Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #189802 > unrolled thread

is there any Windows virus that affect linux?

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  is there any Windows virus that affect linux? Long Wind <longwind2@yahoo.com> - 2017-12-12 01:00 +0100
    Re: is there any Windows virus that affect linux? Dan Purgert <dan@djph.net> - 2017-12-12 03:50 +0100
      Re: is there any Windows virus that affect linux? Anil Duggirala <anilduggirala@fastmail.fm> - 2017-12-12 10:50 +0100
        Re: is there any Windows virus that affect linux? <tomas@tuxteam.de> - 2017-12-12 11:10 +0100
          Re: is there any Windows virus that affect linux? Anil Duggirala <anilduggirala@fastmail.fm> - 2017-12-12 11:20 +0100
            Re: is there any Windows virus that affect linux? <tomas@tuxteam.de> - 2017-12-12 11:30 +0100
          Re: is there any Windows virus that affect linux? "x9p" <debian@x9p.org> - 2017-12-13 01:30 +0100
            Re: is there any Windows virus that affect linux? tomas@tuxteam.de - 2017-12-13 09:20 +0100
              Re: is there any Windows virus that affect linux? "x9p" <debian@x9p.org> - 2017-12-13 12:40 +0100
              Re: is there any Windows virus that affect linux? Jeroen Mathon <jeroenmathonmac@gmail.com> - 2017-12-13 13:20 +0100
                Re: is there any Windows virus that affect linux? Stefan Monnier <monnier@iro.umontreal.ca> - 2017-12-13 17:50 +0100
                  Re: is there any Windows virus that affect linux? <tomas@tuxteam.de> - 2017-12-13 18:40 +0100
                  Re: is there any Windows virus that affect linux? "x9p" <debian@x9p.org> - 2017-12-14 02:50 +0100
              Re: is there any Windows virus that affect linux? John Hasler <jhasler@newsguy.com> - 2017-12-13 17:40 +0100

#189802 — is there any Windows virus that affect linux?

[Multipart message — attachments visible in raw view] — view raw

i have Windows XP and Linux on one diskis there any XP virus that can spread to linux?
Thanks!

[toc] | [next] | [standalone]

#189808

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Long Wind wrote:
> i have Windows XP and Linux on one diskis there any XP virus that can
> spread to linux?
> Thanks!


Generally no, given that Windows and Linux use different executable
formats.  That being said, you can still spread infected files around --
that is, if you download an infected file under linux, when you try to
open it under windows, it'll infect your windows install.

That being said, Windows XP should be banned from any form of external
communications -- it's quite dead and forgotten by Microsoft.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJaLz9TAAoJEI4R3fMSeaKBOfIH/3Tkpl+JcIx4lMe/MvnxcrZw
ehhxqkRNlBsYEbUAB0RLsn080rxYCSSDH049RdjZfmiouDGpLL/4YOhQb/Clg8dv
0Tnm5FViOZfNukYPO+9yHkVNgrhwI4T5a9FcnhH84xM1xFQODHxXGyc5q1/ZZiH7
hbSXqWUMzCZMmg5du41LaOvlK6s3NLN+keIpseLU0v4m0NWlrxMnI7CB+1d9KgNk
VZFmRiV8qtRbS2s7w9NzwxYop1j2/aN04+wtMQvQHYJfMF45kVchaSp/LuINKCH8
/BAeOJ+nrg2v40CQPQEsHBI6gTFgpu0AzPii2YmgsPDS+Fr0C63UxwWglziBcE0=
=p04g
-----END PGP SIGNATURE-----

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#189813

Ill ask another question here. Is having dual boot Windows 10 (or 7 or
8) and Linux a security risk? Will malicious Windows programs gain
access to Linux files (files in the Linux partition?)? Does GPT help
here? 
thanks,

