Is there any known virus that targets the main operating systems: Windows, Linux and Mac OS X?

  • Do XSS and Java / .NET exploits count? – halfbit Jul 26 '14 at 18:26
  • @makerofthings7 JavaScript and Java are portable, so they could be used for this purpose (even if we can not speak about viruses in JavaScript). Whatever the language in which the virus is programmed with, i would love to see any name if it exist – user45139 Jul 26 '14 at 18:44
  • possible duplicate of Can viruses be transfered across incompatible architectures? – Mark Jul 26 '14 at 20:25

Most drive by malware downloads first start out with javascript. A quick search shows this as a good simple example:

var OSName="Unknown OS";
if (navigator.appVersion.indexOf("Win")!=-1) OSName="Windows";
if (navigator.appVersion.indexOf("Mac")!=-1) OSName="MacOS";
if (navigator.appVersion.indexOf("X11")!=-1) OSName="UNIX";
if (navigator.appVersion.indexOf("Linux")!=-1) OSName="Linux";
document.write('Your OS: '+OSName);

Once the OS is determined (more likely with more detail), javascript can also detect versions of plugins such as Java, Flash and Silverlight (in order of preference from what I've seen). These 3 plugins are targeted because they provide a layer between the OS and the malicious code the javascript will then force the browser to download, which means the exploit doesn't have to be concerned with exploit techniques such as DEP or ASLR.

If, for example, Java 7 update 1 was detected, the malicious javascript may direct the browser to download a java exploit (a jar file) based on CVE-2012-1723, which affect Java 7 update 4 and earlier. Once the browser downloads the jar file and runs it, java.exe takes the downloaded code and executes it in a sandbox. The exploit takes advantage of CVE-2012-1723 to break out of that sandbox, letting it interact with the OS directly. Since java's capabilities are limited compared to a natively running binary, the malicious jar file will detect the specific OS version, and download a binary specific for that system (an exe for windows, linux binary for debian, ect). This downloaded and executed exe is just a program at this point, it doesn't have to worry about ASLR or other protections as it's not actually exploiting anything, it's just running.

To answer your specific question, there isn't a virus binary that will run cross platform, the above scenario using cross platform technology (flash and java primarily) is the closest thing I know of.


Usually how they work is the user runs a java application or applet (whether known to the user or not) and due to java being cross platform it detects the OS and typically from there downloads a virus more machine specific usually written in C or C++