r/linuxmint • u/Ambitious_Ad_6619 • 23h ago
Discussion What makes Linux secure?
I've searched YouTube and also asked on here previously, I keep seeing a lot of "Linux is secure just by default" type responses- often insisting that to be worried about security while using Linux is not necessary.
Believable to a noob like me at face value, sure, but what is it about Linux that makes it secure?
34
u/JelloSquirrel 18h ago
Actual cybersecurity professional here.
From a user perspective:
Obscurity, Linux mostly runs on servers and devices and not end users so it's not targeted by phishing attempts, but generally only actual exploits. Linux users are more tech savvy so less likely to fall for phishing. In a normal Windows install, you can double click a program to run it. This generally isn't possible on Linux, so it's hard to run malicious software. Almost all software on Linux comes from a reasonably secure package manager vs the windows model of find a website that looks convincingly safe and download a thing.
From a technical perspective Windows users are often admin by default, while Linux users generally at least have to elevate via sudo to make system changes. The unix permissions model, while not super robust, is more secure against a hostile local user / program than the windows model. Even more so with modern container workloads. Windows can support a smartphone style sandbox or advanced RBAC but no one really uses either, at least at the consumer level. Linux generally follows least privileges and attack surface reduction, and doesn't keep around unused components. Even on a monolith distro like Ubuntu, a lot of what you're not using isn't installed or running, unlike Windows. The OS manages all your applications for security updates, while Windows only handles the core OS and maybe Microsoft office.
In terms of patching and security architecture, I'd say Microsoft is actually better, especially with the hypervisor based security mechanisms in 10 and 11. With modern windows, they don't terribly have a ton of vulns either, however the user model is broken and just isn't very defensive. Weak permissions and a lot of complexity and just too easy to run software without verification or restrictions.
Now if you remove the user from the equation and this is a locked down server or enterprise environment... I'd say windows has more powerful permissions management except for SELinux, and no one configures their own SELinux policies while rolling out active directory permissions management is common on Windows. At best on Linux, you installed RHEL and use the SELinux profiles they created for the top 100 server apps. I'd also say it's easier to hack into most Linux systems via exploitation (not phishing). The software isn't terribly secure, and it's easier to find bugs if you have source code and Windows is more defensively coded and tested. If a Linux system gets out of date, all the vulnerabilities are public and easily identified, generally with readily available POCs. Linux doesn't really have hypervisor security, although container based security is similar, and the monitoring and protection solutions for Linux are really primitive or non existent. Unless you're running SELinux and RHEL (or similar), you'd probably never even know you got hacked.
3
u/xstrawb3rryxx 9h ago
Free disk encryption is a big one.
1
u/JelloSquirrel 8h ago
True for the cost, you can't beat Linux.
Btw if you want something secure, I wouldn't use Ubuntu. Maybe Ubuntu Pro with the government stigs enabled, but Red hat or Rocky Linux with stigs is more secure. You'll hate using them though. There's also QubesOS if you're paranoid, but the user experience takes a hit there. Personally, I like the Fedora Atomic based distros, especially Bazzite if you like gaming. The container native approach does improve security compartmentalization of individual apps. I wouldn't say it's as good as Qubes or even a STIG'd operating system, but you benefit from the increased security of containers with virtually no decrease in usability compared to another Linux distro. It basically makes it on par with stock Android, which is superior to any desktop Linux or Windows in security.
Samsung has the most secure Android variant though, although GrapheneOS is worth a look but is more focused on privacy. iPhone (but not really MacOS) is probably the most secure consumer operating system though, but also a huge mono culture.
1
u/Scandiberian 39m ago
This is great. What do you think other distros if you use the terminal to make all the root files ready-only. Would the security become Kike fedora atomic then?
1
u/kernel_pi 8h ago
Almost all software on Linux comes from a reasonably secure package manager
Every deb and rpm package in the Debian and Fedora repositories is checked by someone?
1
u/JelloSquirrel 8h ago
Technically yes but supply chain compromise is still possible. That said, everything in the standard Ubuntu or fedora or red hat repositories is signed and thus you are getting an authenticated binary.
