Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

blog.lumen.com

Post reply on HN
Print view View original

21–30 of 44 posts

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#21

Post by vetinari »

smichel17 wrote: post #13
geek_at wrote: post #7

Earlier quoted context omitted.

Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them

This comment made me sad, a little. 15 years ago practically everyone would know how to do this: download the installer from Microsoft and run it.

It was possible to download an installer from Microsoft 15 years ago (except MSDN)? For most people getting Office meant trip to the store and getting a box with physical CD.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#22

Post by banana_giraffe »

vetinari wrote: post #21
smichel17 wrote: post #13

Earlier quoted context omitted.

This comment made me sad, a little. 15 years ago practically everyone would know how to do this: download the installer from Microsoft and run it.

It was possible to download an installer from Microsoft 15 years ago (except MSDN)? For most people getting Office meant trip to the store and getting a box with physical CD.

It was:

https://web.archive.org/web/20060430185620/http://g.msn.com/...

A link to download an Office Trial, which at the time was just the full version of office which worked without a key for a trial period.

I seem to recall there was an online store for Office to purchase a key.

Though, I suspect you're right, most people probably bought a box back then. These days, I'd expect the average consumer to use the preloaded Office stubs on new PCs.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#23

Post by zamadatix »

anaganisk wrote: post #18
zamadatix wrote: post #14

Earlier quoted context omitted.

https://docs.docker.com/desktop/windows/wsl/

Oh, I thought each instance of the os has its own VM upto now. Still, I wish it would be more native experience rather than depending on docket desktop, if it makes sense.

If you install separate WSL2 images for each app it does. If you go the container route with Docker (or your container orchestrator of choice) naturally they'll be shared.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#24

Post by a-dub »

shawnz wrote: post #15
tyingq wrote: post #4

Interesting, though it doesn't explain how it's invoking WSL. As far as I know, you would need a second part of the payload that invokes WSL and runs the ELF binaries.

I think the idea is that the user would run these malicious binaries in WSL themselves, thinking it's a safe environment for testing. But actually, anything run in WSL will have the same privileges as the user who started the session, due to the interop features (even if it's not running as root in WSL).

from what i read, it just sounds like the issue is that windows virus scanners haven't been updated to check hashes for elf binaries. wsl added a new executable type to windows and the virus scanners haven't caught up, so now you can have these malicious elf binaries laying around that a user could run and the virus scanner will ignore them.

the nature of the ones they found sound simplistic. just python scripts in one of those self extract and run bundled python interpreter and included script single file executable archive things.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#25

Post by mPReDiToR »

haunter wrote: post #16
geek_at wrote: post #7

Earlier quoted context omitted.

Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them

What a condescending comment

True. Very condescending.

The fact remains, no matter the tone.

Most, not all Windows users CBA with "computers" and call _us_ to install software.

There's a reason shops charge a fortune for basic maintenance. People don't have the time/inclination to learn it.

This is my own opinion, based on my own experience. YMMV.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#26

Post by DoctorOW »

banana_giraffe wrote: post #22
vetinari wrote: post #21

Earlier quoted context omitted.

It was possible to download an installer from Microsoft 15 years ago (except MSDN)? For most people getting Office meant trip to the store and getting a box with physical CD.

It was: https://web.archive.org/web/20060430185620/http://g.msn.com/... A link to download an Office Trial, which at the time was just the full version of office which worked without a key for a trial period. I seem to recall there was an online store for Office to purchase a key. Though, I suspect you're right, most people probably bought a box back then. These days, I'd expect the average consumer to use the preloa…

This seems like a symptom of forgetting 2006 was 15 years ago. I did the math this time but if someone off hand mentions 20 years ago I still think of the 90s.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#27

Post by cookiengineer »

silverscania wrote: post #10

"WSL is a supplemental feature that runs a Linux image in a near-native environment on Windows, allowing for functionality like command line tools from Linux without the over-head of a virtual machine." But since WSL 2 it does use a VM. According to wikipedia: "a real Linux kernel,[4] through a subset of Hyper-V features." "with a Linux kernel running in a lightweight virtual machine environment." edit: unless they m…

> But since WSL 2 it does use a VM.

As a related sidenote: Try doing an apt install metasploit inside a "VM" while an antivirus is running on the host.

You'll soon realize that the "VM" will be bricked by quarantine actions on the NTFS based filesystem, which kind of defeats the reason of the V in VM.

I fear once more people realize this, there'll be NTFS stream based "hidden" malware and other filesystem rights abusing tools everywhere all over again.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#28

Post by deelowe »

wongarsu wrote: post #17
silverscania wrote: post #10

"WSL is a supplemental feature that runs a Linux image in a near-native environment on Windows, allowing for functionality like command line tools from Linux without the over-head of a virtual machine." But since WSL 2 it does use a VM. According to wikipedia: "a real Linux kernel,[4] through a subset of Hyper-V features." "with a Linux kernel running in a lightweight virtual machine environment." edit: unless they m…

When installing WSL you can still choose if you want to use WLS 1 or WSL 2, and you can switch between them. If you keep your files not in the WSL filesystem, WSL 1 is still the recommended choice because of the lower overhead for file access. Plus WLS 1 is marginally easier to install because you don't have to enable Hyper-V

I recently updated my visual studio code development environment and it depends on WSL 2 now. It seems to be that this is the direction MS is heading.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#29

Post by hanniabu »

smichel17 wrote: post #13
geek_at wrote: post #7

Earlier quoted context omitted.

Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them

This comment made me sad, a little. 15 years ago practically everyone would know how to do this: download the installer from Microsoft and run it.

In all fairness, things were a lot easier back then. Installers all had the same UI and you knew where to find them afterwards. Now the UI is different for all of them and you have no idea where the program went when it finished installing.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#30

Post by smichel17 »

vetinari wrote: post #21
smichel17 wrote: post #13

Earlier quoted context omitted.

This comment made me sad, a little. 15 years ago practically everyone would know how to do this: download the installer from Microsoft and run it.

It was possible to download an installer from Microsoft 15 years ago (except MSDN)? For most people getting Office meant trip to the store and getting a box with physical CD.

Ha, you're right, I might have overshot my time period a little. I was thinking Windows 7 era, plus some late Vista/XP. Wikipedia tells me Windows 7 was released in 2009, so my statement would probably hold better if I'd said "around 10 years ago". But on the whole I think it's close enough :)
Post reply on HN