On Mon, Dec 11, 2017, at 09:31 PM, Dan Purgert wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Long Wind wrote:
> > i have Windows XP and Linux on one diskis there any XP virus that can
> > spread to linux?
> > Thanks!
> 
> 
> Generally no, given that Windows and Linux use different executable
> formats.  That being said, you can still spread infected files around --
> that is, if you download an infected file under linux, when you try to
> open it under windows, it'll infect your windows install.
> 
> That being said, Windows XP should be banned from any form of external
> communications -- it's quite dead and forgotten by Microsoft.
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> 
> iQEcBAEBAgAGBQJaLz9TAAoJEI4R3fMSeaKBOfIH/3Tkpl+JcIx4lMe/MvnxcrZw
> ehhxqkRNlBsYEbUAB0RLsn080rxYCSSDH049RdjZfmiouDGpLL/4YOhQb/Clg8dv
> 0Tnm5FViOZfNukYPO+9yHkVNgrhwI4T5a9FcnhH84xM1xFQODHxXGyc5q1/ZZiH7
> hbSXqWUMzCZMmg5du41LaOvlK6s3NLN+keIpseLU0v4m0NWlrxMnI7CB+1d9KgNk
> VZFmRiV8qtRbS2s7w9NzwxYop1j2/aN04+wtMQvQHYJfMF45kVchaSp/LuINKCH8
> /BAeOJ+nrg2v40CQPQEsHBI6gTFgpu0AzPii2YmgsPDS+Fr0C63UxwWglziBcE0=
> =p04g
> -----END PGP SIGNATURE-----
> 
> -- 
> |_|O|_| Registered Linux user #585947
> |_|_|O| Github: https://github.com/dpurgert
> |O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281
> 

[toc] | [prev] | [next] | [standalone]

#189814

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Dec 12, 2017 at 04:40:07AM -0500, Anil Duggirala wrote:
> Ill ask another question here. Is having dual boot Windows 10 (or 7 or
> 8) and Linux a security risk? Will malicious Windows programs gain
> access to Linux files (files in the Linux partition?)? Does GPT help
> here? 

Think for yourself a bit: technically it is perfectly possible. The
Linux partition is accessible from windows and, given some sort of
library for "understanding" the file system (probably ext4), files
can be modified this way. Vice-versa, the windows partition will be
accessible from Linux.

So in both cases, and given enough access rights, software can modify
the respective "other side". Only perhaps full-disk encryption (and
using different keys on both sides, and being particularly suspicious
when you get asked for the "wrong" key) might help you here. Except...
there's the unencrypted boot partition (cf. "evil maid attack").

There is an history of such "mixed target" attacks: Stuxnet[1] comes
to mind, whose ultimate target was (quite probably) the Siemens S7
SCADA at the uranium enrichment plant in Natanz/Iran, but as a stepping
stone it first infected the Windows machines used as operator front
ends connected to the S7.

It takes some dedication to even understand what Stuxnet was doing
there, mind you.

That said, this kinds of attacks are so complex that (as in the
case of Stuxnet) it possibly takes the resources of a nation-state
(or, in this case, probably two) to set something up like that.
OTOH things are pretty fluid these days, so I wouldn't count on
that staying the same for a long time.

So to sum up -- you'll have to read up on many things to even
understand an answer to your question. My current answer would
be (to some high, but unspecified degree of probability) "No",
but that might change whithin the next couple o'years.

Cheers

[1] https://en.wikipedia.org/wiki/Stuxnet
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlovqLIACgkQBcgs9XrR2kYs2wCePta+m261wwRGfqr2wY1Lr9GV
fdwAniuQ7tyLwiZ4WQ7KVkxf8ySea+x1
=zrZZ
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#189816

 Think for yourself a bit: technically it is perfectly possible. The
> Linux partition is accessible from windows and, given some sort of
> library for "understanding" the file system (probably ext4), files
> can be modified this way. Vice-versa, the windows partition will be
> accessible from Linux.

Yes, that is what I am thinking. I have often accesed (viewed) Windows
files from linux but not the other way around. I trust 10 times more on
Linux security than in Windows, thus having dual-boot in my mind,
diminishes my security ten-fold. Is there any safeguard in Windows (or
in Linux) to avoid this access to a different partition?

> So in both cases, and given enough access rights, software can modify
> the respective "other side". Only perhaps full-disk encryption (and
> using different keys on both sides, and being particularly suspicious
> when you get asked for the "wrong" key) might help you here. Except...
> there's the unencrypted boot partition (cf. "evil maid attack").

How does the boot partition play a role here? Is the software planted in
Windows (or Linux) and then executed at boot?

thanks very much.

