SoylentNews is people
SoylentNews
from the Linux-security-Microsoft-style dept.
Yes, of course there's now malware for Windows Subsystem for Linux
In 2017, more than a year after the introduction of WSL, Check Point researchers proposed a proof-of-concept attack called Bashware that used WSL to run malicious ELF and EXE payloads. Because WSL wasn't enabled by default and Windows 10 didn't ship with any preinstalled Linux distro, Bashware wasn't considered a particularly realistic threat at the time.
Four years later, WSL-based malware has arrived. The files function as loaders for a payload that's either embedded – possibly created using open-source tools like MSFVenom or Meterpreter – or fetched from a remote command-and-control server and is then inserted into a running process via Windows API calls.
"Threat actors always look for new attack surfaces," said Mike Benjamin, Lumen vice president of product security and head of Black Lotus Labs, in a statement. "While the use of WSL is generally limited to power users, those users often have escalated privileges in an organization. This creates blind spots as the industry continues to remove barriers between operating systems."
If there's a bright side to this anticipated development, it's that this initial WSL attack isn't particularly sophisticated, according to Black Lotus Labs. Nonetheless, the samples had a detection rate of one or zero in VirusTotal, indicating that the malicious ELFs would have been missed by most antivirus systems.
(Score: 2) by Runaway1956 on Monday September 20 2021, @10:59AM (6 children)
Yeah, well, did you notice that I cut a hole in the hood (bonnet) and installed a custom air scoop?
Abortion is the number one killed of children in the United States.
(Score: 0) by Anonymous Coward on Monday September 20 2021, @04:47PM (5 children)
How do you get the Lada moving fast enough for that hood scoop to work? Downhill?
(Score: 0) by Anonymous Coward on Monday September 20 2021, @04:50PM
Push faster?
(Score: 2) by Dr Spin on Monday September 20 2021, @04:58PM (3 children)
The standard method is to fit a Cosworth engine to your Lada, but there are other engine suppliers
with engines that fit. (Jaguar V12 engines do not fit in a Lada Niva - I know - I tried!).
Warning: Opening your mouth may invalidate your brain!
(Score: 0) by Anonymous Coward on Monday September 20 2021, @06:45PM
Have you tried fitting a DFV?
(Score: 2) by Reziac on Tuesday September 21 2021, @02:27AM
Garage54 alert!!
And there is no Alkibiades to come back and save us from ourselves.
(Score: 2) by turgid on Thursday September 23 2021, @08:44PM
What about a Mazda triple rotor Wankel engine?
I refuse to engage in a battle of wits with an unarmed opponent [wikipedia.org].