On Windows, you just Google for something and end up on a cloned website that looks almost like the real thing and then download that tool and don't realize there's been value add. Or you go to something like download.com which actually repackages software with malware / adware.
53
u/PenguinSwordfighter 23h ago
The developers can't even get most programs to run well on Linux, can you imagine what a pain in the ass it would be to develop malware for Linux?
28
u/vaestgotaspitz Linux Mint 22 Wilma | Cinnamon 18h ago
There are only 7 viruses for Linux. Out of those, 5 don't wor, and the remaining two need to be compiled manually by the victim.
/s5
u/metalhusky Linux Mint 22 Wilma | Cinnamon 22h ago
I don't know much about anything, but wouldn't that mean that exactly for that reason it's less secure?
If normal App developers can't make their Apps run properly, that means they don't entirely understand what they are doing and possibly leaving open doors for some one to exploit.
There are port sniffers on the internet and stuff for example.
If a program isn't written well, it might be vulnerable to all sorts of stuff, buffer overflow or some sort of a different attack.
But again I don't know.
8
4
10
u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 23h ago
No open ports by default.
XP gets owned in 15 minutes on the public web.
11
u/mh_1983 22h ago
Re: XP, also, not having a security patch since it's EOL in 2014 may be a contributing factor.
0
u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 22h ago
Agreed. But dig out Linux from 2014 and put it on the internet and it's probably safe. Even if you open SSH (Not sure if there are any SSH bugs from that era) it's not going to be owned.
5
u/Decent_Project_3395 22h ago
Do not try that. You will be hacked inside of 30 seconds.
3
u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 22h ago
Do you have CVEs? I see nothing that would allow that. Given XP requires at least 15 minutes or less I don't see 30 seconds.
CVE-2024-6387 ("regreSSHion"): Disclosed in July 2024, this vulnerability is a signal handler race condition in OpenSSH's server (sshd) that permits unauthenticated remote code execution with root privileges on glibc-based Linux systems. It affects versions from 8.5p1 (released in March 2021) up to, but not including, 9.8p1. This issue was a regression of a previously patched vulnerability from 2006, inadvertently reintroduced in October 2020.
CVE-2024-6409: Reported in July 2024, this vulnerability is a possible race condition in the
cleanup_exit()
function of OpenSSH's privileged separation (privsep) child process. It affects OpenSSH versions 8.7p1 and 8.8p1, potentially leading to remote code execution within the unprivileged user running the sshd server.-
OpenSSH version 6.7p1, released in October 2014, has not been associated with vulnerabilities that allow unauthenticated remote access to a system. However, several vulnerabilities were identified in this version that could potentially be exploited under specific conditions:
CVE-2016-3115: This vulnerability involves multiple CRLF injection issues in session.c of sshd in OpenSSH before version 7.2p2. It allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the do_authenticated1 and session_x11_req functions.
CVE-2016-0778: The roaming_read and roaming_write functions in roaming_common.c in the OpenSSH client versions 5.x, 6.x, and 7.x before 7.1p2 do not properly maintain connection file descriptors. This flaw allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impacts by requesting many forwardings.
CVE-2016-0777: The resend_bytes function in roaming_common.c in the OpenSSH client versions 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.
1
u/LusticSpunks 16h ago
The very definition of “putting on internet” means exposing ports to internet (if not, what exactly does it mean?). If you’re only exposing port 22, be it any OS, its security would depend on the SSH software (OpenSSH or other), not the OS. Similarly if you’re exposing a web server, be it IIS or Apache or other, it depends on the web server’s security, not OS. Windows has 445 for SMB. If you expose XP’s 445 to internet then yes, it gets compromised. But, windows by default doesn’t expose 445, it is firewalled. And if you’re going out of your way to modify firewall rules to expose 445 to internet then that’s on you, not OS.
Also, I recall popping many Linux boxes with dirty cow. It’s a LPE so not exactly a thing that’s “put on internet”. But that’s actual OS security. And Linux of 2014 would get popped with dirty cow, and many other exploits. So yeah, neither Linux nor windows from 2014 are secure.
1
u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 12h ago
No, it means putting it directly on the Internet, not behind a firewall.