[toc] | [prev] | [next] | [standalone]

#189817

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Dec 12, 2017 at 05:09:59AM -0500, Anil Duggirala wrote:
>  Think for yourself a bit: technically it is perfectly possible. The
> > Linux partition is accessible from windows and, given some sort of
> > library for "understanding" the file system (probably ext4), files
> > can be modified this way. Vice-versa, the windows partition will be
> > accessible from Linux.
>
> Yes, that is what I am thinking. I have often accesed (viewed) Windows
> files from linux but not the other way around. I trust 10 times more on
> Linux security than in Windows, thus having dual-boot in my mind,
> diminishes my security ten-fold. Is there any safeguard in Windows (or
> in Linux) to avoid this access to a different partition?

Well, in Linux you've to be root to mount a partition (if you are using
a desktop environment, this fact is somewhat "cloaked" by PolicyKit
and friends). On Windows there'll be a similar mechanism, likewise
watered down by some convenience wrapper.

> > So in both cases, and given enough access rights, software can modify
> > the respective "other side". Only perhaps full-disk encryption (and
> > using different keys on both sides, and being particularly suspicious
> > when you get asked for the "wrong" key) might help you here. Except...
> > there's the unencrypted boot partition (cf. "evil maid attack").
>
> How does the boot partition play a role here? Is the software planted in
> Windows (or Linux) and then executed at boot?

That's the idea. In its simplest form, it would "impersonate" the
dialog asking you for your encryption passphrase (up to that point
things have to be unencrypted, remember[1]) and then, say phone home
giving away your passphrase.  Read on "evil maid attack"[2] (a stupid
name, but which has become somewhat standard in the field).

[1] Unless you have some help from the hardware. But given the
   last news on Intel's Management Engine, it's not really clear
   who that hardware is helping (it just seems clear it's not
   the user, though).

[2] https://en.wikipedia.org/wiki/Rootkit#Bootkits

> thanks very much.

You are welcome :-)

Cheers
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlovrwIACgkQBcgs9XrR2kZa+QCfdmSVblwgpm8j1UaUoGEhmMXK
4e0AnjKWy+Ye8Zssn53+PY66QzrGcgCM
=MA/w
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#189827

On Tue, December 12, 2017 8:00 am, tomas@tuxteam.de wrote:
...
> That said, this kinds of attacks are so complex that (as in the
> case of Stuxnet) it possibly takes the resources of a nation-state
> (or, in this case, probably two) to set something up like that.
> OTOH things are pretty fluid these days, so I wouldn't count on
> that staying the same for a long time.
>
> So to sum up -- you'll have to read up on many things to even
> understand an answer to your question. My current answer would
> be (to some high, but unspecified degree of probability) "No",
> but that might change whithin the next couple o'years.
>
...

If a nation-state wanna play games with you, there are a lot of more
important things you should really care about...

ps:

ELF --> PE infection on FAT/FAT32/NTFS partition on same disk, unencrypted
(quite easy)
PE --> ELF infection on ext? partition on same disk, unencrypted (bit more
of work)

cheers.

--
x9p | PGP : 0x03B50AF5EA4C8D80 / 5135 92C1 AD36 5293 2BDF  DDCC 0DFA 74AE
1524 E7EE

[toc] | [prev] | [next] | [standalone]

#189839

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Dec 12, 2017 at 10:25:18PM -0200, x9p wrote:
> 
> On Tue, December 12, 2017 8:00 am, tomas@tuxteam.de wrote:
> ...
> > That said, this kinds of attacks are so complex that [...] it
> > possibly takes the resources of a nation-state [...]

> If a nation-state wanna play games with you, there are a lot of more
> important things you should really care about...

If they target *you* individually, yes, they have cheaper means at
their disposal. That's called "rubber hose cryptanalysis"[1] -- not
pretty. Or, as Schneier put it "the NSA is better at breaking knuckles
than at breaking codes".

Still, for an attack of the Natanz type, they seem to have picked
the Stuxnet way, and you and me might end up as collaterals.

> ps:
> 
> ELF --> PE infection on FAT/FAT32/NTFS partition on same disk, unencrypted
> (quite easy)
> PE --> ELF infection on ext? partition on same disk, unencrypted (bit more
> of work)

Yes. Unencrypted is easy. Encrypted... well you have to stick to the
(necessarily) unencrypted bit.

