A wasu kalmomin, tushen kawai zai iya gyara waɗannan fayilolin. Wannan haka lamarin yake a Unix tun daga shekarun 70s, a cikin Linux tun daga asalinsa, kuma a cikin tsarin fayil wanda ke tallafawa gata, har yanzu babu wani kuskure da ya bayyana wanda zai ba da damar wasu halayen. Tsarin fayilolin zartarwa na ELF sananne ne kuma an adana su da kyau, don haka yana yiwuwa a zahiri fasaha don irin wannan nau'in don ɗora kaya a cikin wani fayil na ELF ... muddin mai amfani mai amfani na tsohon ko ingantaccen rukuni na na farko suna da damar shiga karatu da rubutu da aiwatarwa a fayil na biyu. Da yawa masu aiwatar da tsarin fayil zasu iya kamuwa a matsayin mai amfani na kowa?
Wannan tambayar tana da amsa mai sauƙi, idan muna so mu san fayiloli nawa za mu iya "harba", mun ƙaddamar da umarnin:

$ find / -type f -perm -o=rwx -o \( -perm -g=rwx -group `id -g` \) -o \( -perm -u=rwx -user `id -u` \) -print 2> /dev/null | grep -v /proc

Muna ware kundin adireshin / proc saboda tsarin fayel ne na kamala wanda yake nuna bayanai game da yadda tsarin aiki yake. Fayil ɗin nau'in fayil ɗin tare da gatan aiwatarwa waɗanda za mu same su ba sa kawo matsala, tunda galibi hanyoyin haɗi ne na kama-da-wane waɗanda suke kama da karantawa, rubutawa da aiwatarwa, kuma idan mai amfani ya gwada, ba ya aiki. Har ila yau, muna cire kurakurai, suna da yawa - tunda, musamman a cikin / proc da / gida, akwai kundin adireshi da yawa inda mai amfani da kowa ba zai iya shiga ba -. Wannan rubutun yana ɗaukar lokaci mai tsawo. A yanayinmu na musamman, akan na'urar da mutane hudu ke aiki, amsar ita ce:

/tmp/.ICE-unix/dcop52651205225188
/tmp/.ICE-unix/5279
/home/irbis/kradview-1.2/src
/kradview

Sakamakon ya nuna fayiloli guda uku waɗanda zasu iya kamuwa da cuta idan aka gudanar da cutar kwayar cutar. Biyun farko sune fayilolin nau'in soket na Unix waɗanda aka share su a farawa - kuma ba za a iya kamuwa da su ba - kuma na uku shine fayil ɗin shirin ci gaba, wanda ake sharewa duk lokacin da aka sake buga shi. Kwayar cutar, ta mahangar amfani, ba za ta yadu ba.
Daga abin da muke gani, hanya guda kawai don shimfiɗa ƙarin biyan kuɗi ita ce kasancewa tushen. A wannan yanayin, don ƙwayar cuta tayi aiki, dole ne masu amfani koyaushe su sami gatan gudanarwa. A wannan yanayin, tana iya ɗaukar fayiloli. Amma ga abin kamawa: don yada kamuwa da cutar, kuna buƙatar ɗaukar wani wanda za a kashe, aika shi zuwa wani mai amfani wanda kawai yake amfani da inji azaman tushe, kuma maimaita aikin.
A cikin tsarin aiki inda ya zama dole ya zama mai gudanarwa don ayyuka gama gari ko gudanar da aikace-aikace da yawa na yau da kullun, wannan na iya zama lamarin. Amma a cikin Unix ya zama dole ya zama mai gudanarwa don saita inji da canza fayilolin sanyi, saboda haka adadin masu amfani da asusun asalin ke amfani da su azaman asusun yau da kullun kaɗan ne. Ya fi; wasu rarraba Linux basu ma da tushen asusun ba. A kusan dukkanin su, idan kuka sami damar yanayin zane kamar haka, bango ya canza zuwa ja mai tsanani, kuma ana maimaita saƙonni koyaushe waɗanda ke tunatar da cewa bai kamata a yi amfani da wannan asusun ba.
A ƙarshe, duk abin da yakamata ayi kamar tushen za a iya aiwatar dashi tare da umarnin sudo ba tare da haɗari ba.
A saboda wannan dalili, a cikin Linux mai aiwatarwa ba zai iya harba wasu ba muddin ba mu yin amfani da asusun asali kamar asusun amfani da kowa; Kuma kodayake kamfanonin riga-kafi sun nace kan cewa akwai ƙwayoyin cuta don Linux, hakika mafi kusa abin da za'a iya ƙirƙirar shi a cikin Linux shine Trojan a yankin masu amfani. Hanyar hanyar da waɗannan Trojan zasu iya shafar wani abu akan tsarin shine ta hanyar tafiyar dashi azaman tushe kuma tare da gatan da ake buƙata. Idan yawanci muna amfani da inji azaman masu amfani na yau da kullun, ba zai yuwu ba ga tsarin da mai amfani da shi ya gabatar ya cutar da tsarin.

