Windows infected with backdoored Linux VMs in new phishing attacks

sram said:

backdoored​

Click to expand...
nice-south-park.gif
 
It's election time, and it's a contentious one, it likely wouldn't be too difficult to trick angry voters into rage clicking a link.
Social engineering at it's finest, this is why blocking zip attachments in email is a modern must.
 
pendragon1 said:
"The phishing emails pretend to be a "OneAmerica survey" that includes a large 285MB ZIP archive to install a Linux VM with a pre-installed backdoor."

lol if you fall for that, you deserve it.
Click to expand...
I thought it is a website promoting some specific purpose linux distribution which can appear in a google search. That's how it came to my mind. I wouldn't suspect a linux distribution to be pre-programmed with malware. But it won't be called phishing that way. I didn't read the full article anyways.

Do you know metasploitable? If you install it to play with, you should take certain precautions to avoid attracting attackers.
 
pendragon1 said:
yet you posted it?!
no idea what that last part is....
Click to expand...
Yeah man, I'm becoming too lazy to read entire articles, yet it grabbed my attention. A VM injected with malware!

Metasploitable is a vulnerable VM built for penetration testing training or something like that. It has so many vulnerabilities so that pen testers can practice their skills.
 
How does that even work?

Don't tell me Windows by default has a 1-click VM install (when you have no VMs or Hypervisor yet).
 
uOpt said:
How does that even work?

Don't tell me Windows by default has a 1-click VM install (when you have no VMs or Hypervisor yet).
Click to expand...
no idea, but its all built in.
not as far as i know.
 
pendragon1 said:
no idea, but its all built in.
not as far as i know.
Click to expand...
https://github.com/yuk7/ArchWSL
https://wsldl-pg.github.io/ArchW-docs/How-to-Setup/

You can contain the entire ArchWSL inside a zip file then you just need to kick the process off by triggering the exe file within.
There are plenty of ways to automatically silently execute an exe file within a zip file just by double clicking the zip file so yeah.

If you really strip down that ArchWSL image you can get it under 20MB, which gets it inside the limits placed on attachment sizes for just about everybody.
 
Last edited:
uOpt said:
WSL is not a virtual machine, though.
Click to expand...
But it is,
https://learn.microsoft.com/en-us/windows/wsl/compare-versions
WSL 2 is the current default version when installing a Linux distribution and uses the latest and greatest in virtualization technology to run a Linux kernel inside of a lightweight utility virtual machine (VM). WSL2 runs Linux distributions as isolated containers inside the managed VM.

While WSL 2 does use a VM, it is managed and run behind the scenes, leaving you with the same user experience as WSL 1.

WSL1 wasn't a VM in the traditional sense and tried doing some fun emulation tasks but it was painful with limited support, they ditched that and WSL2 does run a kernel inside a VM container.
 
Lakados said:
But it is,
https://learn.microsoft.com/en-us/windows/wsl/compare-versions
WSL 2 is the current default version when installing a Linux distribution and uses the latest and greatest in virtualization technology to run a Linux kernel inside of a lightweight utility virtual machine (VM). WSL2 runs Linux distributions as isolated containers inside the managed VM.

While WSL 2 does use a VM, it is managed and run behind the scenes, leaving you with the same user experience as WSL 1.

WSL1 wasn't a VM in the traditional sense and tried doing some fun emulation tasks but it was painful with limited support, they ditched that and WSL2 does run a kernel inside a VM container.
Click to expand...

OK, it runs its own kernel. That is a criteria that makes it a VM.

But there is no system management, no resource management, network shares are missing, no raw devices or other disk management. That is counter to what I expect from a VM. It is not an actual machine, not a complete computer, that you find inside.
 
Lakados said:
WSL1 wasn't a VM in the traditional sense and tried doing some fun emulation tasks but it was painful with limited support
Click to expand...
In spite of that, it ran well enough you could run a Windows X server--I used to use Exceed--and have X apps on your Windows desktop.
 
1_rick said:
In spite of that, it ran well enough you could run a Windows X server--I used to use Exceed--and have X apps on your Windows desktop.
Click to expand...
Yeah it worked well enough, but WSL2 can work damned well.
 
uOpt said:
OK, it runs its own kernel. That is a criteria that makes it a VM.

But there is no system management, no resource management, network shares are missing, no raw devices or other disk management. That is counter to what I expect from a VM. It is not an actual machine, not a complete computer, that you find inside.
Click to expand...
Yeah there isn't a UI for you to directly control it but these are all things that can be managed in the .wslconfig file
add the tag networkingMode=mirrored and then go to powershell and run wsl --shutdown will bring it back up on its next start with a DHCP address, then getifaddrs will list you the virtual NIC interfaces now accessable to the VM and you can make the needed IP address configuration settings from there.

If you want to then make the VM's drives accessible, you just need to run your standard mount commands for your linux distro of choice.
once that is done install cifs-utils inside your VM to enable SMB and that should leave you with access to the drives directly in Windows.
 
