Testing virusses under Linux

[Nod]

I ran into these two old articles:
Running Windows viruses with Wine

It just isn't fair that Windows users get all the viruses. I mean really, shouldn't Linux users be in on the fun as well? Well... thanks to the folks running the Wine project, Linux users can "catch the virus bug" too -- sort of.

and,
Hands-on testing of the new Linux virus

Thanks to one of our readers, NewsForge has obtained a copy of the widely reported Windows/Linux cross-platform "proof of concept" virus. News reports thus far on the code have contradicted themselves: some reported the virus can replicate itself on both Windows and Linux, others saying it has a viral nature only on Windows. Testing by both NewsForge staff and Hans-Werner Hilse may reveal why the confusion.

 

[The_Unbeliever]

Why?

We don't need viruses on Linux.

Based on our examination of the code, Linux users need to be aware of two things. First, given the right permissions, a virus can replicate itself on Linux. This, however, has never been in doubt -- it remains to be seen whether malware authors can create a virus that can spread as easily on Linux as viruses on Windows. Second, this "proof of concept" is an excellent example of why running as root is a very bad idea.

errrr... this do mean that if your userspace have been infected, and you su as root, then you'll have a problem, especially if the viral code still is active.

Best course of action - log out, log in as root, do your stuff, log out, and log in again. (or am I mistaken?)

 

[Nod]

Why?

We don't need viruses on Linux.

I think they just wanted to see what will happen if they tried to run it, and what the effort would be to actually make it work.

errrr... this do mean that if your userspace have been infected, and you su as root, then you'll have a problem, especially if the viral code still is active.

Best course of action - log out, log in as root, do your stuff, log out, and log in again. (or am I mistaken?)

su'ing to root wouldn't do anything. The virus will have to be executed as the root user in order to infect the whole system.

Running a virus in wine, wouldn't do much to the system, unless it was designed to run in wine, then it might be able to infect your whole home directory. If it is not Linux aware, you would simply remove your "~/.wine" directory to get rid of it.

 

[The_Unbeliever]

Ahhh thanks for the clarification!