Linux Security Packages Fail Malware Detection Tests

In a recent laboratory test conducted by SITS Deutschland GmbH (AV-TEST), 16 antivirus solutions for Linux operating systems were put through rigorous evaluation. The results indicated substantial deficiencies, particularly in detecting Windows malware, which is concerning given the increasing use of Linux machines in conjunction with Windows environments.

The 16 tested software packages, comprising both desktop and server solutions, were challenged to identify threats within an Ubuntu Linux environment. Despite Linux's general reputation for security, its prevalent role in web servers and its integration into Windows networks make it an attractive target for attackers. The issue intensifies when Linux machines are utilized as a conduit for distributing Windows malware.

The test outcomes demonstrated that several software programs detected only a fraction of Windows malware. Up to 85% of Windows threats went unrecognized by some solutions. For instance, McAfee's detection rate stood at only 85.1%, and Comodo's at 83%. The situation was even more dire for F-Prot (22.1%) and ClamAV (15.3%). Symantec's solution achieved 100% detection for Windows threats, with eight other solutions coming close to full detection.

Deficiencies were also noted in the detection of native Linux malware. Only Kaspersky Endpoint Version and ESET achieved near-complete detection rates (100% and 99.7%, respectively). The test also included an assessment of false positives, but specific details were not released.

AV-TEST advises the use of security solutions for Linux systems, especially in networks that include Windows components. While Linux malware might not directly harm the system itself, it can remain dormant and subsequently spread to Windows machines.