Labari da karya:

Mun sami tatsuniyoyi da yawa, labaran karya, da ƙarairayi kawai game da ƙwayoyin cuta a cikin Linux. Bari muyi jerin su bisa ga tattaunawar da ta faru a wani lokaci da suka gabata tare da wakilin masana'antar riga-kafi na Linux wanda ya ji haushi ƙwarai da labarin da aka buga a cikin wannan mujallar.
Wannan tattaunawar misali ce mai kyau, kamar yadda ta shafi dukkan bangarorin ƙwayoyin cuta a cikin Linux. Zamu sake nazarin duk wadannan tatsuniyoyin daya bayan daya kamar yadda aka tattauna su a waccan takamaiman tattaunawar, amma wacce aka maimaita ta sau da yawa a wasu dandalin.

Labari 1:
"Ba duk shirye-shirye masu ƙeta ba, musamman ƙwayoyin cuta, suna buƙatar gata ta asali don cutarwa, musamman a cikin batun ƙwayoyin cuta masu saurin aiwatarwa (tsarin ELF) waɗanda ke cutar da wasu masu aiwatarwa".

Amsa:
Duk wanda yayi irin wannan da'awar bai san yadda tsarin gatan Unix yake aiki ba. Domin shafar fayil, ƙwayar cuta na buƙatar alfarmar karatu – dole ne a karanta shi don gyaggyara shi-, kuma dole ne a rubuta –a rubuta –wajan gyara ya zama mai inganci – kan fayil ɗin da yake son aiwatarwa.
Wannan koyaushe haka lamarin yake, ba tare da togiya ba. Kuma a kowane ɗayan rarraba, masu amfani da tushen basu da waɗannan gatan. Sannan kawai tare da rashin tushe, kamuwa da cuta ba zai yiwu ba. Gwajin gwaji: A cikin sashin da ya gabata mun ga rubutu mai sauƙi don bincika kewayon fayilolin da kamuwa da cuta zai iya shafa. Idan muka ƙaddamar da shi a kan injinmu, za mu ga yadda ba zai yiwu ba, kuma game da fayilolin tsarin, babu. Hakanan, ba kamar tsarin aiki kamar Windows ba, baku buƙatar gatan mai gudanarwa don yin ayyuka na yau da kullun tare da shirye-shiryen da masu amfani da al'ada ke amfani da su.

Labari 2:
"Hakanan basu buƙatar zama tushen shiga tsarin nesa ba, a game da Slapper, tsutsa wanda, yin amfani da rauni a cikin Apache's SSL (takaddun shaida da ke ba da damar sadarwar amintacce), ya ƙirƙiri nasa cibiyar sadarwar zombie a cikin Satumba 2002".

