Wine runs your malware!

[David Gerard]

http://www.trustedsource.org/blog/186/R ... e-in-Linux

So: avoid running toxic waste, and use a fresh .wine and run ClamAV
over it regularly if you're fond of trying random binaries found on
the Net a lot


- d.

[kareeser]

Windows malware cannot affect the Linux filesystem, just as most viruses can't do much damage to a Linux filesystem.

It has to do with the limited permissions given. Therefore, if you get malware from using iexplore.exe, it will only affect files in your virtual WINE C drive.

[James Mckenzie]

David Gerard <[email protected]> wrote on Feb 24:

Sent: Feb 24, 2009 9:04 AM

http://www.trustedsource.org/blog/186/R ... e-in-Linux

So: avoid running toxic waste, and use a fresh .wine and run ClamAV
over it regularly if you're fond of trying random binaries found on
the Net a lot

Really informatative article. I like the bottom of the article warnings as well.

Now the question is: Are we THAT GOOD?

James McKenzie

[James Mckenzie]

kareeser <[email protected]> wrote on Feb 24th:

Windows malware cannot affect the Linux filesystem, just as most viruses can't do much damage to a
Linux filesystem.

What about sector 0 viruses and those that wipe the Partition table? Yes, FAT and NTFS viruses cannot do anything to your system as well as those that only affect DOS and Windows executibles. However, if you get hit with MonkeyB (look it up, its a partition virus), it may run in Wine and it will definitely ruin your day (hope you had a good backup, like I did.)

It has to do with the limited permissions given. Therefore, if you get malware from using iexplore.exe, it will only affect files in your virtual WINE C drive.

True, if the virus only affects files. See the above.

James McKenzie

[David Gerard]

2009/2/24 kareeser <[email protected]>:

Windows malware cannot affect the Linux filesystem, just as most viruses can't do much damage to a Linux filesystem.
It has to do with the limited permissions given. Therefore, if you get malware from using iexplore.exe, it will only affect files in your virtual WINE C drive.

Ah, stuff running under Wine runs as you. So it can change any file
you can. Which means your entire home directory, i.e. anything you
actually care about.

(For added points: a sufficiently obnoxious piece of malware could
easily put itself in a quiet corner of your home folder, set itself to
restart as a cron or at job, listen to the net on a high port as you,
send email on port 25 as you ... that's just obvious stuff off the top
of my head.)


- d.

[David Gerard]

2009/2/24 James Mckenzie <[email protected]>:

kareeser <[email protected]> wrote on Feb 24th:

Windows malware cannot affect the Linux filesystem, just as most viruses can't do much damage to a
Linux filesystem.

What about sector 0 viruses and those that wipe the Partition table?  Yes, FAT and NTFS viruses cannot do anything to your system as well as those that only affect DOS and Windows executibles.  However, if you get hit with MonkeyB (look it up, its a partition virus), it may run in Wine and it will definitely ruin your day (hope you had a good backup, like I did.)

You'd need to be root to attack the partition table or MBR.


- d.

[James Mckenzie]

David Gerard <[email protected]> wrote on Feb 24th:

2009/2/24 James Mckenzie <[email protected]>:

kareeser <[email protected]> wrote on Feb 24th:

Windows malware cannot affect the Linux filesystem, just as most viruses can't do much damage to a
Linux filesystem.

What about sector 0 viruses and those that wipe the Partition table?  Yes, FAT and NTFS viruses cannot do anything to your system as well as those that only affect DOS and Windows executibles.  However, if you get hit with MonkeyB (look it up, its a partition virus), it may run in Wine and it will definitely ruin your day (hope you had a good backup, like I did.)

You'd need to be root to attack the partition table or MBR.

Take a look at the number of folks who report problems who ARE running as root. Austin English tried to get AJ to change his mind about warning folks when they are running Wine as root, either deliberately to get around several known issues, or accidentally. I agree that a message should appear when you attempt to run Wine as root, but how is in question.

James McKenzie

[James Mckenzie]

David Gerard <[email protected]> wrote on Feb 24th:

2009/2/24 kareeser <[email protected]>:

Windows malware cannot affect the Linux filesystem, just as most viruses can't do much damage to a Linux filesystem.
It has to do with the limited permissions given. Therefore, if you get malware from using iexplore.exe, it will only affect files in your virtual WINE C drive.

Ah, stuff running under Wine runs as you. So it can change any file
you can. Which means your entire home directory, i.e. anything you
actually care about.

(For added points: a sufficiently obnoxious piece of malware could
easily put itself in a quiet corner of your home folder, set itself to
restart as a cron or at job, listen to the net on a high port as you,
send email on port 25 as you ... that's just obvious stuff off the top
of my head.)

At least Storm would not be able to function and you would definitely know it was there (it attempts to use port 25/SMTP). However, the person who blogged the article was not able to get a keylogger to run successfully. I consider that an improvement as a normal user running Wine should not be able to grab the keyboard. It will be interesting to see if this will be possible as improvements are made to Wine.

James McKenzie

[austin987]

On Tue, Feb 24, 2009 at 1:33 PM, James Mckenzie
<[email protected]> wrote:

David Gerard <[email protected]> wrote on Feb 24th:

2009/2/24 James Mckenzie <[email protected]>:

kareeser <[email protected]> wrote on Feb 24th:

What about sector 0 viruses and those that wipe the Partition table?  Yes, FAT and NTFS viruses cannot do anything to your system as well as those that only affect DOS and Windows executibles.  However, if you get hit with MonkeyB (look it up, its a partition virus), it may run in Wine and it will definitely ruin your day (hope you had a good backup, like I did.)

You'd need to be root to attack the partition table or MBR.

Take a look at the number of folks who report problems who ARE running as root.  Austin English tried to get AJ to change his mind about warning folks when they are running Wine as root, either deliberately to get around several known issues, or accidentally.  I agree that a message should appear when you attempt to run Wine as root, but how is in question.

James McKenzie

He told me a way that was acceptable, but unfortunately, I don't know
how to implement it quite yet. Anyone with moderate C experience
should be able to do so, however.

If anyone's interested, e-mail/pm me and I'll assist you.
--
-Austin