Live data from Hacker News

Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

blog.lumen.com

11–20 of 44 posts

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#11
post #9

Earlier quoted context omitted.

Yes, and I believe enabling it requires administrative rights so the risk to a lot of organizations with locked down Windows installs is minimal unless they’ve enabled WSL intentionally

I got WSL setup in my computer without the admin rights.

That's interesting. The mainline builds seem to require running dism.exe with admin rights, and the preview builds require running "wsl.exe --install" with admin rights. Curious how you got around that.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#12
How about this. May be this is a bad idea too. Can we have like WSL3, where highly optimised Linux kernel runs on hypervisor. And Ubuntu/arch share the kernel using containerised approach. And individual apps too can run using the same workflow? That way we have benefits wrt overhead. Something like electron but they all use the same ringtone instead of a new instance. Again it may be a bad idea, just curious of the benefits.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#13
post #7
post #2

Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).

Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them

This comment made me sad, a little. 15 years ago practically everyone would know how to do this: download the installer from Microsoft and run it.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#14

How about this. May be this is a bad idea too. Can we have like WSL3, where highly optimised Linux kernel runs on hypervisor. And Ubuntu/arch share the kernel using containerised approach. And individual apps too can run using the same workflow? That way we have benefits wrt overhead. Something like electron but they all use the same ringtone instead of a new instance. Again it may be a bad idea, just curious of the…

https://docs.docker.com/desktop/windows/wsl/

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#15
post #4

Interesting, though it doesn't explain how it's invoking WSL. As far as I know, you would need a second part of the payload that invokes WSL and runs the ELF binaries.

I think the idea is that the user would run these malicious binaries in WSL themselves, thinking it's a safe environment for testing. But actually, anything run in WSL will have the same privileges as the user who started the session, due to the interop features (even if it's not running as root in WSL).

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#16
post #7
post #2

Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).

Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them

What a condescending comment

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#17

"WSL is a supplemental feature that runs a Linux image in a near-native environment on Windows, allowing for functionality like command line tools from Linux without the over-head of a virtual machine." But since WSL 2 it does use a VM. According to wikipedia: "a real Linux kernel,[4] through a subset of Hyper-V features." "with a Linux kernel running in a lightweight virtual machine environment." edit: unless they m…

When installing WSL you can still choose if you want to use WLS 1 or WSL 2, and you can switch between them. If you keep your files not in the WSL filesystem, WSL 1 is still the recommended choice because of the lower overhead for file access.

Plus WLS 1 is marginally easier to install because you don't have to enable Hyper-V

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#18

How about this. May be this is a bad idea too. Can we have like WSL3, where highly optimised Linux kernel runs on hypervisor. And Ubuntu/arch share the kernel using containerised approach. And individual apps too can run using the same workflow? That way we have benefits wrt overhead. Something like electron but they all use the same ringtone instead of a new instance. Again it may be a bad idea, just curious of the…

https://docs.docker.com/desktop/windows/wsl/

Oh, I thought each instance of the os has its own VM upto now. Still, I wish it would be more native experience rather than depending on docket desktop, if it makes sense.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#19
post #9

Earlier quoted context omitted.

Yes, and I believe enabling it requires administrative rights so the risk to a lot of organizations with locked down Windows installs is minimal unless they’ve enabled WSL intentionally

I got WSL setup in my computer without the admin rights.

Sure you didn't just get it without UAC?

If you actually don't have admin rights, was this WSL1?

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#20
post #7
post #2

Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).

Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them

> Most...users are also never going to know how to get...on their Computer when it doesn't come preinstalled.

What?

Isn't that the biggest selling point of MacOS on HN/Reddit?

Post reply on HN