Amsa:
Wannan misali baya nufin kwayar cuta, amma tsutsa. Bambancin yana da mahimmanci: tsutsa shiri ne wanda ke amfani da sabis don Intanet don watsa kansa. Ba ya shafar shirye-shiryen gida. Saboda haka, yana shafar sabobin kawai; ba wasu inji ba.
Tsutsotsi koyaushe sun kasance 'yan kaɗan kuma ba abin da ya faru. Abubuwa uku masu mahimmancin gaske an haife su ne a cikin shekaru 80, lokacin da Intanet ba ta da laifi, kuma kowa ya amince da kowa. Mu tuna cewa sune wadanda suka shafi aika sako, yatsa da rexec. Yau abubuwa sun fi rikitarwa. Kodayake ba za mu iya musun cewa suna nan ba kuma hakan, idan ba a kiyaye su ba, suna da haɗari sosai. Amma yanzu, lokutan amsawa ga tsutsotsi gajere ne. Wannan shine batun Slapper: tsutsa da aka kirkira akan yanayin rauni wanda aka gano - kuma aka facin - watanni biyu kafin bayyanar tsutsa kanta.
Ko da ɗauka cewa duk wanda ke amfani da Linux yana da Apache yana aiki kuma yana aiki koyaushe, sauƙaƙe abubuwan fakitin kowane wata sun isa fiye da yadda ba za su taɓa fuskantar haɗari ba.
Gaskiya ne cewa kwaron SSL da Slapper ya haifar ya kasance mai mahimmanci - a zahiri, babban kwaro da aka samo a cikin tarihin SSL2 da SSL3 - kuma saboda haka an gyara shi cikin awanni. Cewa wata biyu bayan an gano wannan matsalar kuma an warware ta, wani ya yi tsutsa a kan kwaro wanda tuni an gyara shi, kuma wannan shine mafi ƙarfin misali da za'a iya bayarwa azaman rauni, aƙalla yana tabbatarwa.
A matsayinka na ƙa'ida, mafita ga tsutsotsi ba shine siyan riga-kafi ba, girka ta da ɓata lokacin sarrafa kwamfuta don kiyaye shi mazaunin. Mafitar ita ce yin amfani da tsarin sabunta tsaro na rarrabawar mu: idan aka sabunta rarrabawa, babu wasu matsaloli. Gudanar da ayyukan da muke buƙata shi ma kyakkyawan ra'ayi ne saboda dalilai biyu: muna haɓaka amfani da albarkatu, kuma muna guje wa matsalolin tsaro.

Labari 3:
"Ba na tsammanin ainihin abin ba zai yiwu ba. A zahiri, akwai ƙungiyar shirye-shirye masu ɓarna da ake kira LRK (Linux Rootkits Kernel), waɗanda suka dace daidai da amfani da rauni a cikin ƙananan kernel da maye gurbin tsarin binaries.".

Amsa:
Tushen rootkit shine asalin facin kernel wanda zai baka damar ɓoye kasancewar wasu masu amfani da tsari daga kayan aikin da aka saba dasu, saboda gaskiyar cewa ba zasu bayyana a cikin / proc directory ba. Abu na yau da kullun shine suyi amfani da shi a ƙarshen harin, da farko, zasuyi amfani da yanayin rauni don samun damar amfani da na'urar mu. Sannan za su gudanar da jerin hare-hare, don haɓaka dama har sai sun sami asusun asali. Matsalar idan suka yi ita ce yadda za a girka sabis a kan injinmu ba tare da an gano su ba: anan ne tushen tushen yake shigowa. An ƙirƙiri wani mai amfani wanda zai zama ingantaccen mai amfani da sabis ɗin da muke son ɓoye shi, suna shigar da rootkit, kuma suna ɓoye mai amfani da duk hanyoyin da mai amfanin yake.
Yadda za a ɓoye kasancewar mai amfani yana da amfani ga ƙwayoyin cuta abu ne da zamu iya tattaunawa mai tsawo, amma kwayar cutar da ke amfani da rootkit don girka kanta kamar daɗi. Bari muyi tunanin makanikai na kwayar cutar (a cikin pseudocode):
1) Kwayar cuta ta shiga cikin tsarin.
2) Gano lambar asalin kernel. Idan kuwa ba haka ba, sai ya girka da kansa.
3) Sanya kernel don zaɓuɓɓukan kayan aikin da suka shafi inji da ake magana akai.
4) Tattara kwaya.
5) Sanya sabon kwaya; gyaggyara LILO ko GRUB idan ya zama dole.
6) Sake yi inji.

Matakai (5) da (6) na buƙatar gatan tushen. Yana da ɗan rikitarwa cewa ba a gano matakai (4) da (6) waɗanda suka kamu da cutar ba. Amma abin ban dariya shine akwai wanda ya yarda cewa akwai shirin da zai iya yin mataki na (2) da (3) kai tsaye.
A matsayina na ƙarshe, idan muka haɗu da wani wanda ya gaya mana "idan an sami ƙarin injunan Linux za a sami ƙwayoyin cuta da yawa", kuma ya bada shawarar "sanya riga-kafi da sabunta shi koyaushe", mai yiwuwa yana da alaƙa da kamfanin da ke tallata riga-kafi da sabuntawa . Yi hankali, mai yiwuwa mai shi ɗaya.

