Cross-Platform Sample Virus Targets Windows, Linux

Virus researchers at Kaspersky Lab find proof-of-concept code for a virus capable of infecting both Windows and Linux systems.

Virus researchers at Kaspersky Lab have found proof-of-concept code for a cross-platform virus capable of infecting both Windows and Linux systems.

In an alert posted to Viruslist, Kaspersky said the sample virus has been given a dual name—Virus.Linux.Bi.a/ Virus.Win32.Bi.a—and highlighted the way attackers are targeting multiple platforms in malware attacks.

"The virus doesnt have any practical application," the company said in the alert. "Its classic proof-of-concept code, written to show that it is possible to create a cross-platform virus."

Could Windows malware infect Mac hardware? Click here to read more.

However, according to Shane Coursen, senior technical consultant at Kaspersky Lab, in Woburn, Mass., its normal to see proof-of-concept code modified and used in actual copycat attacks.

"This is the kind of attack well be seeing in the future," Coursen said in an interview with eWEEK. "We know it can be done and there are obvious reasons why malware writers would want to target multiple operating systems with a single piece of malware."

"Well start seeing viruses attacking Windows with the ability to infect Linux and Mac machines. Its not a stretch to imaging a single virus going across all three platforms and even further," Coursen said.

Resource Library:

According to Kasperskys analysis, the cross-platform virus sample is written in assembler and only infects files in the current directory. "However, it is interesting in that it is capable of infecting the different file formats used by Linux and Windows—ELF and PE format files respectively," the alert said.

The virus uses the Kernel32.dll function to infect systems running Win32. It injects its code into the final section and gains control by again changing the entry point, Kaspersky said.

The warning from Kaspersky caught the attention of incident handlers at the SANS ISC (Internet Storm Center), a group of volunteers that tracks malicious activity on the Web.

Ziff Davis Media eSeminars invite: Is your enterprise network truly secure? Join us April 11 at 4 p.m. ET as Akonix demonstrates best practices for neutralizing threats and securing your network.

ISC volunteer Swa Frantzen said the impact of the proof-of-concept code "is very low in itself" but is a sign that the cross-platform aspects of malware are becoming important.

"Even today, Web sites sending exploits to their visitors tend to detect what browser or platform the visitor is using and send a matching exploit to install some malware and earn their quarter for each confirmed installation," Frantzen said.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

Reader Comments: Cross-Platform Sample Virus Targets Windows, Linux >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By Ryan Naraine