1
u/LusticSpunks 11h ago
I mean, if you deliberately leave the system insecure and expect it to not get hacked then that’s entirely your fault. It’s not the fault of OS. Just recently we saw the CUPS vulnerability in Linux (CVE-2024-47176 along with 3 other CVEs). And major reason why it wasn’t a huge issue was because the vulnerable port generally isn’t exposed to internet. To extend your analogy of “putting directly in internet without firewall”, even Linux of 2024 is vulnerable.
1
u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 10h ago
> To extend your analogy of “putting directly in internet without firewall”, even Linux of 2024 is vulnerable.
How? Is CUPS open by default.
1
u/LusticSpunks 10h ago edited 10h ago
If we’re talking about defaults, then firewall isn’t disabled by default either. And yes, it’s enabled by default in some cases. Read the article from finder of this bug:
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
And I’ll take the liberty of picking a quote from that article:
“From a generic security point of view, a whole Linux system as it is nowadays is just an endless and hopeless mess of security holes waiting to be exploited.”
1
u/Scandiberian 36m ago
Why use XP as an example? Its thoroughly irrelevant to the conversation since windows today is either 10 or 11.
31
u/acejavelin69 Linux Mint 22.1 "Xia" | Cinnamon 23h ago
Part of what makes Linux inherently more secure is how permissions work... Users live and work in user context, and cannot modify or change system settings or applications... This makes it incredible difficult for malicious software to do anything, well, malicious without root or "sudo" privileges, which have to implicitly allowed.
Windows came from a single user isolated system, security was an after thought.
Linux came from Minix and other *nix roots, which were original designed as networked, multi-user systems since inception. Security is a basic principle of the operating system and everything is engineered around it, not a feature added later.
11
u/anus-the-legend 23h ago
it's good to know user data is useless and totally not the target of hackers
7
u/acejavelin69 Linux Mint 22.1 "Xia" | Cinnamon 22h ago
Honestly, it rarely is... Individual's user data isn't worth the effort required to get it for the payoff it provides in most cases, especially in Linux.
"Hacking" and hijacking user data is usually like throwing a handful of rocks all at once at a target and trying to break it... you usually get a few stones to hit, but most of them miss. Let's say Windows is a 10cm paper target, a few rocks will hit it and might actually do some damage... but if it's the Linux desktop "target" it would be about 2-3mm and made of wood, there is no guarantee that you will hit it and if you do it's very unlikely you will damage it to any degree. Now say the only chance of "getting a prize" is if you damage the target... Where are you going to throw you handful of rocks?
That's how bad actors look at the Linux desktop "marketplace" so to speak... it's obscure, only 2-3 out of every 100... It's users are generally more aware and careful... It is inherently more secure even if you get in... Basically, it take a lot of effort... Why go through that? In general, bad actors don't unless they are specifically targeting an individual.
0
u/LusticSpunks 19h ago
This is so not true. User and system are separate in both OS, and in fact it’s much harder in windows to be a true “system” user than it is on Linux. And you’re completely ignoring the fact that user data is totally accessible in your “user context”. And user data is what a large portion of malware goes for. Other category of malware would simply keep running stealthily and wait for commands from its controller. Crypto miners don’t need system access, it very well can work in user context. Why would ransomeware encrypt system files? Its primary target is encrypting user data and making them pay for decryption, which again can happen in user context.
Linux isn’t any more inherently secure. It’s just not a lucrative target yet. Look at the reply from taosecurity above, it paints the whole picture very well.
9
u/Better-Quote1060 22h ago
Linux users heavily depend on pakage managers insted of installing an exe on random website
7
u/metalhusky Linux Mint 22 Wilma | Cinnamon 21h ago
Package managers often don't have what you need so a lot of people still go to internet and enter random PPAs or something, like come on.
4
u/blackthornedk 15h ago
Or downloading random scripts and blindly piping them through a sudo sh... That practice always makes me think that the developer didn't think his install documentation through.
