Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
1–10 of 44 posts
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#2Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#3Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
Yes, and I believe enabling it requires administrative rights so the risk to a lot of organizations with locked down Windows installs is minimal unless they’ve enabled WSL intentionally
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#4Interesting, though it doesn't explain how it's invoking WSL. As far as I know, you would need a second part of the payload that invokes WSL and runs the ELF binaries.
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#5Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
The install process for WSL is still fairly complex for mainline Windows builds. However, in the preview channel, it's mostly just "wsl.exe --install". And that wsl.exe ships with the preview builds. I can see this being a bigger target once that feature is pushed down to the mainline windows builds. It does still require admin rights.
See: https://docs.microsoft.com/en-us/windows/wsl/install-win10
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#6Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
It's not something a consumer will do by accident, and IIRC the last time I set up Enterprise on my work machines I also had to activate itanually.
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#7Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#8Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
Yes, and I believe enabling it requires administrative rights so the risk to a lot of organizations with locked down Windows installs is minimal unless they’ve enabled WSL intentionally
Pretty much all government contractors use windows for bureaucratic and spying purposes. Good luck convincing your security-minded boss to let you have a linux playground when it increases attack surface area.
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#9Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
Yes, and I believe enabling it requires administrative rights so the risk to a lot of organizations with locked down Windows installs is minimal unless they’ve enabled WSL intentionally
I got WSL setup in my computer without the admin rights.
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#10"WSL is a supplemental feature that runs a Linux image in a near-native environment on Windows, allowing for functionality like command line tools from Linux without the over-head of a virtual machine."
But since WSL 2 it does use a VM. According to wikipedia:
"a real Linux kernel,[4] through a subset of Hyper-V features." "with a Linux kernel running in a lightweight virtual machine environment."
edit: unless they mean user overhead of getting it to work. I kind of read it as performance overhead.