Dualbooting Windows and Ubuntu, can I get Windows viruses/malware while running Ubuntu?

If you had two viruses in play, one that infected Linux with a payload to infect Windows, then it could conceptually happen. However, a native Windows virus cannot run in Linux at all. The reason why nothing would happen has to do with something known as the "Application Binary Interface", or "ABI" for short.

In Windows, most system calls are performed through something called "INT 20h", while in Linux, system calls are performed through "INT 80h". This means that a Windows-based virus that tries to call the system through 20h would simply terminate without causing any harm, as INT 20h is a "DOS-compatible terminate program" command.

In reality, most virus writers are going to go through the path of least resistance: write a Linux virus to infect the currently running Linux system, and write a Windows virus to infect the currently running Windows system. It would take a significant amount of extra effort just to write a virus whose only purpose was to infect an offline OS.

As far as I know, it would be far easier to simply write a hypervisor virus that runs "underneath" the OS, as then the ABI would have no meaning, since they'd have direct access to the hardware and memory.

On the other hand, if you download a virus intentionally, for example, you were trying to get a copy of a game from a questionable resource, and you did this in Linux, but downloaded the file to your Windows partition, and you later ran the program in Windows, then you could indeed get infected at that point. The main point, however, is that Linux is impervious to Windows viruses, and Windows is impervious to Linux viruses. They simply do not speak the same language.


In many Ubuntu dual-boot setups it is possible to run code as an unprivileged user which has the ability to write to the Windows partition. Because, if you can do it with the file manager without getting asked for a system password a malware could mount the windows partition too with the same kind of helper. And if the malware setups a file into the Autostart folder of the Windows user it gets executed on the next boot of Windows. Or it could simply read the Windows files and send them to the attacker.

If this way is not possible the malware might try to use a privilege escalation bug to get either root or even kernel permissions. From there it could mount and write to the Windows partition or even setup a BIOS/UEFI malware.

And sometimes not even privilege escalation is needed because you are doing some seemingly innocent software installation as root, like trying to install some python package and making a typo.

Of course the original malware would have to be designed with this dual-boot setup in mind. Chances are low that you encounter a malware running in Ubuntu at all (apart from malware targeting web servers), chances are even lower that this is designed to infect the Windows partition in a dual-boot setup. But it is possible and probably not even hard to implement. And especially if you are an interesting target and the attacker knows about your setup then he might try this attack path.

One way to protect you against this is by encrypting your Windows partition so that it is impossible to access the files from outside the Windows OS. This does not protect against attacks on the BIOS/UEFI level though.


Yes, it is possible for a malware to infect the Windows partition while your are using Linux - source: it happened to me.

This was many years ago when I was starting with Linux. The dualboot system was currently running under Linux, and I wanted to exchange files between two computers using Samba. Since there were some problems with it, I removed all security protections and limitations in Samba one by one until it finally worked (or maybe it didn't even work, I don't remember).

Upon booting back into Windows some time later I was greeted by several alarms by the personal firewall asking if programs xyz and foo are allowed to connect to the internet. Those turned out to be malware executables located in c:\windows\system or the like.

Turns out with my Samba fiddling under Linux I had actually shared the entire Windows C:\ drive with write permissions and without any authentication or address limitation; and also apparently I didn't have any firewall activated in Linux (or maybe I had disabled that as well). Since this was in the days before SOHO router were commonplace, the computer was directly connected to the internet via DSL modem. So some malware had found my writable Samba share (probably by brute-force scanning of IP ranges), had copied itself into the Windows system directory, and had also added necessary entries to autostart files it had found there. Naturally the infection had stayed dormant while Linux was running, but became active next time I booted Windows.

So granted, this was a massive heap of f***ups on my part; but it shows that if you are sufficiently careless under Linux you might even infect your Windows system.

Tags:

Virus

Malware