Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
It's funny. Laugh. Security Worms Operating Systems Software Windows Linux

Running Windows Viruses Under Linux 361

Posted by timothy from the under-is-the-right-preposition dept.
ResQuad writes "Everyone loves Windows viruses, right? Well, the crazy people over at NewsForge (owned by the same people that own Slashdot) decided to try running Windows viruses with Wine. So next time you receive an email virus, strike up Wine and see what you can do (or not)."
This discussion has been archived. No new comments can be posted.

Running Windows Viruses Under Linux More

Running Windows Viruses Under Linux

Comments Filter:

  • Obligatory (Score:4, Funny)

    by commodoresloat ( 172735 ) on Wednesday January 26, 2005 @04:25PM (#11484972)
    Will this run on a Lexus?

  • Wine is not an Emulator. (Score:5, Insightful)

    by wot.narg ( 829093 ) <wot,narg&gmail,com> on Wednesday January 26, 2005 @04:25PM (#11484977) Homepage
    Lets see just how non emulator wine is... If the virii own it, its an emulator, if not, its telling the truth.

    Bwhahahh...

    • Re:Wine is not an Emulator. (Score:4, Informative)

      by Jarn_Firebrand ( 845277 ) <eurus103&gmail,com> on Wednesday January 26, 2005 @04:29PM (#11485026)
      Mod parent up and insightful
    • Or it could just be an emulator that doesn't work very well. If you try an early version of bochs/vmware/etc. from before they had networking support, the viruses won't be able to own that either.
      • Wine
        Is
        Not (an)
        Emulator!

        • Re:Wine is not an Emulator. (Score:5, Insightful)

          by m50d ( 797211 ) on Wednesday January 26, 2005 @05:45PM (#11485864) Homepage Journal
          Yeah, just like lame ain't an mp3 encoder. Names aren't always the full story. Wine definitely is an emulator in that it emulates, it just does it on a different level than most emulators, so it doesn't have many of their drawbacks, like the slowness.

        • Re:Wine is not an Emulator. (Score:5, Insightful)

          by dinivin ( 444905 ) on Wednesday January 26, 2005 @05:45PM (#11485867)
          Just because that's what the developer's claim, it doesn't make it so.

          If it quacks like a duck, walks like a duck, and looks like a duck, it's gonna be a duck.

          Wine, acronym or not, is an emulator.

          Dinivin
          • Not necessarily... it might be a wooden witch...

          • Re:Wine is not an Emulator. (Score:3, Informative)

            by Anonymous Coward
            Wine emulates the Win32 API, if anything

            Wine does not emulate a processor, video, or sound subsystem, but rather 'wraps' the necessary calls (in theory) to native Linux calls. It requires an x86 CPU (for which an x86 emulator could be used, I suppose, but it's still not part of Wine).

            And in the situations where real Win32 DLLs are used, it's not even emulating that part of the API.

            It might be considered a simulator, but I doubt it would be considered an emulator.
          • Then it is obvious that you don't know what an emulator is.

            WINE is an implementation of the win32 api on linux, such that windows applications will run on it without recompiling. An application running on WINE isn't encapsulated in a "safe" emulated environment much like vmware would do, it's running in your system just like any other app you're running.

  • Native ports now! (Score:5, Funny)

    by PCM2 ( 4486 ) on Wednesday January 26, 2005 @04:26PM (#11484998) Homepage
    Oh my god, how many times do we have to say it? People, running Windows software under WINE is not a solution. I say all Slashdotters should boycott these software vendors until we get a serious commitment from them to do true, native Linux ports of their products.

    And for that matter, why aren't their open source alternatives to this software already? The open source community won't stay competitive by resting on its laurels.

    • Re:Native ports now! (Score:5, Funny)

      by freshman_a ( 136603 ) on Wednesday January 26, 2005 @04:31PM (#11485044) Homepage Journal
      <sarcasm>

      Yes, I demand that there be open source native Linux ports of all Windows viruses!

      </sarcasm>

    • Re:Native ports now! (Score:5, Insightful)

      by airConditionedGypsy ( 703864 ) on Wednesday January 26, 2005 @04:32PM (#11485065)
      Yes, it is a solution. Especially in situations where you have persuaded your friends and relatives to use Linux, but they still want to use some crappy Windows software because they are used to it, and there are no free/open-source ones.