Cheers

[1] Or, as XKCD puts it, in a similarly charming way, "$5 wrench cryptanalysis"
   <https://www.xkcd.com/538/>

- -- t
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlow4hAACgkQBcgs9XrR2kZFhgCdHSFMmz3D0FUNXiMfUbl+wGgV
dPgAmQHNQKfQ6aP2/dAUmlajyx7lkoUN
=aQ72
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#189845

On Wed, December 13, 2017 6:17 am, tomas@tuxteam.de wrote:
...
> If they target *you* individually, yes, they have cheaper means at
> their disposal. That's called "rubber hose cryptanalysis"[1] -- not
> pretty. Or, as Schneier put it "the NSA is better at breaking knuckles
> than at breaking codes".
>
> Still, for an attack of the Natanz type, they seem to have picked
> the Stuxnet way, and you and me might end up as collaterals.

so true.

> [1] Or, as XKCD puts it, in a similarly charming way, "$5 wrench
> cryptanalysis"
>    <https://www.xkcd.com/538/>

I luv that comic :)

cheers.

--
x9p | PGP : 0x03B50AF5EA4C8D80 / 5135 92C1 AD36 5293 2BDF  DDCC 0DFA 74AE
1524 E7EE

[toc] | [prev] | [next] | [standalone]

#189846

[Multipart message — attachments visible in raw view] — view raw

The weakest link in most chains of Data protection is the person that
has access to it.

Always keep that in mind.


On 12/13/2017 12:34 PM, x9p wrote:
> On Wed, December 13, 2017 6:17 am, tomas@tuxteam.de wrote:
> ...
>> If they target *you* individually, yes, they have cheaper means at
>> their disposal. That's called "rubber hose cryptanalysis"[1] -- not
>> pretty. Or, as Schneier put it "the NSA is better at breaking knuckles
>> than at breaking codes".
>>
>> Still, for an attack of the Natanz type, they seem to have picked
>> the Stuxnet way, and you and me might end up as collaterals.
> so true.
>
>> [1] Or, as XKCD puts it, in a similarly charming way, "$5 wrench
>> cryptanalysis"
>>    <https://www.xkcd.com/538/>
> I luv that comic :)
>
> cheers.
>
> --
> x9p | PGP : 0x03B50AF5EA4C8D80 / 5135 92C1 AD36 5293 2BDF  DDCC 0DFA 74AE
> 1524 E7EE
>

[toc] | [prev] | [next] | [standalone]

#189855

> The weakest link in most chains of Data protection is the person that
> has access to it.

And rather than breaking knuckles, sometimes it's more ...elegant.. to
just fool/seduce the target,


        Stefan

[toc] | [prev] | [next] | [standalone]

#189861

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Dec 13, 2017 at 11:41:08AM -0500, Stefan Monnier wrote:
> > The weakest link in most chains of Data protection is the person that
> > has access to it.
> 
> And rather than breaking knuckles, sometimes it's more ...elegant.. to
> just fool/seduce the target,

For small targets as we are, intimidating works best.

Cheers, nevertheless :)
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAloxZbkACgkQBcgs9XrR2kY+YwCfSplAn4hUVKkvd1r7bnywEcop
3vMAnRkfmpxUSerkWRdcHjX3nJARfsVq
=mAFP
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#189875

On Wed, December 13, 2017 2:41 pm, Stefan Monnier wrote:
>> The weakest link in most chains of Data protection is the person that
>> has access to it.
>
> And rather than breaking knuckles, sometimes it's more ...elegant.. to
> just fool/seduce the target,
>
>
>         Stefan

We know. Poor Assange... but it was a beautiful job.

cheers.

--
x9p | PGP : 0x03B50AF5EA4C8D80 / 5135 92C1 AD36 5293 2BDF  DDCC 0DFA 74AE
1524 E7EE

[toc] | [prev] | [next] | [standalone]

#189854

tomas writes:
> Or, as Schneier put it "the NSA is better at breaking knuckles
> than at breaking codes".

Not NSA.  That would be trespassing on another agency's territory.
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web