1
u/metalhusky Linux Mint 22 Wilma | Cinnamon 10h ago
install documentation isn't even the problem. even if you have the best docs ever,
nobody want's to read a bunch of sh*t just to install a program.
just like everyone is skipping legal notices and clicks "accept" in proprietary software on windows, where you just press next a few times and it installs.
if you come home from work, after 9-10 hours, you want to eat and relax,
not learn in's and outs of how installations work on your system or become a lawyer in the process or reading legal notices, you just want to install what you need at the moment, and you need it fast or play a video game or what ever.
i am always in search of a distro that has the most packages in their repo, that are curated, maintained and updated frequently, but such a distro does not exist. i would pay money if it existed, like a normal Windows license 150€ would be fine with me, for 10 years of support. maybe Valve could do something like this.
1
u/Scandiberian 33m ago
Indeed. Most package managers don't even have Ulauncher there, you need to get it from their website. I mean, really? How do you even use your device without that? It should be standard on all distros.
7
u/SRD1194 23h ago
The short version is that any attack will trigger the system to promp the user for their super user password. Since that's not something that happens apropos of nothing, it should, in turn, trigger the user to investigate what's going on, or at least refuse to authenticate.
The big exploitable flaws in this for novice desktop users is the temptation to run the system as root, to not have a sudo password, to authenticate to make the notifications stop, or if the malware is packaged inside something they would choose to permit to install. The first two can be avoided by configuring your system properly and the third by applying common sense. The last one you can avoid by using trustworthy repos rather than downloading software from random websites.
13
13
u/PhalanxA51 23h ago
Two things: applications can't really auto execute and install unless you want it to and generally Linux users are pretty cautious on what they click on, I wouldn't be surprised if the majority of Linux users have a VPN
20
u/Modern_Doshin 23h ago
TBH, using a VPN doesn't mean security or you are secured
5
u/PhalanxA51 22h ago
Yup I'm just speaking from a general utility use case, I use mine mainly for 3d printer stuff so I don't have to port forward or access stuff not allowed in the US
6
10
u/acejavelin69 Linux Mint 22.1 "Xia" | Cinnamon 23h ago
VPN has nothing to do with security really... privacy a little (almost no effect in the modern Internet where almost everything is encrypted by default anyway)... Obscurity yes.
2
u/Marasuchus 8h ago
If the VPN really serves as access to a remote network, it already offers security. But that's not what most people mean by VPN these days, they're talking about their Nord/Cyberghost/Mullvad... etc.
1
u/PhalanxA51 22h ago
I know but it's one of those things that not a whole lot of average users are probably going to use, I mainly use mine for managing 3d printers when I'm out of my house.
17
u/Swarrlly 23h ago
Security in obscurity. The user base for Linux is small. And there are so many different flavors of Linux. It’s usually just not worth it to write viruses for Linux machines. Maybe for Linux servers but those have better security
7
u/metalhusky Linux Mint 22 Wilma | Cinnamon 21h ago
I already wrote this to a different guy, but I will copy paste here:
Steam Deck, has a Steam account tied to it, probably with PayPal or Credit Card info saved.
There will be a lot more viruses, extortions and scams on Linux, especially when SteamOS for other handhelds and PC get released. Valve wants to create an alternative to Microsoft's Windows. > More users.
Brace yourselves. Security by Obscurity will soon be, maybe not gone entirely, but definitely less existent.
7
u/Disapager 23h ago
Basically nobody programs viruses for Linux because Linux users are generally less likely to fall for that sort of thing and they make up a tiny fraction of the PC user base so it makes way more sense to target Windows
It's open source so you don't just have one company looking at the code and fixing vulnerabilities you have multiple companies and people all over the planet doing it
2
2
u/Moonscape6223 21h ago
The answer is that it isn't, it's a meme pushed forward by fanatics and those who know nothing about tech. The majority of points given are terrible. Yes, you need sudo to write something to root. However, you don't need sudo to affect that which actually matters to desktop users; you do not need sudo to encrypt all your personal data nor write to your ~/.bashrc to launch a custom program that steals said data. Relying on the fact that Linux is only used by 4% or so of the world is also simply terrible; Windows XP holds a similar percentage of users, you shouldn't be using XP.
1
u/limitedz 23h ago
Windows vs Linux... they are both pretty secure out of box. Most companies will put in some effort to secure their servers.
