2

So every now and then I switch over to my Windows 10 OS from my Linux partition. Whilst I am there, I am fully aware that I can be infected with WannaCry which will encrypt all the files on the system. But will it affect my Linux partitions? If it only affects the Windows partition then I will have nothing to worry about as I barely have anything on Windows, but if it affects the Linux partitions (which from what I know, you can't really access from Windows) then I will have to do something about it! Anyway would it affect my Linux ext4 filesystem from Windows?

Improve this question

2 Answers 2

Reset to default
2

There are different variants circulating but some can. Once infected it damages/modifies the master boot record prior to windows even being loaded, then yes it can. Once it does, then it attempts to encrypt the full disk.

Improve this answer
2
  • 1
    Most ransomware works without admin privilege, which is what's disconcerting about them. Modifying the MBR would've required admin privilege.
    – Lie Ryan
    Jul 1, 2017 at 1:00
  • @LieRyan Local root exploits are considered relatively cheap, though.
    – Elias
    Aug 2, 2017 at 8:20
1

No it is not vulnerable to the same variant of WannaCrypt.

WannaCrypt leveraged vulnerabilities in Windows which are now patched.

It made use of a Windows specific exploit known as EternalBlue to exploit a vulnerability in the Windows implementation of SMBv1 to spread as well as a Windows specific backdoor known as DoublePulsar.

Once a host is infected it will search the Windows filesystem(s) for specific file types (the most common file types used by users jpeg, doc, mp3 etc), encrypt them and change them to the '.WNCRY' file type.

As you point out your Windows install cannot access your EXT4 filesystem on the Linux partition.

However if you were to mount the Linux partition within Windows, or create a samba sahre so Windows could access it, it is likely that the files would be encrypted by WannaCrypt.

This is not to say that there isn't malware with similar behaviour that will impact Linux/EXT4 (ransomware spreading via samba for example), but not this variant of WannaCrypt and not in these circumstances.

The diagram below summarizes the WannaCrypt infection cycle and demonstrates how it impacts Windows only.

TLDR: WannCrypt only impacts Windows and encrypts specific file types, in your circumstances your Linux partition is not impacted, however if you were to mount the Linux partition or create a samba share within windows so windows could read and write files to it, it is likely that files on that drive may be impacted.

Technical analsys can be seen here.

The following diagram summarizes the WannaCrypt infection cycle

Improve this answer
1
  • Good answer but I think the diagram is a bit confusing. It doesn't actually show what wannacry will encrypt which is what the question was about.
    – Elias
    Aug 2, 2017 at 8:18

You must log in to answer this question.