Sebastian<p>I often find myself browsing certain Linux groups and communities on the web, and finding memes that "malware on Wine has no effect", which is extremely false.</p><p>The Wine team itself wrote in the FAQ that malware can have an effect and cause damage, especially that Wine is *not sandboxed*.</p><p><a href="https://gitlab.winehq.org/wine/wine/-/wikis/FAQ#is-wine-malware-compatible" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">gitlab.winehq.org/wine/wine/-/</span><span class="invisible">wikis/FAQ#is-wine-malware-compatible</span></a></p><p>Of course it depends on the nature of the malware, from something that can ruin a prefix to something that can make *native* syscalls, messing with your files and damage the system.</p><p>Now I imagine someone who could say "if I remove the Z: drive, which is the root, it should do no harm", well, it is a weak defense, as mentioned in the FAQ.</p><p>Let's make an example, the notorious ransomware WannaCry, it actually *encrypts* the data on /home/user/.</p><p>"oh my god, the malware escaped from Wine"</p><p>No, it's not "escaped", Wine launches apps *natively*, and started messing the files. (natively because Wine is not an emulator, hence the name "Wine Is Not an Emulator")</p><p>Or back in 2007, reported on the Wine mailing list, when a trojan masking as keygen for a Symbian app created problems (fortunately only to the prefix, but it could have been worse).<br><a href="https://web.archive.org/web/20080804091002/https://www.winehq.org/pipermail/wine-devel/2007-January/053719.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">web.archive.org/web/2008080409</span><span class="invisible">1002/https://www.winehq.org/pipermail/wine-devel/2007-January/053719.html</span></a></p><p>So, if you need to test or use Windows applications under Wine, I recommend using Wine under a sandbox/container (that's why I appreciate <span class="h-card" translate="no"><a href="https://mastodon.online/@usebottles" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>usebottles</span></a></span> which is under Flatpak).<br>If you want even more security, use a virtual machine with Windows.</p><p><a href="https://social.treehouse.systems/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> <a href="https://social.treehouse.systems/tags/foss" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>foss</span></a> <a href="https://social.treehouse.systems/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://social.treehouse.systems/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://social.treehouse.systems/tags/winehq" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>winehq</span></a> <a href="https://social.treehouse.systems/tags/wine" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>wine</span></a> <a href="https://social.treehouse.systems/tags/sandbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sandbox</span></a> <a href="https://social.treehouse.systems/tags/flatpak" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>flatpak</span></a> <a href="https://social.treehouse.systems/tags/windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>windows</span></a> <a href="https://social.treehouse.systems/tags/software" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>software</span></a></p>