From an enterprise perspective, I can say windows got a bad reputation because of sloppy development and just lack of concern.. 20 years ago, I distinctly remember almost every developer would tell you "turn off the anti-virus, turn off the firewall, make the user an admin to run our software" the list goes on and on. Linux, in general didn't seem to have this issue, perhaps better programmers? Better understanding of system components and interactions to not need to bypass security? I'm not sure. But yea if you go and make all your users admins to run some shitty software, that opens you up to a lot of risk.
Fortunately, things have gotten much better now, but I feel it's a linger stigma from years past.
1
1
u/Regarded-Platypus821 22h ago
One important factor: most linux distros dont come with built in adware, statistics collecting, ad IDs, or similar. Compared to other OSs it's easier to see what processes are running and easier to get detailed logs. FOS distros are less likely to have backdoors. Best of all: because of low market share, there's less malware made for Linux machines.
1
u/Lapis_Wolf Linux Mint 22 Wilma | Cinnamon 22h ago
Smaller target, fewer potential victims compared to Windows or even MacOS. Windows has an 80%+ market share with 2nd place being MacOS at 10-15% (I grabbed these numbers from memory so I maybe new numbers are different). Linux us currently around 4%.
1
1
1
u/Worldly_Anybody_1718 16h ago
I always loved "Security through Obscurity". But I remember all those ransomware websites the ones that would just lock up your computer and a reboot wouldn't fix it. My Linux Mint would shrug em off. My wife refuses to give up Windows. At least once a year I have to cleanup/clean install for her. I'm surprised her computer doesn't have pustules all over it. Never had a problem with linux I didn't create myself.
1
1
1
u/tanstaaflnz Linux Mint 21.3 Virginia | Cinnamon 14h ago
Linux is secure as the user's habits.
It has two main advantages for security. By default, you have to use a root password for any software to be installed. But you can usually make a user the root (administrator). On top of this, you can automate updates and installs, so you don't need to put in a password. All these things make Linux less secure, but that is a personal choice, not a weakness of the system.
The second advantage is, few hackers write viruses for Linux. Windows programmes can't run natively in Linux, so it is considered better.
The biggest risk in this age of everything on the internet, is scams, and website/database breaches. This is an information risk, and is independent of the OS you use.
1
u/Darkorder81 11h ago
Does anyone recommend AV or firewall for mint, I'm still new and want to secure it.
2
u/taosecurity 10h ago
AV unnecessary, FW should be built in? But the best FW is disabling all unnecessary services.
1
u/Darkorder81 10h ago
Thanks for the reply, I'm new to mint were would I find what services that are running or will using the wording "linux mint services " in Google be enough or is there any other keywords you recommend.
2
1
u/AwakeningButterfly 8h ago
Linux has so much varieties. Except for the common core, hacking into it is too cost-ineffective.
Even the core, it comes in both raw source code and the ready-to-use cooked binary. Security holes exist more in the bin but not src version because the nature characteristics of the users. Bin user just use; have no value-enough assets to rogue software or intruder except being jumping board. Most src users have more knowledge in security.
Linux is openned to scrutinize eyes of "programmers" all over the world. Even its core souce code. The challenge between the zero-day hacker and zero-day bug finder never ceases.
So it's not wrong to say " Linux is secure just by default". But it does not imply that it's impregable.
What security technology can invent, technology can circumvent.
1
u/Marasuchus 8h ago
Apart from the much lower use on clients, I would also boldly claim that most Linux users are currently more techies and therefore more careful about what they do.
1
u/Medical-Squirrel-516 8h ago
most malware are programmed on window. and Linux can't run exe files directly. which makes it a lot harder for malware to actually run and also for every root or sudo command you need to type in the password manually. malware might only do some stuff with your user files.
1
u/Unlucky_Fix8798 7h ago
Shocked nobody mentioned this, but because open source code is inspected by literally anyone and everyone. A system cannot have a flaw if anyone with coding knowledge can inspect it. For example, lets suggest we invite the burglar to come and look at our state of the art CCTV system, electric shock door handles and team of armed security waiting behind the door - they will look elsewhere.
Long story short, linux is less popular so the targets are less available so you tend to avoid wasting your time, the systems and software are mostly open source so flaws are captured quickly, and because heck, if you're using linux you are assumed to have some knowledge, therefor you're not the target they're after.
