26

After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu.

One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is safe? (Beside the side effects, Wine, and being a conveyor)

Improve this question
4

3 Answers 3

Reset to default
-16

Wannacry doesn't infect Linux machines. It uses CVE-2017-0146 and CVE-2017-0147 which is the NSA leak exploit which was released by Shadow Broker almost 3 weeks ago. It does affect Linux machines with wine configured.

It takes advantage of an SMB exploit.

There are 2 paths that can help you protect yourself.

  1. Make this domain available to your environment. http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com The wannacry uses this to detect if the environment is running under analysis or not. This domain was a unregistered domain until researchers realized. They made it and purchased to domain to stop the spreading. On registering the ransomware thinks it is running under sandbox and hence stops
  2. Download the patch officially release by Microsoft. Following is the link.

WannaCry: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

SMB patch: https://technet.microsoft.com/library/security/MS17-010

Concluding: WannaCry is the ransomware affects only Windows systems.

Improve this answer
3
  • 13
    The question asks if the malware affects Linux, so how is one supposed to use a Microsoft patch on such a system?
    – Soron
    Commented May 14, 2017 at 7:50
  • @everyone for whatever reason, this was accepted as an answer - I'm not sure I want to override the OP's wishes here - if you do not think this answer is helpful to others, your option is to downvote
    – schroeder ♦
    Commented May 17, 2017 at 21:08
  • why this answer takes so many negative ratings?
    – hamedsh
    Commented Dec 24, 2019 at 20:03
52

WannaCry exploits a set of flaws in Microsoft's implementation of the SMB1 protocol. Since these are implementation flaws rather than structural flaws in the protocol itself, Linux systems cannot be automatically infected, but can be if manually installed. This is true regardless of if the systems are running Samba, Wine, or any other Windows-emulation layer.

Improve this answer
6
  • 15
    I think saying that because what is being exploited is an implementation bug rather than a structural flaw in the protocol leading to the conclusion that Linux systems are "immune" is a bit much. There remains a possibility that the same bug could exist in Linux, or in Linux userspace code e.g. Samba. I agree with what you probably meant, though, that the likelihood of the same bug existing in a very different code base is exceedingly small. And of course, absent an emulation or similar layer the payload would not be able to execute on Linux, so even if the bug exists it's no big deal now.
    – user
    Commented May 14, 2017 at 12:07
  • 3
    Reports that Wine is affected: askubuntu.com/a/914954/107069
    – schroeder ♦
    Commented May 15, 2017 at 8:12
  • 1
    @schroeder, as I understand it, the AskUbuntu answer is from someone who downloaded and ran WannaCry. The worm can't self-propagate onto a Linux system the way it can with a Windows system -- it can only be installed manually.
    – Mark
    Commented May 15, 2017 at 9:26
  • 3
    Right, but this would constitute a modification to the statement of 'immunity'
    – schroeder ♦
    Commented May 15, 2017 at 10:24
  • 3
    @weejing, WannaCry does not have any built-in method of propagation other than the SMB1 flaws. Yes, with sufficient effort, a Linux user could infect themselves, but it requires deliberate actions to bypass various barriers, unlike Windows, which can be infected just sitting there connected to a network.
    – Mark
    Commented May 16, 2017 at 20:13
6

Not this strain, it has been written exclusively to attack Windows <=7. WannaCry in its current form does not have any modules to spread directly to Linux-based systems. As mentioned, it uses a recently leaked NSA cyberweapon codenamed ETERNALBLUE to spread within the network, after someone has been infected wiJa th a malicious mail or other attack. It works because of a programming error in Windows' SMB ( network share ) code.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .