



White Hat hacker with a 20 year career here
(and retired Digital Forensic Consultant):
Your suspicions are correct:
Windows is far easier to hack out of the box than Linux.I can hack/compromise / access user data on 95% of the windows machines on the planet, with just physical access. And only a handful of poorly configured Linux devices. But don't get complacent, Linux hacks can, and have, happened
Here's my tips for securing Linux to be as "unhackable" as possible:
1. Use Ubuntu or something based on it. Everything else will be less secure unless you're a Linux professional capable of securing Linux yourself, manually. And it's the only distribution that supports Secure Boot out of the box, WITH officially licenced Microsoft encryption keys (that I'm aware of, feel free to correct me on this one). That being said, secure boot is increasingly security theater, and you can have a secure Linux system with it disabled. Possibly more secure, depending on what attack surface you're most concerned about.
2. Keep your operating system and software up to date.
3. Enable your free Ubuntu Pro account (free on up to 5 devices)
4. Now that you have Ubuntu pro, you'll want to enable the following Pro features:4a. ESM to get 12 years of security updates instead of 5,
5. Enable full disk encryption at install. It's just a checkbox. It literally couldn't be easier. This is a difference between someone being able to access your personal data with physical access and the right tools, or not.
4b. Canonical's security updates for the Universe repo (traditionally Debian and Ubuntu have left this up to the community), but they're now offering official security updates.
4c. And, most importantly, "livepatch". This will give you the ability to upgrade even the Linux kernel, without needing to reboot (usually). And it's free.
6. If you install a SSH server, also install Fail2ban. It's in the repos and has no drawbacks. You only really need it if you're opening your SSH server to the outside world via port forwarding, but don't risk forgetting. It could even (hypothetically) protect you from an already compromised device on your local network. Or a compromised router itself.
7. ALWAYS get your software from the repos. Never download and install executable files to get your Linux software. Flatpak and appimage are more secure than traditional package managers, Snaps are more secure than both, but traditional Linux package managers are still incredibly secure. Far more than the Windows approach to software install and management.
Yes, their are outliers and there have been exceptions where malicious software briefly made it through the walled gardens via Linux package managers, but they are literally one out of a million, compared to Windows malware & other infections. And one out of 10,000 compared to Mac malware.
Avoid the multi OS package manager NPM outright, and be very cautious with PIP. If you decide to use the PIP package manager, use pipx to install packages instead. It has additional security and isolation from the system, built right in.
If you can't find the software you want in the repos, find a repo with the software you want and add that to your system. Then you can install the software via your package manager. This ensures that when there's a security flaw that's been patched for any of your user installed software, the mitigation will be installed right along with your normal system updates.
The LastPass hack, one of the worst in history (and one of the few times Linux has been massively compromised), would have been outright stopped if the target had followed this advice when installing Plex on Linux.
On Debian/Redhat/RH clones you'll need to find a compatible repository, add it to your sources, update your sources, and install the software.
On Ubuntu (and Ubuntu based distribution) you can search for a "PPA" for said software (Personal Package Archive) and add that to your system with a single command (it'll be on the PPA page, just copy and paste).
It will even automatically detect your Ubuntu distribution version, and install the correct repo for you (or warn you if there isn't one, and it's incompatible with your system). Then your desired software will be instantly available via your normal package manager.

















Return to Computer & Technology
Registered users: Bing [Bot], Majestic-12 [Bot]