      Furthermore, the 2% of Linux users don't really constitute a meaningful profit motive for these companies. We need to do more to get Linux on the desktop before they'll jump off the MS ship.

      • And I realize you were being funny ... but for those folks who don't understand you were talking about the virus-writers, I felt obligated to point out that WINE is quite useful.
    • People, running Windows software under WINE is not a solution.

      You just don't get it, do you? How can you expect Windows users to switch to Linux when their most common programs, known as viruses, don't run on Linux?

    • No desire (Score:5, Insightful)

      by Schezar ( 249629 ) on Wednesday January 26, 2005 @04:37PM (#11485116) Homepage Journal
      It's simple. A lot of specialty software is very boring, and there just isn't any interest in the OSS community in developing similar software.

      Many businesses, especially real estate, banking, auto repair, fast food, and hotel management, rely on software written for windows many years ago that, for them, functions just fine.

      They're not techies: computers are not their business. Their business is their business. They're not going to invest resources in developing what they already have just so it can run on "another kind of computer." WINE is the perfect solution for these applications.

      Maybe, years from now, when they're running -ALL- of their software under WINE, they might realize that there's a better way.

      Until then, good luck finding good programmers who are psyched to write hotel reservation management software that will interface an archaic database platform for free.

      Projects like Open Office and The GIMP don't suffer from this problem largely because they're applications that Linux users need on a regular basis. When was the last time you needed to track your fast food orders?

    • Re:Native ports now! (Score:5, Interesting)

      by morcheeba ( 260908 ) on Wednesday January 26, 2005 @04:39PM (#11485145) Journal
      I used to work for a 5-person company. We easily ported our main ap to linux, but a critical tool we used to build our code was developed for windows. It was gui-centric, so a port would be difficult, and besides, all the programmers were algorithm people, not gui people. Wine was a godsend - our old tool just worked, and it saved us a lot of time. Boycotting ourselves wouldn't have gotten us the needed people to port it.
    • If we can prove that their programs can run well under linux with just a few tweaks in how it speaks to the system (WINE [wikipedia.org] is a compatibility layer [wikipedia.org]), and possibly even explain to the company how to change their software to speak correctly, it makes it take a lot less of their time to release a native linux version, as they already know how to do it.

      So if you help them help you, we've got native software on Linux. But, that's just my opinion.

    • Re:Native ports now! (Score:2, Insightful)

      by BuhSnarf ( 633686 )
      Companies wont develop Linux native apps if there isn't the market for them... i.e. Money.

      The problem with the open source movement is that people are used to (and I include myself in this) using software for free. Most people will either use a free alternative or just copy it, crack it etc.

      There just wouldn't be the market. Until there is we're not going to see Linux native apps of big software appear.

      IMHO.

  • Combatibility! Yes! (Score:5, Funny)

    by physicsphairy ( 720718 ) on Wednesday January 26, 2005 @04:27PM (#11485002)
    The last barrier between widows and linux is slowly but surely being eroded by the WINE engineers.

    Brilliant work guys!

  • Damn worm writers... (Score:5, Funny)

    by Anonymous Coward on Wednesday January 26, 2005 @04:27PM (#11485003)
    Programmers these days, don't they even CARE about cross-platform compatability!?

  • That's awhole lot of differences (Score:5, Interesting)

    by Dark Coder ( 66759 ) on Wednesday January 26, 2005 @04:27PM (#11485004)
    True AV and AT (anti-trojan) SW engineers uses VMWARE [vmware.com] for their studies and dissemination of malacious flotsam of codes floating around the internet.

    But the article is "A Good Thing" because it shows EITHER that Wine isn't 100% Microcrap or is more robust against viruses.

    Take your pick.
    • Indeed, VMWare is great for testing out dangerous ideas. Just save a snapshot, then hose the system, then revert back to the original to start over. This came in real handy a few weeks ago when I was experimenting with shrinking and moving reiser root partitions (turns out its not trivial to move the START of a reiser partition, if you, for example, wanted to remove a windows partition that came before it)

  • about time. I almost forgot what a virus was (Score:5, Funny)

    by locutus2k ( 103517 ) on Wednesday January 26, 2005 @04:30PM (#11485033)
    Its nice to see someone finally exploited this long missing aspect of linux. What better way to make a windozer user feel more at home than with their old virus friends.

    Nice article, and congrats matt [mailto] on your first article.

    -Craig
    • You know MS will place in this their new advertisements:

      "Yes if you get Linux you will have more security flaws then Windows."

      They will be able to get away with "more" because they will tweak the numbers to show "more", just like they are able to show that switching from Windows to Linux on an Enterprise level is more expensive then sticking with Windows.

  • Done it. It works. Kinda. (Score:5, Interesting)

    by Frater 219 ( 1455 ) on Wednesday January 26, 2005 @04:30PM (#11485040) Journal
    This past December, one of the engineers at my workplace gave a presentation on WINE. Since I'm the security guy, somone asked me if Windows viruses ran under WINE. So I tried three: Lovgate, a Mydoom variant, and a Netsky variant.

    Lovgate simply exited without doing anything. Mydoom actually crashed WINE into its debugger. The Netsky variant, as the article describes (SomeFool is Netsky) actually ran. Moreover, it did a passel of DNS queries and actually tried to send e-mail (which was rejected). So, if that e-mail had been accepted, Netsky would have been able to propagate under WINE. As in the article, Ctrl-C proved necessary and effective.

    To make a long story short, yes, some Windows viruses do run under WINE. Of course, you have to tell WINE to run them -- not exactly the social engineering that viruses are intended to do. However, as WINE gets more popular and reliable, I would expect that this will be more of a problem for people who choose to (e.g.) run Outlook in WINE.

    (For what it's worth, WINE isn't the only way to run Windows viruses and worms on your non-Windows system. I've had to explain to users that yes, their VMware or Virtual PC system is quite capable of getting wormed, and that yes, they did need to do their Windows Update on that "virtual" Windows system, too.)

    • Of course, you have to tell WINE to run them -- not exactly the social engineering that viruses are intended to do.

      You can tell Mozilla to open .exe's with Wine ;-). Maybe you can add the same mime-types to Gnome and/or KDE!
    • There's no need for social engineering. I remember on Red Hat 7.3, Windows .exe files were automatically launched with Wine under Gnome. Which meant that attachment viruses could be run from Evolution by clicking on the attachment.

      I never tested to see if they worked, but then I never really wanted to find out!
    • So, did you file a bugreport to the Netsky developers?

    • Re:Done it. It works. Kinda. (Score:5, Interesting)

      by kevcol ( 3467 ) on Wednesday January 26, 2005 @05:53PM (#11485950) Homepage
      Not 'kinda' here.

      Propogated.

      I executed a viral attachment once about 4 months ago, and then forgot about it ("Haha! That can't possibly work."). A couple hours later, my 'abuse' address had a complaint. Source IP was my SuSE workstation. Thunderbird even deep-sixed a spam that was sent by my own machine to me. D'oh!

  • How long before.. (Score:3, Funny)

    by cOdEgUru ( 181536 ) * on Wednesday January 26, 2005 @04:32PM (#11485058) Homepage Journal
    The wine developers get a non-compliance notice from Bill forcing them to comply??

    Now, how can you claim full compliance unless you run my viruses too..goddamn it!!

  • Discussed in Ask Slashdot (Score:4, Informative)

    by gbulmash ( 688770 ) * <semi_famous&yahoo,com> on Wednesday January 26, 2005 @04:34PM (#11485079) Homepage Journal
    Oddly enough, this was discussed in an Ask Slashdot [slashdot.org] in October 2003.

    - Greg

  • What about spyware? (Score:5, Funny)

    by RikRat ( 834490 ) on Wednesday January 26, 2005 @04:34PM (#11485087)
    I run Windows spyware under Wine. I also emulate IE6 so I can use CoolWebSearch and other cool searchbars! I have this cute Bonzi Buddy and a system tray icon which tells me the weather!
    • Hey, then this mail I got today was probably for you ;-)

      "Welcome to Health suite. Chek it out!

      nax
      Viagr a Vico din Ci alis Va lium Xa

      Save Yourself up to 80% Off 0rder With Us.
      We are the only store which gives this great deal to you.

      Save Your Health and M0NEY!"

  • ...to stop Wine-ing

    Geeze!

