Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders • Hacker News Board

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#41

Post by tyingq » Fri, Sep 17, 2021, 8:49 PM UTC

shawnz wrote: post #40

tyingq wrote: post #36

Earlier quoted context omitted.

This github issue in interesting: https://github.com/microsoft/WSL/issues/2886 It sort of hints that you could coax LxssManager.dll into running an elf binary without WSL itself really running. Though you would need to do some things to make lxss happy, so it's not trivial.

But there's no advantage to starting with a Windows binary and executing a Linux binary just to have it execute a Windows binary again. You may as well just start with the final payload if you are already able to run code in Windows, there's no point invoking WSL in that scenario at all. I am pretty sure the attack scenario imagined here is regarding Linux binaries executed in WSL by the user or other software inside…

No, but assuming a windows binary executing a Linux binary is somehow bypassing (some) heuristics, etc...

That might be an advantage. You have full access to windows files, etc, from WSL.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#42

Post by selfhoster11 » Fri, Sep 17, 2021, 10:45 PM UTC

geek_at wrote: post #7

pkilgore wrote: post #2

Is WSL still opt-in? Something to be aware of for power users, but most Windows users are never going to know about or figure out how to turn on WSL (at least as of the last time I tried it).

Most Windows users are also never going to know how to get Microsoft Office on their Computer when it doesn't come preinstalled. Usually people have other people who do things like this for them

Really? I think they will just Google "buy Microsoft office" and follow the instructions on the first link that pops up. Or buy it from the Windows store app.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#43

Post by cookiengineer » Sun, Sep 19, 2021, 7:49 AM UTC

_0ffh wrote: post #33

cookiengineer wrote: post #27

Earlier quoted context omitted.

> But since WSL 2 it does use a VM. As a related sidenote: Try doing an apt install metasploit inside a "VM" while an antivirus is running on the host. You'll soon realize that the "VM" will be bricked by quarantine actions on the NTFS based filesystem, which kind of defeats the reason of the V in VM. I fear once more people realize this, there'll be NTFS stream based "hidden" malware and other filesystem rights abus…

Wouldn't simply activating file-level encryption in the Linux subsystem be enough to throw off Windows-based AV scanners?

I didn't test whether or not LUKS or similar filesystem level encryptions are transparently mapped to the Windows kernel.

Might be a good way to avoid this behavior. The default (from the Windows Store) Ubuntu based VM however doesn't use filesystem level encryption, and every folder or file inside the "VM" is available somewhere buried in the Roaming folders.

Re: Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders

#44

Post by _0ffh » Sun, Sep 19, 2021, 2:49 PM UTC

cookiengineer wrote: post #43

_0ffh wrote: post #33

Earlier quoted context omitted.

Wouldn't simply activating file-level encryption in the Linux subsystem be enough to throw off Windows-based AV scanners?

I didn't test whether or not LUKS or similar filesystem level encryptions are transparently mapped to the Windows kernel. Might be a good way to avoid this behavior. The default (from the Windows Store) Ubuntu based VM however doesn't use filesystem level encryption, and every folder or file inside the "VM" is available somewhere buried in the Roaming folders.

Yeah, you'd have to install LUKS or eCryptfs or something, but I think it would be worth a try. I expect Windows would only see the encrypted files then.