Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.

I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to do harm when being executed with Wine on Linux, can do harm to my Linux system. I use a standard Wine installation. Wine is never executed as a superuser.

I guess it could read/write/delete files from my folder, and connect with the Internet.

I think, but am am not quite sure, that it can't install software. Could it install harmful (Firefox) plugins?

share|improve this question
    
If it has access to your memory, it can do quite a bit. –  JVE999 Jul 24 at 19:45

3 Answers 3

up vote 13 down vote accepted

You are right about accessing the file system and internet, especially because the home folder is mapped with write permission by default. This implies that it can mess with your documents as well, for example adding macros to Open Office documents, deleting your mp3 files or sending interesting files to someone on the internet.

And yes, it can write to your Firefox profile and install an Addon.

Connecting to the internet means, that it can fetch commands from a C&C server to turn your computer into a drone.

I guess some maleware will fail to find those locations outside the standard windows folders. But other will just scan all drives for interesting places.

share|improve this answer
    
The malware would need to be Wine-aware in order to traverse the directory tree above /home/user/.wine/drive_c –  Andrew Lambert Jul 10 '11 at 23:43
5  
@Amazed, in the default configuration / is mapped as Z:. So a Windows program can modify files in Z:\home\hendrik\documents without knowing anything about Wine or Linux. All it has to do is to look for documents outside C:\Documents and Settings\hendrik. This is not as unlikely as it may seem on first glance because it is the standard way to spread across network shares. –  Hendrik Brummermann Jul 11 '11 at 4:41
    
good point! I forgot about Z:\ –  Andrew Lambert Jul 11 '11 at 5:18
    
It would still have to be wine aware to install a firefox addon or it won't find firefox's profile directory. –  Joshua Jul 24 at 18:08

Been a long time since I've done C structured exceptions (MS specific but emulated on Wine), but the syntax is close to this. Somebody using this could have a lot of fun even if Z is not mapped.

bool isLinux = 0;
__try {
    asm {
        mov AL, 172
        int 80h
    }
    isLinux = 1;
} __except {}
if (isLinux)
   asm {
      /* Linux shellcode here */
   }
share|improve this answer
1  
Please explain your code. –  moose Jul 24 at 18:20
    
The code attempts a Linux system call, which will throw invalid instruction on Windows, but __except{} will eat the SEH exception. –  Joshua Jul 24 at 18:28
    
So what happens when this gets executed on a windows computer? What could happen when it gets executed on Linux via wine? –  moose Jul 24 at 19:12
    
(By the way: The -1 is not from me.) –  moose Jul 24 at 19:14
    
Windows: int80 raises exception caught by __except() and isLinus = 0. Linux: control passes through the asm block setting isLinux = 1. Now it knows to apply the Linux specific payload say either by downloading and running a binary or unpacking it from resources and then calling it with exec() which it can by repeating the asm trick (no more try necessary). –  Joshua Jul 24 at 21:13

Theoretically, yes.

Firstly, a bit of background on Wine. Wine provides an executable loader for running Windows executables. Also installed or made use of optionally is a binfmt handler described here, which is how the linux kernel deduces what loader to execute - for example, somewhere built into the kernel is a binfmt handler for ELF files for Linux. Function calls from these executables are then translated by the Wine runtime into their equivalent Linux system calls. The Wine FAQ deals with the question of wine being an emulator.

So, back to your question - could Windows malware infect a Linux box? I said theoretically yes - here are the various threats you face:

  • Bugs in the format handlers. If a specially crafted executable causes Wine to incorrectly load the PE file, you might well be able to exploit it.
  • Bugs in Wine's function translation. This is the same as saying "bugs in the Windows API", if you like - if certain functions translated in Wine are susceptible to buffer overflows etc, then they can be exploited.
  • The fact that function calls are translated. This very fact in itself means malicious activity can happen.
  • The setup and limitations of the Wine install. What file systems have you mapped? Can the executable escape this "chroot"?

There is one key proviso here - being aware or planning for infecting Wine. If malware is written with the expectation that it may be run on Wine, then it can begin to use Wine specific exploits, possibly detecting that Z: is mapped to / and performing appropriate actions. The earlier points in my list above are the least likely, but also the most damaging if they occur.

However, most malware is not written for Wine. You can think of Wine as a separate build target, almost, since how it implements the Windows API is different to how Windows implements the API. Most malware is aimed squarely at Windows, so I'd expect the damage to occur only to the "Windows" install. Indeed some malware may not run, where the Wine developers have assumed strict usage of an API function and where Windows allows something different.

So, to cut a long story short, Wine increases your attack surface by a sizeable amount by allowing you to execute arbitrary Windows programs. The same general rules apply to Wine as apply to any piece of software:

  • Do you need it? If not, don't install it.
  • Is it up to date? If not, update it.
  • Be careful what you run with it. It is not a substitute for being careful with what you download, access and run.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.