Earlier quoted context omitted.
Yes, and I believe enabling it requires administrative rights so the risk to a lot of organizations with locked down Windows installs is minimal unless they’ve enabled WSL intentionally
I got WSL setup in my computer without the admin rights.
Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
11–20 of 44 posts
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#12Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#13Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#14How about this. May be this is a bad idea too. Can we have like WSL3, where highly optimised Linux kernel runs on hypervisor. And Ubuntu/arch share the kernel using containerised approach. And individual apps too can run using the same workflow? That way we have benefits wrt overhead. Something like electron but they all use the same ringtone instead of a new instance. Again it may be a bad idea, just curious of the…
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#15Interesting, though it doesn't explain how it's invoking WSL. As far as I know, you would need a second part of the payload that invokes WSL and runs the ELF binaries.
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#16Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#17"WSL is a supplemental feature that runs a Linux image in a near-native environment on Windows, allowing for functionality like command line tools from Linux without the over-head of a virtual machine." But since WSL 2 it does use a VM. According to wikipedia: "a real Linux kernel,[4] through a subset of Hyper-V features." "with a Linux kernel running in a lightweight virtual machine environment." edit: unless they m…
Plus WLS 1 is marginally easier to install because you don't have to enable Hyper-V
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#18How about this. May be this is a bad idea too. Can we have like WSL3, where highly optimised Linux kernel runs on hypervisor. And Ubuntu/arch share the kernel using containerised approach. And individual apps too can run using the same workflow? That way we have benefits wrt overhead. Something like electron but they all use the same ringtone instead of a new instance. Again it may be a bad idea, just curious of the…
https://docs.docker.com/desktop/windows/wsl/
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#19Earlier quoted context omitted.
Yes, and I believe enabling it requires administrative rights so the risk to a lot of organizations with locked down Windows installs is minimal unless they’ve enabled WSL intentionally
I got WSL setup in my computer without the admin rights.
If you actually don't have admin rights, was this WSL1?
Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
#20Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).
Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them
What?
Isn't that the biggest selling point of MacOS on HN/Reddit?