Bad Taste Attack Brings Windows Malware to Linux (Theoretically)

Windows and Linux are getting along better than ever — so much so that attackers can now use Windows installation scripts to drop malware onto Linux computers, one researcher has found.

Earlier this month, Nils Dagsson Moskopp reported a vulnerability that he named Bad Taste. It works like this:

Exploit Limitations

This does not spell the end of the world as we know it for Linux users. There are several important caveats worth bearing in mind:

The real-world effects of this vulnerability are thus very minimal.

Bringing Windows Exploits to Linux

Still, the attack is interesting because it highlights how an interest in making Linux-based environments compatible with Windows software can create new types of vulnerabilities for Linux users.

Today, Linux and Windows blend together more seamlessly than ever. You can run applications like Microsoft SQL Server on Linux. You can run a Linux subsystem on Windows. This all happens with Microsoft's blessing.

This Linux-Windows integration makes it tempting to use tools like Wine (which, for the record, was created long before Microsoft became so Linux-friendly) to integrate Windows programs seamlessly into Linux-based systems as a convenience for the user.

This integration comes at a cost. Merging Windows and Linux environments creates new potential attack vectors and security complications, as the Bad Taste vulnerability shows.