24

Can wine as a whole or the windows applications installed via wine pose some kind of risk to an Ubuntu installation? This question arose in my mind when I read this answer to my earlier question Accessing IE only sites:

Try installing PlayonLinux from playonlinux.org and install IE via PlayonLinux. and use IE only for those pesky sites :) - Received 1 downvote

And enjoying the risks of IE? No thanks - This comment received 2 upvotes

I believe this PlayOnLinux works as a frontend to wine making installing tasks easier.

In totality, I want to know if it is safe to install Internet connecting applications like IE via Wine? Is there any remote possibility of being subject to more online attacks and virus threats this route. I plan to use IE only for browsing websites not accessible with other browsers, like the one in earlier question.

Improve this question

5 Answers 5

Reset to default
13

Wine is just a compatibility layer, programs run in it have the same privileges as the logged in user.

From their FAQ:

7.5. How good is Wine at sandboxing Windows apps?

Wine does not sandbox in any way at all. When run under Wine, a Windows app can do anything your user can. Wine does not (and cannot) stop a Windows app directly making native syscalls, messing with your files, altering your startup scripts, or doing other nasty things.

Also read 7.4, especially:

  1. Never run executables from sites you don't trust. Infections have already happened.

Wine has to possibility to share your documents (or even your home directory or /) with the application. Even if programs are not malicious, it could still put junk on your system, like desktop.ini (controls the view of folders in Explorer).

Improve this answer
3
  • 1
    To this date, Wine FAQ has been updated. So the quoted link "Also read 10.1" now points to "11.1. Wine is malware-compatible" and the previously quoted entry "10.2. How good..." is now titled as "11.2. How good is Wine at sandboxing Windows apps?". The contents are more or less the same when compared to older FAQ snapshot on Wayback Machine.
    – user37165
    Oct 15, 2015 at 15:47
  • @clearkimura and they changed it again, now to 7.4 and 7.5.
    – muru
    Aug 18, 2017 at 6:54
  • But with winecfg one can remove the Z / drive (making drive_c the only path accessible to wine progs). In this case, is the Linux (all but drive_c/*) environment at risk?
    – Déjà vu
    Mar 11, 2019 at 1:44
3

Viruses that are run in wine will generally stay within the C drive which wine creates, however, they can still cause harm to your system through startup entries and other method used by malware. However, they generally will not affect specifically Linux portions of your computer. This does not mean that it is impossible. A virus can be made specifically for wine to infect unprotected Linux binaries or attempt to escalate privileges on your system.

Improve this answer
3

While looking for security implications running Wine I encountered following analysis. I believe, it will serve all users interested in this topic.

Analysis from 2018 (emphasis by me):

Malware family File system Registry Processes Network Services success Overall success
Narilam True True True N/A N/A True
Hikit False False False False False False
Stabuniq N/A N/A False False False False
Drixed False False False False False False
Batch Wiper False True False N/A N/A Partially
Dialer False False True N/A N/A False
MyDoom False False True False False False
Minamps True False True True False Partially
PlugX, Korplug False False True False N/A False
Wykcores True True True True True True
Didrex False False False False False False
Dozmot False N/A False N/A N/A False
Potao False N/A True N/A N/A False
Gamarue False True False False N/A Partially
TDL/Alureon False N/A False False N/A False
SC-KeyLog True True True True N/A True
Wirenet True N/A True True N/A True
CoreBot False False False False N/A False
Kawpfuni True False True N/A N/A Partially
Skypii False N/A False N/A N/A False
4DW4R3 True N/A True False N/A Partially
LokiBot False False False N/A N/A False
Nitol True True True True True True
Nivdort False False False False False False
Unknown1 False False True N/A N/A False
Unknown2 False False False N/A N/A False
Unknown3 False False False False N/A False
Unknown4 True False False False N/A Partially
Unknown5 False False False False False False

CONCLUSIONS

The research conducted in this study produced a series of results that can be used to develop an understanding of the behavior of Windows malware running in Linux via Wine. Results indicate that Windows malware is able to run successfully in a Linux environment through Wine. The success rates of Windows malware running in a Linux environment does appear to be relatively low. The fact that some samples of malware did run successfully illustrates that using the compatibility layer software Wine in a Linux environment does present a security risk to Linux systems, which would otherwise be secure against Windows malware. No relationships could be established between any types of malware or behavior of malware and the malware running successfully in the Linux environment; relationships between the services started in Windows and Network started in Windows independent variables may be investigated via future research and an increased sample size.

The findings suggest that samples which use particular API calls are less likely to run successfully. The OpenServiceA and OpenServiceW functions were never called in Zero Wine suggesting that using these calls can cause compatibility issues with Wine. Another possible reason for this could be that the services being opened are not available through Wine.

Source: https://link.springer.com/article/10.1007/s11416-018-0319-9

Improve this answer
2

Using Wine with Internet Explorer or other programs will only have potential malware reach your wine "drive", which is a folder structure inside of ~/.wine, as well as any other mapped folders.

And regarding viruses. The viruses may infect only those Windows' files, but Windows viruses do not run on Linux effectively - i.e. they won't infect your Linux system files unless its an actual Linux virus.

Improve this answer
3
  • 1
    / is a mapped folder (`Z:`), so this is quite misleading. And since Wine can run Windows services, being infected with some Windows malware really could be a serious concern.
    – Eliah Kagan
    Oct 28, 2012 at 15:30
  • True, although i thought sudo requirements for / still applied?
    – Thomas Ward -On Strike ♦
    Nov 1, 2012 at 13:10
  • The user running Wine certainly has access to some things contained within / but not within ~/.wine, such as all of ~. That could be a big problem! Besides that, Windows malware running as a limited user via Wine would have the same limitations of any program running as a limited user on an Ubuntu system. (Except there is a lot of Windows malware out there, and while this will almost certainly change in the future, right now there is very little malware written specifically to target Ubuntu and other GNU/Linux operating systems.)
    – Eliah Kagan
    Nov 3, 2012 at 13:55
0

Windows malware needs to be executed to work, so if you download a corrupted version of some Program that in turn downloads and executes some Malware, then nothing would happen. The reason being is that instead of executing some Malware into Windows, for the malware to work it would need to be initiated by WINE, and therefore by you. Installing WINE does not open your computer up to any "Windows malware" because you are directly in control of what exe's, batch, and com's WINE executes. The only theoretical danger is if you download a Linux program that downloads a windows virus, and then calls WINE to execute that virus, and then fixes everything to work out of the WINE sandbox.

In the long run, your Linux computer is completely safe with WINE. The only real danger is what you install,

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.