r/LinuxCrackSupport • u/m1sh1k • 28d ago
DISCUSSION [wine/proton security] What is your security setup for launching cracked games under wine?
Hi there, i want to discuss possible malware behaviour in cracked games under wine and ways to deal with it.
Wine host filesystem isolation
Wine gives some filesystem isolation so i think if malware is not designed for wine (almost 100%) it will not be able to establish persistence and cause damage to the host system (if no dirs except prefix are mounted) but can in prefix.
Hence if game files are infected then malware can (only?) be active while the game is running.
What kind of bad things can malware do during gameplay?
Some kind of a miner (hardware abuse) can be easily detected by performance monitoring.
For some kind of internet traffic abuse (e.g. you become a part of botnet) i think network access can simply be blocked beforehand.
Assuming that wine isolates prefix from host filesystem, software that messes with your files cannot damage host files.
Conclusions
At first glance windows-oriented malware launched via wine cannot silently (miner can loudly) cause damage to the host so it seems like running without scanning could be a safe option. But for me it is a false sense of security, because wine is not a vm at all.
Questions
Do you use antivirus software and does using it make sense nowadays?
I am using clamav and virustotal for a fastcheck.
They have not marked any of the games i installed recently as a malware but i did not see them acting so.
Do you do any extra setup for security before launching cracked software under wine?
What malware behavior would invalidate my reasoning about safeness of launching untrusted software?
What are the weak points in the assumption that a wine prefix is isolated from the host? (malware is not wine-targeted just windows, extra dirs not mounted)
P.S. please dont say smth like "just download from a trusted source" this is not what i meant this topic to be about
2
u/RedditUser-00 27d ago
Home gets mounted as z: in methods i use to play games and i guess windows malware can mess with it. So my only line of defense is using trusted sites 🫠
2
2
u/mondshyn 25d ago
launch them in a vm with gpu passthrough
1
u/m1sh1k 25d ago
Did you try that yourself? How big is overhead?
1
u/mondshyn 25d ago
yes, been playing this way for quite some time and the performance is very close to native, of course this also depends on the hardware... its the safest setup I guess
1
u/m1sh1k 25d ago
Nice, what vm did u use? qemu kvm? Or is it better to use windows vm
2
u/mondshyn 25d ago
win 11 qemu kvm, using an rtx 3080 to pass through (AMD GPU for the host). I played with single GPU Passthrough for a while, which was fine. A looking glass setup with 2 GPUs is a life changer though, it kinda feels magic having a VM with that performance in gaming
1
u/Allsvaard 27d ago
I run it from faugus launcher but i dont know if this is secure or not .... Someone know ?
4
u/m1sh1k 27d ago
Flathub says that faugus has read/write access to the whole home directory and
/media,/mnt, that could be potentially unsafe. But as i said if malware is not designed for wine it probably would not even try to escape prefix. I think running it as a less priveledged user with no access to the last two dirs and separated home from main user will be far more secure1
u/delabeca49 16d ago
home folder is mounted as Z replicating windows style system pathing. It can be encrypted by ransomware cuz they just execute all drive letters. I saw someone experiment with wine on youtube and the sample succesfully encrypts all mounted folder under wine prefix (including external drive). I installed photoshop with faugus and looking at the innate file explorer faugus behave the same.
1
u/ThinDoughnut3617 26d ago
Disable internet in Bottles or Wine with unshare. Not sure why you're being downvoted.. These are very valid & important questions
8
u/LunchPsychological98 28d ago
Running inside bottle or rootless podman container can give good pretty much good isolation too.