AV-TEST: Many Linux Security Packages Show Weak Malware Detection

German testing lab AV-TEST has released a comprehensive evaluation of 16 security products designed for Linux systems. The results indicate concerning weaknesses in malware detection, highlighting the need for stronger security measures on Linux servers and desktops.

The test focused on the effectiveness of these products in identifying malware targeting both Windows and Linux platforms. Many Linux machines operate within networks alongside Windows PCs, and with approximately half of all web servers running Linux, they represent an attractive target for attackers seeking to use them as a bridgehead for Windows threats.

The findings revealed that several of the tested products detected only around 85% of Windows malware, with up to 75% of purely Linux-specific malicious code remaining entirely undetected. McAfee and Comodo exhibited particularly weak performance in Windows malware detection, while Dr. Web, F-Prot, and ClamAV also showed significantly low detection rates.

Detection rates for Linux malware were even more challenging. Only Kaspersky Endpoint Version achieved a full 100% detection rate for Linux threats. ESET NOD32 Antivirus for Linux Desktop, Kaspersky Antivirus for Linux File Server, and Sophos for Linux were noted as better performers, though deficiencies were still present.

AV-TEST emphasizes that while Linux is traditionally considered secure, the increasing prevalence of targeted malware and user errors, such as installing software from untrusted sources, are raising risks. The report suggests that both businesses and individuals should reassess and enhance the security of their Linux environments.