  • Secret APIs (Score:3, Interesting)

    by hey ( 83763 ) on Wednesday January 26, 2005 @04:39PM (#11485155) Journal
    Running Microsoft programs is the hardest for Wine because they use secret function calls. The Virus writers (presumably) aren't insiders so don't know about the secret APIs. Should be easy for Wine.

    • Re:Secret APIs (Score:4, Interesting)

      by TekPolitik ( 147802 ) on Wednesday January 26, 2005 @05:17PM (#11485569) Journal
      Running Microsoft programs is the hardest for Wine because they use secret function calls

      Current CVS versions of Wine can install and run the major MS applications, including MS office and Internet Explorer. Why would you do such a thing, I hear you ask? Because users still use Windows and as developers we still have to write code that interfaces with those applications. Absent that, OpenOffice and Konqueror or Mozilla work perfectly well.

    • Re:Secret APIs (Score:3, Informative)

      by dnaumov ( 453672 )
      Could you possibly talk more of these "sikrit APIs"? What Microsoft products use them? Where are they located? You DO realise that the _ENTIRE_ Windows source code is avaible to akademia as well as goverment entities?
  • Now Windows users have no excuses for not switching to Linux, they can even run they favorite viruses on it!

    I know the viruses didn't run great yet, but that's only a matter of time...

  • Isn't this story (Score:3, Insightful)

    by arodland ( 127775 ) on Wednesday January 26, 2005 @04:41PM (#11485166)
    a couple years old? I'm sure I've seen it before, and I'm pretty sure it was on slashdot.
  • These guys really need to step up their efforts to improve compatability.

  • PE on linux (Score:4, Informative)

    by northcat ( 827059 ) on Wednesday January 26, 2005 @04:42PM (#11485179) Journal
    Linux kernel now supports foriegn binaries. IIRC, some patches are available to enable support for PE binaries (Windows native binaries). If dependencies are kept low, with some clever programming, virii that run on multiple platforms are possible without something like wine or java.
  • WINE is a "contained" platform to let the virus roam free... just like the jurassic park was supposed to be for the re-created dinasaurs... but soon enough, the windows virus will mutate and infect the rest of the machine... taking over linux... ;)

  • Why? (Score:3, Funny)

    by catdevnull ( 531283 ) on Wednesday January 26, 2005 @04:43PM (#11485198)
    Though it's good to know that WINE will do what it's supposed to do--execute code written for Windows, it's kinda silly to think it wouldn't.

    Maybe they'll post a story about, "Why do dumb users get to have all the fun? Why shouldn't Linux admins get in on all the insanity, too? Today we'll be doing rm -rf / to see what happens!"

    Let's not go to Camelot. 'Tis a silly place..."

    • Re:Why? (Score:3, Informative)

      by madstork2000 ( 143169 ) *
      Somebody already did that. I am pretty sure it was mentioned here on slashdot. Anyway here is the URL:

      http://librenix.com/?inode=5508

      Basically a guy wants to see what will do the most damage --

      rm -rf /

      or

      format c:\

    • Re:Why? (Score:3, Informative)

      by remahl ( 698283 )

      Though it's good to know that WINE will do what it's supposed to do--execute code written for Windows, it's kinda silly to think it wouldn't.

      Most of the viruses did not work as expected.

  • Evaluation (Score:3, Funny)

    by c0dedude ( 587568 ) on Wednesday January 26, 2005 @04:48PM (#11485261)
    This article ran fine under firefox and delivered interesting content. The methodology was fundimentally flawed as viruses use obscure problems in Windows. Nevertheless, I'll give this article four meta-penguins, for a score of 4/5.
  • I can believe all the people complaining that this is a waste of time. Don't you know how much FUN viruses can be?

    Take Magistr: I'd spend HOURS chasing my icons all over the desktop. Or what about the one that would crash my system every time I shot a rocket into a wall in Quake 2 (I'm not joking, I really had one that did this)?

    Come on, this is quality entertainment!
  • I'm still waiting for the e-mail telling me to launch the attached jar file.

  • Been there, done that '99 (Score:3, Interesting)

    by wertarbyte ( 811674 ) on Wednesday January 26, 2005 @04:53PM (#11485315) Homepage
    Right before Y2K, there was a worm/virus/whatever called Happy99.exe. If you secured your wine installation prior execution, you could watch the pretty fireworks it produced without harming your installation.

