Linux Malware Detect

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
Linux Malware Detect
Output of a sample run of LMD
Output of a sample run of LMD
Developer(s)R-fx Networks
Stable release
1.6.4 / March 18 2019
Operating systemLinux
TypeLinux malware Detector
LicenseGNU GPL v2
Websitewww.rfxn.com/projects/linux-malware-detect/

Linux Malware Detect often abbreviated as LMD or maldet, is a software package that looks for malware on Linux systems and reports on it.[1]

Traditionally, Linux systems are generally regarded as very well-protected against, but not immune to, computer viruses and other malware. Whereas there are relatively many malware detection software packages like virus scanners for Windows systems, there are relatively few for Linux systems.[2][3]

For protecting Linux systems against vulnerabilities, various other software packages are available, like rootkit detectors such as Rootkit Hunter and chkrootkit, auditing systems like lynis. Malware detection software like LMD and ClamAV add to the security of systems by scanning them based on the signatures of thousands of instances of known malware.

For malware signatures, LMD uses various sources, like the signatures database of ClamAV and the Malware Hash Registry of Team Cymru.[4][5] Besides such third party signature databases, it also maintains its own database of signatures.

If a ClamAV scanner engine is already available on a system, LMD will use this for its scanner engine. This will normally give better performance than the built-in scanner engine of the software package.[1]

Like many virus scanners, LMD can quarantine malware and it can clean software that contains malicious code.[6]

The executable command of LMD is maldet. Typical command invocations are maldet -d to check for later versions, maldet -u to check for malware signature updates and maldet -a to scan the file system of the server on which LMD resides. Checking for malware signature updates is typically done in an automated manner. Besides periodic scans, Real-time monitoring is also supported with the --monitor command line argument. LMD can monitor users, paths and files in such a way.[6]

Linux Malware Detect is one of the objectives for the LPI 303 certification.[7]

References[edit]

  1. ^ a b Mastering Linux Security and Hardening by Donald A. Tevault Publisher: Packt Publishing Release Date: January 2018 ISBN 9781788620307
  2. ^ Granneman, Scott (October 2003). "Linux vs. Windows Viruses". Retrieved 2008-03-06.
  3. ^ Yeargin, Ray (July 2005). "The short life and hard times of a linux virus". Archived from the original on 1 May 2008. Retrieved 2015-12-06.
  4. ^ Linux Server Security, Chapter 8 Malware Detection, by Chris Binnie, John Wiley & Sons, 2016, ISBN 9781119277651
  5. ^ Cymru, Team. "Malware Hash Registry - Team Cymru". www.team-cymru.com. Retrieved 19 May 2018.
  6. ^ a b "Linux Malware Detect - R-fx Networks". www.rfxn.com. Retrieved 19 May 2018.
  7. ^ "Exam 303 Objectives". lpi.org. 31 August 2016. Retrieved 19 May 2018.

External links[edit]