Antivirus don Linux:

Gaskiya ne cewa akwai kyawawan riga-kafi don Linux. Matsalar ita ce, ba su yin abin da masu rigakafin riga-kafi ke jayayya. Aikinta shine tace wasikun da suka shigo daga malware da ƙwayoyin cuta zuwa Windows, da kuma tabbatar da kasancewar ƙwayoyin cuta na Windows a cikin manyan fayilolin da aka fitar dasu ta hanyar SAMBA; don haka idan muka yi amfani da injinmu azaman ƙofar wasiƙa ko azaman NAS don injunan Windows, zamu iya kiyaye su.

Kirana-AV:

Ba za mu gama rahotonmu ba tare da magana game da babban riga-kafi na GNU / Linux: ClamAV ba.
ClamAV babbar rigakafin GPL ce mai ƙarfi wacce ke tattara abubuwa don yawancin Unix ɗin da ke kasuwa. An tsara shi don bincika haɗe-haɗe zuwa saƙonnin imel da ke wucewa ta tashar kuma a tace su don ƙwayoyin cuta.
Wannan aikace-aikacen yana haɗawa daidai tare da aika saƙo don ba da izinin tace ƙwayoyin cuta da za a iya adana su a cikin sabar Linux waɗanda ke ba da imel ga kamfanoni; samun bayanai na kwayar cutar da ake sabuntawa kullun, tare da tallafi na dijital. Ana sabunta bayanan bayanan sau da yawa a rana, kuma aiki ne mai ban sha'awa da ban sha'awa sosai.
Wannan shirin mai iko yana iya nazarin ƙwayoyin cuta har ma a cikin haɗe-haɗe a cikin hadaddun tsare-tsaren da za a buɗe, kamar RAR (2.0), Zip, Gzip, Bzip2, Tar, MS OLE2, fayilolin Cabinet na MS, MS CHM (HTML Mai Rarraba), da MS SZDD .
ClamAV kuma yana goyan bayan mbox, Maildir, da fayilolin wasiku na RAW, da Fayil masu ɗaukewa mai ɗauke da UPX, FSG, da Petite. Clam AV da spamassassin biyu sune cikakkun biyun don kare abokan cinikinmu na Windows daga sabobin wasikun Unix.

GUDAWA

Zuwa tambaya shin Shin akwai yanayin rauni a cikin tsarin Linux? amsar tabbas haka ne.
Babu wani mai hankalin da zai yi shakkar hakan; Linux ba shine OpenBSD ba. Wani abu shine taga yanayin rauni wanda tsarin Linux yake dashi wanda aka sabunta shi da kyau. Idan muka tambayi kanmu, shin akwai kayan aikin da za mu yi amfani da waɗannan ramuka na tsaro, mu yi amfani da su? Da kyau, ee, amma waɗannan ba ƙwayoyin cuta bane, amfani ne kawai.

Dole ne kwayar cutar ta shawo kan wasu matsaloli da yawa wadanda masu kare Windows suka sanya ta a matsayin matsala ta Linux / matsala, kuma hakan yana wahalar da kasancewar kwayar cutar ta gaske - kwayayen da aka sake su, nau'ikan aikace-aikace da yawa, rarrabawa da yawa, abubuwan da basu ta atomatik wucewa ga mai amfani a bayyane, da dai sauransu -. Dole ne a shigar da "ƙwayoyin cuta" na yau da kullun da hannu daga asalin asusun. Amma ba za a iya ɗaukar hakan a matsayin cuta ba.
Kamar yadda koyaushe nake fadawa dalibata: kar ku yarda da ni, don Allah. Zazzage kuma shigar da rootkit akan injin. Idan kuma kana son kari, karanta lambar tushe ta "kwayoyin cuta" a kasuwa. Gaskiya tana cikin lambar tushe. Yana da wahala "kwayar cutar da kanta" ta ci gaba da sanya mata suna a wannan hanyar bayan karanta lambarta. Kuma idan baku san yadda ake karanta lambar ba, mizanin tsaro mai sauƙi wanda nake ba da shawara: yi amfani da tushen asusun kawai don sarrafa inji, kuma kiyaye sabunta tsaro har zuwa yau.
Da wannan kawai ba zai yuwu ƙwayoyin cuta su shiga cikinku ba kuma da wuya tsutsotsi ko wani ya farma injinku cikin nasara.