26

After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu.

One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is safe? (Beside the side effects, Wine, and being a conveyor)

marked as duplicate by Steffen Ullrich, Alexander O'Mara, Rory Alsop May 14 '17 at 20:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

-17

Wannacry doesn't infect Linux machines. It uses CVE-2017-0146 and CVE-2017-0147 which is the NSA leak exploit which was released by Shadow Broker almost 3 weeks ago. It does affect Linux machines with wine configured.

It takes advantage of an SMB exploit.

There are 2 paths that can help you protect yourself.

  1. Make this domain available to your environment. http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com The wannacry uses this to detect if the environment is running under analysis or not. This domain was a unregistered domain until researchers realized. They made it and purchased to domain to stop the spreading. On registering the ransomware thinks it is running under sandbox and hence stops
  2. Download the patch officially release by Microsoft. Following is the link.

WannaCry: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

SMB patch: https://technet.microsoft.com/library/security/MS17-010

Concluding: WannaCry is the ransomware affects only Windows systems.

  • 11
    The question asks if the malware affects Linux, so how is one supposed to use a Microsoft patch on such a system? – Ethan Kaminski May 14 '17 at 7:50
  • @everyone for whatever reason, this was accepted as an answer - I'm not sure I want to override the OP's wishes here - if you do not think this answer is helpful to others, your option is to downvote – schroeder May 17 '17 at 21:08
53

WannaCry exploits a set of flaws in Microsoft's implementation of the SMB1 protocol. Since these are implementation flaws rather than structural flaws in the protocol itself, Linux systems cannot be automatically infected, but can be if manually installed. This is true regardless of if the systems are running Samba, Wine, or any other Windows-emulation layer.

  • 15
    I think saying that because what is being exploited is an implementation bug rather than a structural flaw in the protocol leading to the conclusion that Linux systems are "immune" is a bit much. There remains a possibility that the same bug could exist in Linux, or in Linux userspace code e.g. Samba. I agree with what you probably meant, though, that the likelihood of the same bug existing in a very different code base is exceedingly small. And of course, absent an emulation or similar layer the payload would not be able to execute on Linux, so even if the bug exists it's no big deal now. – a CVn May 14 '17 at 12:07
  • 3
    Reports that Wine is affected: askubuntu.com/a/914954/107069 – schroeder May 15 '17 at 8:12
  • 1
    @schroeder, as I understand it, the AskUbuntu answer is from someone who downloaded and ran WannaCry. The worm can't self-propagate onto a Linux system the way it can with a Windows system -- it can only be installed manually. – Mark May 15 '17 at 9:26
  • 2
    Right, but this would constitute a modification to the statement of 'immunity' – schroeder May 15 '17 at 10:24
  • 2
    @weejing, WannaCry does not have any built-in method of propagation other than the SMB1 flaws. Yes, with sufficient effort, a Linux user could infect themselves, but it requires deliberate actions to bypass various barriers, unlike Windows, which can be infected just sitting there connected to a network. – Mark May 16 '17 at 20:13
6

Not this strain, it has been written exclusively to attack Windows <=7. WannaCry in its current form does not have any modules to spread directly to Linux-based systems. As mentioned, it uses a recently leaked NSA cyberweapon codenamed ETERNALBLUE to spread within the network, after someone has been infected wiJa th a malicious mail or other attack. It works because of a programming error in Windows' SMB ( network share ) code.

Not the answer you're looking for? Browse other questions tagged or ask your own question.