  • Like
Reactions: uOpt
like this
1_rick said:
In spite of that, it ran well enough you could run a Windows X server--I used to use Exceed--and have X apps on your Windows desktop.
Click to expand...

I never understood the use case for this. Why wouldn't one want the more stable and secure OS as the host? Run Linux instead and put Windows in a VM if you need it :p
 
Zarathustra[H] said:
I never understood the use case for this. Why wouldn't one want the more stable and secure OS as the host? Run Linux instead and put Windows in a VM if you need it :p
Click to expand...
I mean you can install Windows 11 within LXD, that's sort of the same thing?
 
Lakados said:
I mean you can install Windows 11 within LXD, that's sort of the same thing?
Click to expand...

You can?

I've used LXC extensively over the years. I have several server containers running in it right now.

My understanding is LXD is just a frontend for LXC, and LXC requires the guest inside the container to share the kernel with the Host, meaning both have to be Linux?
 
Zarathustra[H] said:
I never understood the use case for this. Why wouldn't one want the more stable and secure OS as the host? Run Linux instead and put Windows in a VM if you need it :p
Click to expand...
From what I understand is that they use the Linux VM to hide it's activities from Windows anti-malware tools. Especially QEMU because it's digitally signed. Windows should always be in a VM, but that's not going to be easily done remotely with a 285MB file.
 
DukenukemX said:
From what I understand is that they use the Linux VM to hide it's activities from Windows anti-malware tools. Especially QEMU because it's digitally signed. Windows should always be in a VM, but that's not going to be easily done remotely with a 285MB file.
Click to expand...

Well, yeah, I understand why the attacker would do so in this instance. I just don't understand the use purposeful case for the system owner :p It just doesn't make sense to me.
 
Zarathustra[H] said:
1.) How does that even work, seeing that LXC depends on the linux kernel?

2.) Why would one do this instead of just running a real VM using KVM?

3.) Eww. Snaps. Someone needs to murder snaps.
Click to expand...
I don't recall saying anything about it making sense or it being clean, I simply said you could...
 
Lakados said:
I don't recall saying anything about it making sense or it being clean, I simply said you could...
Click to expand...

Ah, my bad.

I still am curious how they make it work though, considering the founding principle of an LXC container is that it is lightweight because it shares the kernel with the host.

Is LXD somehow on the sly, setting up a KVM instance inside of a secondary Linux install inside of LXC? That would be a serious case of Russian dolls...
 
Zarathustra[H] said:
Ah, my bad.

I still am curious how they make it work though, considering the founding principle of an LXC container is that it is lightweight because it shares the kernel with the host.

Is LXD somehow on the sly, setting up a KVM instance inside of a secondary Linux install inside of LXC? That would be a serious case of Russian dolls...
Click to expand...
The LXD documentation has this to say on the topic.

LXD includes another important feature: native support for virtual machines, which was added in version 4.0. A LXD VM emulates the physical host machine, while providing an environment with a completely isolated OS. In contrast, system containers share the host kernel instead of creating their own environments. This makes the containers faster and more lightweight than VMs, but they don't provide the same level of isolation
 
Zarathustra[H] said:
1.) How does that even work, seeing that LXC depends on the linux kernel?

2.) Why would one do this instead of just running a real VM using KVM?

3.) Eww. Snaps. Someone needs to murder snaps.
Click to expand...
LXC is a container. So, much lighter weight than a full OS in full VM. So, while you can run older/newer/different flavors of Linux distros, yes, the kernel is shared.

Yet another possibility, that is incredibly useful, is to just use qemu and run Type 2 VMs in Linux. Why? Access to needed old virtual hardware emulation (to run very old things). So, while not as efficient as Type 1 or containers, the flexibility make make it possible to run something that can't be run some other way.

Type 2 gets a bad rap because people only see Windows as the base host, but things in Linux are pretty fast context switching wise. There was a time when full process context switching in Linux was faster than threads in Windows. So, depending on application, you might find type 2 using qemu to be the "right choice" (depends).


No comment on snaps.
 
Zarathustra[H] said:
I never understood the use case for this. Why wouldn't one want the more stable and secure OS as the host? Run Linux instead and put Windows in a VM if you need it :p
Click to expand...
Well, let's say your day job mostly, but not exclusively, uses Windows-specific tools. You'd want your primary environment to be the one you're going to be in the most.
 
Lakados said:
The LXD documentation has this to say on the topic.

LXD includes another important feature: native support for virtual machines, which was added in version 4.0. A LXD VM emulates the physical host machine, while providing an environment with a completely isolated OS. In contrast, system containers share the host kernel instead of creating their own environments. This makes the containers faster and more lightweight than VMs, but they don't provide the same level of isolation
Click to expand...

Ah, so it is no longer actually just an LXC front end. That explains it. Thanks. So Windows inside LXD is not containerized, it is a proper VM.
 
You must log in or register to reply here.
Back
Top