Potential Reach of Windows Malware via Wine and Mono

Question

Scenario: I have a desktop Ubuntu 21.04 system with Wine and Mono installed. The only program I run on Wine is VisiPics, a Windows photo comparison tool. VisiPics needs read-write access to the external drive on which those photo files are stored, so as to delete unwanted duplicates.

My question is, to what extent do Wine and/or Mono pose security risks in that scenario?

Certain comments contribute to my confusion:

• Is it only a question of what software I deliberately use? Some consider Wine and Mono intrinsically risky, regardless of what software I run. It is reported that "malware can be delivered in many ways" and that WannaCry (for example) has a "worm aspect." So could malware find its own way to my Linux system from an infected file on the external drive, as soon as I make that drive available to the system?
• How great is the threat level, in practical terms? Some say that "your Linux computer is completely safe with WINE" unless you use it to run infected software. Others claim that malware will face so many complexities, in Wine, that it is unlikely to get far. Yet researchers warn that "Wine can pose serious security implications when used to run Windows software in a Linux environment."
• Is it likely that, if the user can access the external data drive with VisiPics, Windows malware running on Wine can too?
• Regardless of whether a generic Linux installation needs antivirus software, shouldn't Wine users install antivirus software? If so, would that be Linux antivirus software that can detect Windows malware, or Windows antivirus software running on Wine?

To repeat, my question is, to what extent do Wine and/or Mono pose security risks in the stated scenario?

Answer 1

Wine is basically a Win32 compatibility layer in Linux. By itself it's not risky to have it installed or run trusted Windows applications in it. Wine does not do anything by itself, it doesn't open ports, it has no persistent network services, nada, it's just there to run your Windows software. As long as this software is malware free, doesn't have vulnerabilities and comes from a respected company, there's no way you can be infected or hacked.

Applications running under Wine are proper Linux applications and can do anything that native Linux applications can do including accessing and modifying your files. In theory malware can install *.desktop files in your autostart (e.g. ~/.config/autostart) directory and have itself automatically run whenever you log in but such malware should have been coded with Wine/Linux in mind. So far, I've seen nothing like this. It makes very little sense for malware writers to target Wine considering the Linux desktop market share (below 2%).

Regardless of whether a generic Linux installation needs antivirus software, shouldn't Wine users install antivirus software? If so, would that be Linux antivirus software that can detect Windows malware, or Windows antivirus software running on Wine?

Again, if you have only trusted software it makes virtually no sense. Secondly, most if not all modern Windows AV solutions do not work under Wine because they require low-level kernel drivers and access to your system which Wine doesn't provide or support.

There are native desktop Linux AV solutions but in my +20 years of using Linux I've never thought about using them. I have at the very least 25 Windows applications installed in my Linux/Wine. Never had malware or anything.

If you're concerned about your safety, you could run Windows/Wine applications under a separate user account: https://wiki.archlinux.org/title/wine#Running_Wine_under_a_separate_user_account

Wine is not an operating system - you can think of it as a set of libraries to facilitate running of Windows applications.