I feel like I've enumerated this a hundred times or more but Ubuntu isn't "immune".

Like a lot of Linux distributions, we have features that people read too much into:

• Nice maintained repos (but how do we know they're virus free?)


• By default we run unprivileged (Windows does too)


• Open source mean that anybody can audit the code and submit their patches (but do they?)


• Ubuntu doesn't run that many services by default


• AppArmor does limit the range of some applications

And as soon as you add a user, all bets are off.

• Users add things from PPAs without looking at where they come from.

  
  



• Users download .deb installers because they've got two decades of experience downloading .exe files. These can be scripted to run anything and they run it as root.

  
  



• Users will run almost any scripting you give them if they think it'll help their problem and you can very curtly (and opaquely) script almost anything in Ubuntu by default.

  
  



• User view dodgy websites not knowing that their browser and Flash is just as exploitable as Windows users' browsers with Flash. There's a reason pwn2own entrants always go for the browser — it's a weak point.

  
  



• Users install a SSH server with an account that has a weak password (ie any password, use keys kids). Tips for securing SSH.

  
  



• Users install other services that shouldn't be web-accessible and don't use a firewall. Before they know it, their weak MySQL password is cracked or their webserver is exploited because they don't update it nearly often enough.

  
  



• Users dump whatever version of generic PHP script on their LAMP install and never update it.

  
  

The only thing that actually works in our favour is that desktop users are currently a target so small that it's not worth attacking... But that could change at any moment. Servers have been being hacked for years but again, this is mostly down to poor administration.

So many people think they can create an Ubuntu server, stick their PHP app on its and don't need to do anything with it. They all get hacked.

And in terms of physical security, Ubuntu is pretty weak. Reboot to root console and you have everything. This can be disabled but it's not the default.