CrowdStrike's Falcon Sensor also linked to Linux kernel panics and crashes

People drink the kool-aid and believe that Linux needs antivirus. So many vendors tried and failed at scaring people into buying Linux antivirus that I've lost track over the years.

My perspective is that it is a very very poor idea to have an anti-malware solution running on a Linux system. CrowdStrike is very persistent in their sales pitches and do FUD campaigns better than the competition to convinse people with decision making authority that Linux and Containers and what needs an antivirus.

What makes you think Linux can't have a virus or malware? It has attack vectors like any piece of software, surely?

Recently helped somebody who accidentally left dockerd open to the internet with no auth. It was hacked, backdoored and running a crypto miner within hours. Only detected when the hosting company emailed him days later because the worm was further scanning other hosts from his machine.

How would you stop, detect and/or remove this threat from this machine on a linux server without antivirus / EDR?

You have metrics from the server which tell you that you're running 100% CPU for a period of time. If the crypto miner wasn't something very dumb, it would not be detected. And I can scan a network using nmap with an XML or grepable output format options.

CrowdStrike doesn't remove threats. It would stop the process and quarantine the file. It requires knowledge on how to actually remove the threat beyond the quarantined file.

Yeah, desktop Linux more obscure and generally used by more technically inclined people so malware is less common, but out of the box its just as vulnerable to viruses as Windows or any other OS that runs user-installed applications with no sandbox.

If we were _really_ serious about endpoint security we'd be pushing business users towards operating systems with more modern security architectures, like Android, iOS or Chrome OS. That would be a lot of work though due to the fact that most legacy software is not compatible with those systems.

> People drink the kool-aid and believe that Linux needs antivirus

No we don't we just have compliance checklists to get through.