  • Old-school virus propogation... (Score:3, Informative)

    by Xaroth ( 67516 ) on Wednesday January 26, 2005 @04:55PM (#11485333) Homepage
    From the article:

    Oh sure, I could manually forward these viruses to the folks in my address book, but where's the fun in that?

    This reminds me of the old standby text-based, system agnostic viruses, some of which can be seen here [nerdherd.com].

  • Wine devs test for this (Score:5, Interesting)

    by bluGill ( 862 ) on Wednesday January 26, 2005 @04:56PM (#11485344)

    At the last WineConf (almost exactly one year ago) some of the Wine developers were testing the hot mail virus of the day to make sure it ran. That was the one that activated as a DDoS on www.sco.com. It ran, and after putting making www.sco.com resolve to 127.0.0.1 in /etc/hosts it attempted to take down the local machine.

    We also found the back door, and came close to getting arbitrary programs to run from it, but supper came before we got that part working. We think it would have worked if a free meal hadn't gotten in the way.

    So now you know. If a windows virus doesn't run under wine you can thank CodeWeavers for buying everyone a meal before we got it implimented.

  • The Sound of One Hand Clapping (Score:5, Interesting)

    by 4of12 ( 97621 ) on Wednesday January 26, 2005 @05:02PM (#11485411) Homepage Journal

    So, if WINE fails to properly run a Windows virus under Linux, is it considered a bug or a feature?

  • You know, some dimwit is going to read this thread and/or the article and go running to his boss saying, "See? SEE?! Linux has Windows viruses too!"

    Just you wait and see....
  • Almost as sick as compiling KDE to run under Cygwin so that you could have a KDE desktop on your windows box.. Just 'cause you can do it, just dont make it right! Ugh.

  • Wine - could do better (Score:4, Funny)

    by martin ( 1336 ) <maxsec@nosPaM.gmail.com> on Wednesday January 26, 2005 @06:06PM (#11486084) Journal
    Obviously work is still needed on Wine to make it more Windows compatible :-)

  • Am I Missing Something? (Score:3, Funny)

    by Cruxus ( 657818 ) on Wednesday January 26, 2005 @06:31PM (#11486355) Journal

    Hello, fellow Slashdotters,

    I use Microsoft Windows XP, Professional Edition, Service Pack 2; yet my computer is missing the viruses mentioned in this article. Where did I go wrong? My Web browser is Mozilla Firefox 1.0, and my e-mail client is Mozilla Thunderbird 1.0. Should I change these? Microsoft Internet Explorer 6.0 SP-2 is resident on my computer for testing my websites in this popular program. Should I browse more freely with it? I prefer to use open-source-licensed software on my computer when possible (except the OS itself, although I do have an underutilized Debian partition). Should I start downloading random programs without being sure they do not contain any kind of malware?

    I just want to get along better with my fellow Windows users! Please, help!

  • Linux viruses already exist! (Score:4, Funny)

    by eric.t.f.bat ( 102290 ) on Wednesday January 26, 2005 @07:04PM (#11486635)
    I suspect I may have a virus on my Linux system. The other day I switched the computer on, and it took a very long time to boot - and kept spewing out all this cryptic text as it did. After I logged in, I noticed that my desktop menu had a lot of strange, poorly documented programs in it, some of which didn't seem to do anything useful. The configuration system was strangely flakey, popping up tabbed windows that wouldn't go away when I clicked on other options. Various programs worked partially, but in some of them the clipboard didn't work properly and in others the windows widgets and controls looked wrong. A few would randomly open shell windows when I tried running them, even though they were GUI programs. The windows theming/skinning system worked partially, at best. I tried running a graphics program, but it just opened up lots of windows all over the screen and I couldn't get it to do anything reasonable, so I gave up. I suspect it was the cause of the virus infection, in fact, because it was called some insulting and childish name that had nothing to do with Graphics or Image Manipulation Programs or anything else. Oh, and there's this picture that shows up everywhere, of some kind of anatomically improbable cartoon bird with an eating disorder, which is either a symptom of virus infection or else a failed attempt at coordinated branding by a lot of uncoordinated programmers.

    In general, my Linux system seems to be totally hosed. I think I'll go back to Windows.

Slashdot Top Deals

The computer is to the information industry roughly what the central power station is to the electrical industry. -- Peter Drucker

Close