Can viruses be transfered across incompatible architectures?

Question

I am needing to run scans from one computer/laptop/device to another computer in a protected system. I am worried that plugging in my scanning computer to the protected computer might cause some risk in that a virus may be transferred.

To reduce the risk I wish to use incompatible architectures, specifically I wish to use an ARM based computer to scan the x64. If both computers use the same type of operating system Windows RT/Windows 7 or a Debian Arm Port with an standard Debian 64-bit have I reduced my chances of transferring a virus in any significant way?

Answer 1

It might, different architectures may stop binaries compiled for one architecture being executed on another. On the other hand, if the virus does not depend heavily on the host architecture (eg. it uses interpreted code such as shell scripts) or is designed to work across multiple architectures then it may not help.

A better approach might be to use an ephemeral OS, such as a live CD which can be discarded afterwards, or mount your root device as read only.

Answer 2

It is theoretically possible to write multi-architecture binary malware. In practice, it's very difficult, belonging to the realm of proofs of concept rather than actual malware in the wild.

Script-based malware is a very different story. A well-written shell script, for example, could infect any Unix-like operating system; a Microsoft Office macro virus can infect vulnerable versions of Office on any platform.

If you're only worried about binary malware (eg. typical Windows malware), mixing architectures is sufficient. If script-based malware is a concern, you should mix operating systems as well (eg. ClamAV on a Debian ARM system to scan for Windows malware).

Answer 3

A binary virus that targets more than one hardware architecture is more of a theoretical threat than a realistic one.

However, several viruses that target one hardware architecture but that run on multiple operating systems exist. Another example is the Peelf / Winux / Lindose Virus, which exists as a proof-of-concept.