Running Windows Viruses Under Linux

ResQuad writes "Everyone loves Windows viruses, right? Well, the crazy people over at NewsForge (owned by the same people that own Slashdot) decided to try running Windows viruses with Wine. So next time you receive an email virus, strike up Wine and see what you can do (or not)."

Comments

Obligatory

[commodoresloat]

Will this run on a Lexus?

Re:Obligatory

[greechneb]

Don't give them any ideas. Next thing you know we'll see Norton antivirus:Auto 2005 - guaranteed to keep your system virus free AND improve your gas mileage!

Re:Obligatory

[lukewarmfusion]

Along with my 3-month oil changes, six month tire rotations, and annual checkup, I need to buy a new LiveUpdate license so my car won't crash?

To be fair, if I spent that much on a Lexus I should expect to see pictures of Anna Kournikova.

Re:Obligatory

[3TimeLoser]

For that amount of money, I'd expect to see her in the passenger seat.

Although, I'm sure my wife would not agree.

Re:Obligatory

[Illserve]

I'm willing to bet that upon looking back, this statement is going to be much less funny in 10 years.

Wine is not an Emulator.

[wot.narg]

Lets see just how non emulator wine is... If the virii own it, its an emulator, if not, its telling the truth.

Bwhahahh...

Re:Wine is not an Emulator.

[Jarn_Firebrand]

Mod parent up and insightful

Re:Wine is not an Emulator.

[Anonymous Coward]

Mod parent up Informative. Mod this post Funny.

Re:Wine is not an Emulator.

[Lord Kano]

You are correct.

We have "bling bling" and "ain't" in dictionaries. Marijuana is legally classified as a "narcotic", when in pharmacology only opiates can be narcotics.

The language changes. It may suck, but it's reality.

LK

Re:Wine is not an Emulator.

[m50d]

Yeah, just like lame ain't an mp3 encoder. Names aren't always the full story. Wine definitely is an emulator in that it emulates, it just does it on a different level than most emulators, so it doesn't have many of their drawbacks, like the slowness.

Re:Wine is not an Emulator.

[dinivin]

Just because that's what the developer's claim, it doesn't make it so.

If it quacks like a duck, walks like a duck, and looks like a duck, it's gonna be a duck.

Wine, acronym or not, is an emulator.

Dinivin

Native ports now!

[PCM2]

Oh my god, how many times do we have to say it? People, running Windows software under WINE is not a solution. I say all Slashdotters should boycott these software vendors until we get a serious commitment from them to do true, native Linux ports of their products.

And for that matter, why aren't their open source alternatives to this software already? The open source community won't stay competitive by resting on its laurels.

Re:Native ports now!

[freshman_a]

Yes, I demand that there be open source native Linux ports of all Windows viruses!

</sarcasm>

Re:Native ports now!

[airConditionedGypsy]

Yes, it is a solution. Especially in situations where you have persuaded your friends and relatives to use Linux, but they still want to use some crappy Windows software because they are used to it, and there are no free/open-source ones.

Furthermore, the 2% of Linux users don't really constitute a meaningful profit motive for these companies. We need to do more to get Linux on the desktop before they'll jump off the MS ship.

Re:Native ports now!

[morcheeba]

I used to work for a 5-person company. We easily ported our main ap to linux, but a critical tool we used to build our code was developed for windows. It was gui-centric, so a port would be difficult, and besides, all the programmers were algorithm people, not gui people. Wine was a godsend - our old tool just worked, and it saved us a lot of time. Boycotting ourselves wouldn't have gotten us the needed people to port it.

Combatibility! Yes!

[physicsphairy]

The last barrier between widows and linux is slowly but surely being eroded by the WINE engineers.

Brilliant work guys!

Damn worm writers...

[Anonymous Coward]

Programmers these days, don't they even CARE about cross-platform compatability!?

Re:Damn worm writers...

[einhverfr]

Programmers these days, don't they even CARE about cross-platform compatability!?

Right. At least the Morris Worm was distributed with the Source Code and was cross-platform. Go look for something like this today.

That's awhole lot of differences

[Dark Coder]

True AV and AT (anti-trojan) SW engineers uses VMWARE for their studies and dissemination of malacious flotsam of codes floating around the internet.

But the article is "A Good Thing" because it shows EITHER that Wine isn't 100% Microcrap or is more robust against viruses.

Take your pick.

Re:His point?