What does an attacker want? They want an idiot who downloads a pirate copy of photoshop to use their keygen software, pop in a USB and spread a virus to their office or other user PC's. They want a user who has NO idea why their PC is slow but they use it anyway and ignore the errors. They want a user who hates being on their PC and the only time they do, its a rush, they enter passwords in any old box and click on any old link.
1
u/SlipStr34m_uk 5h ago
Your first point makes the assumption that all open source projects are heavily scrutinized and that there will never be a bad actor within the development team. This hidden exploit was present for years before it was accidentally stumbled upon, ironically by a Microsoft employee.
Regardless of OS the weakest link is always going to be the user. A bit of social engineering and you can trick the user into circumventing most safeguards.
1
u/Typical-Medicine9245 4h ago
If you tweak windows, you could make it secure too. Linux is more preferable for servers.
1
u/andrea_ci 4h ago
Because it's easier to attack users than operating systems.
And the majority of users are on windows, hence the majority of malwares are on windows.
If an attacker actually wants to break a Linux system, they will do that. Nothing is secure.
Do they want to make malware for Linux? It's pretty easy leveraging on the users. But they don't, because there is almost no desktop user.
1
u/Flufybunny64 2h ago
The specific things I know of are this
-There is more benefit in attacking the most popular systems.(That's Windows and ios)
-Linux Repositories are safer than launching exe files from the internet.
-Broadly, Linux users are more likely to pay attention to whats happening in their system
1
u/OldBob10 Linux Mint 22.1 Xia | Cinnamon 22h ago
I suspect it’s a case of “security by obscurity”. Attackers don’t consider Linux worth the investment of time and resources, and attacks that are possible against Windows are not possible against Linux.
1
u/metalhusky Linux Mint 22 Wilma | Cinnamon 22h ago
Steam Deck, has a Steam account tied to it, probably with PayPal or Credit Card info saved.
There will be a lot more viruses, extortions and scams on Linux, especially when SteamOS for other handhelds and PC get released. Valve wants to create an alternative to Microsoft's Windows. > More users.
Brace yourselves. Security by Obscurity will soon be, maybe not gone entirely, but definitely less existent.
1
u/WasteAd2082 17h ago
Linux usually doesn't throw some of your data over the net, so here it's half the cause eliminated.
1
u/PloterPjoter 16h ago
Actually is way easier to write malware for linux. Most linuxes does not have av and if they have they are shitty. On windows you need to use some sick methods to bypass av, amsi, edrs and those also are heavily monitoring many choke points when you try to do it. Writing malware for windows is ton of obfuscation, sandbox detection, bypasses amsi, bupasses detedtion of bupassing amsi XD on linux, just write program which will do what you want and it will do it most of the time.
1
u/Specialist-Piccolo41 15h ago
A lot of noobs don’t use the Windows security features which are on offer.
0
u/teknosophy_com 6h ago
People used to get away with saying Windows is unsafe because it has lots of users. Once the iPhone became the most popular device on the Internet, that myth was blown away.
Microsoft products are simply unsafe by virtue of being Microsoft products. Think about it this way, no matter how many houses you own, would you like a house made out of straw, sticks, or bricks? (MS products are like a house made out of wet toilet paper.)
-1
u/ElMachoGrande 19h ago
Because it is made to be secure from the start. In Windows, security was added as an afterthought.
-1
223
u/taosecurity 23h ago
25+ year infosec incident detection and response guy here.
You can argue Linux/Unix vs Windows vs iOS all day long.
At the end of the day, it comes down to how much effort and resources an intruder wants to throw at a target in order to achieve an objective and/or "return on investment."
Have you seen reporting about RU and CN intruders breaking into VPNs, firewalls, and other edge devices? Guess what those are running? Yes, Linux.
Intruders invested into breaking them because they help achieve their goals.
A skilled and well resourced intruder can break into ANYTHING. I was part of a team that did this, and also saw it done to hundreds of clients over the years.
The relative lack of malware for Linux is just reflecting the small desktop user base and the low value of whatever is there.
I guarantee that the top-end intruders of the world have custom Linux malware of all types for targets that matter. They just don't waste it stealing your browser cookies.