[kempokaraterulz]

The point being its not a zip file to begin with. its simply disguised as one.

about time. I almost forgot what a virus was

[locutus2k]

Its nice to see someone finally exploited this long missing aspect of linux. What better way to make a windozer user feel more at home than with their old virus friends.

Nice article, and congrats matt on your first article.

-Craig

Done it. It works. Kinda.

[Frater 219]

This past December, one of the engineers at my workplace gave a presentation on WINE. Since I'm the security guy, somone asked me if Windows viruses ran under WINE. So I tried three: Lovgate, a Mydoom variant, and a Netsky variant.

Lovgate simply exited without doing anything. Mydoom actually crashed WINE into its debugger. The Netsky variant, as the article describes (SomeFool is Netsky) actually ran. Moreover, it did a passel of DNS queries and actually tried to send e-mail (which was rejected). So, if that e-mail had been accepted, Netsky would have been able to propagate under WINE. As in the article, Ctrl-C proved necessary and effective.

To make a long story short, yes, some Windows viruses do run under WINE. Of course, you have to tell WINE to run them -- not exactly the social engineering that viruses are intended to do. However, as WINE gets more popular and reliable, I would expect that this will be more of a problem for people who choose to (e.g.) run Outlook in WINE.

(For what it's worth, WINE isn't the only way to run Windows viruses and worms on your non-Windows system. I've had to explain to users that yes, their VMware or Virtual PC system is quite capable of getting wormed, and that yes, they did need to do their Windows Update on that "virtual" Windows system, too.)

Re:Done it. It works. Kinda.

[kevcol]

Not 'kinda' here.

Propogated.

I executed a viral attachment once about 4 months ago, and then forgot about it ("Haha! That can't possibly work."). A couple hours later, my 'abuse' address had a complaint. Source IP was my SuSE workstation. Thunderbird even deep-sixed a spam that was sent by my own machine to me. D'oh!

What about spyware?

[RikRat]

I run Windows spyware under Wine. I also emulate IE6 so I can use CoolWebSearch and other cool searchbars! I have this cute Bonzi Buddy and a system tray icon which tells me the weather!

How many times do I have to tell you k|dd|35...

[gotgenes]

...to stop Wine-ing

Geeze!

No desire

[Schezar]

It's simple. A lot of specialty software is very boring, and there just isn't any interest in the OSS community in developing similar software.

Many businesses, especially real estate, banking, auto repair, fast food, and hotel management, rely on software written for windows many years ago that, for them, functions just fine.

They're not techies: computers are not their business. Their business is their business. They're not going to invest resources in developing what they already have just so it can run on "another kind of computer." WINE is the perfect solution for these applications.

Maybe, years from now, when they're running -ALL- of their software under WINE, they might realize that there's a better way.

Until then, good luck finding good programmers who are psyched to write hotel reservation management software that will interface an archaic database platform for free.

Projects like Open Office and The GIMP don't suffer from this problem largely because they're applications that Linux users need on a regular basis. When was the last time you needed to track your fast food orders?

Yes, but

[einhverfr]

What would RMS say?

Is that virus Free Software?

Re:Yes, but

[einhverfr]

That's GNU/MyDoom

Or maybe MyGNUUM?

What is MyGNUUM? MyGNUUM is a port of the popular Windows mass-mailer "MyDoom." It is licensed under the GNU GPL, which some have criticized as a "viral" license.

Because it didn't execute the not-zip file

[SuperKendall]

When a zip file on Linux is not a zip file, you get an error.

When a zip file on Windows is not a zip file, you get some system enhancemnets you may not have wished for (or would even wish on your worst enemy).

Wine devs test for this

[bluGill]

At the last WineConf (almost exactly one year ago) some of the Wine developers were testing the hot mail virus of the day to make sure it ran. That was the one that activated as a DDoS on www.sco.com. It ran, and after putting making www.sco.com resolve to 127.0.0.1 in /etc/hosts it attempted to take down the local machine.

We also found the back door, and came close to getting arbitrary programs to run from it, but supper came before we got that part working. We think it would have worked if a free meal hadn't gotten in the way.

So now you know. If a windows virus doesn't run under wine you can thank CodeWeavers for buying everyone a meal before we got it implimented.

If you do this,

[Jeremiah Cornelius]

If you do this - run the exploit code - can you spell it Whine?

Whine is Hazardous, even If Not and Emulator

The Sound of One Hand Clapping

[4of12]

So, if WINE fails to properly run a Windows virus under Linux, is it considered a bug or a feature?

Re:The Sound of One Hand Clapping

[Anonymous Coward]

Yes