Slashdot Mirror
Linux on Windows Exposes a New Attack Surface (eweek.com)
An anonymous Slashdot reader writes:
The Linux in Windows 10 isn't running inside of a hypervisor; it's "running on the raw hardware, getting all the benefits of performance and system access, as well as expanding the potential attack surface." eWeek reports on a new threat discovered by Alex Ionescu, the chief architect at cybersecurity company Crowdstrike, which begins with the fact that "The Windows file system is also mapped to Linux, such that Linux will get access to the same files and directories."
Ionescu says "There are a number of ways that Windows applications could inject code, modify memory and add new threats to a Linux application running on Windows." According to eWeek, "The modified Linux code in turn could then call Windows APIs and get access to system calls to perform malicious actions that might not be mitigated." Ionescu describes it as "a two-headed beast that can do a little Linux and can also be used to attack the Windows side of the system."
Ionescu says "There are a number of ways that Windows applications could inject code, modify memory and add new threats to a Linux application running on Windows." According to eWeek, "The modified Linux code in turn could then call Windows APIs and get access to system calls to perform malicious actions that might not be mitigated." Ionescu describes it as "a two-headed beast that can do a little Linux and can also be used to attack the Windows side of the system."
If the Linux personality has the same level of access to the kernel as the Windows personality, then this is a natural consequence. It's the same as if MS added a dozen new win32/64 APIs that could be exploited by apps with appropriate privileges. New code, new bugs. Total non-story.
This seems circular:
Is this some privilege escalation scenario for the original "Windows applications" against its own system via Linux subsystem?
Isn't that a bigger problem with the subsystem implementation?
What kind of "new threat" is this? All he's saying is that running code on a machine can have affect its state.
You have to enable developer mode in order to enable the Ubuntu Linux features, basically anything you can run in a shell, and while this implementation might be flawed its nowhere near as bad as Cygwin. Plus with cygwin you have to re-run the %$@ing GUI-based installer every time you need a patch instead of simply using apt-get. I am very much looking forward to dumping cygwin ASAP.
The Server Application in Windows 10 isn't running inside of a hypervisor; it's "running on the OS, getting all the benefits of performance and system access, as well as expanding the potential attack surface." eWeek reports on a new threat discovered by Alex Ionescu, the chief architect at cybersecurity company Crowdstrike, which begins with the fact that "The Windows file system is also mapped to the Server Application, such that the Server Application will get access to [...] files and directories."
Ionescu says "There are a number of ways that Windows applications could inject code, modify memory and add new threats to the Server Application running on Windows." According to eWeek, "The modified Server Application code in turn could then call Windows APIs and get access to system calls to perform malicious actions that might not be mitigated."
I'll Tell you what else increase your attack surface: Turning the computer on.
Didn't RTFA (naturally!), but the summary fails to convince me that this is more than incrementally worse than running...well...MOST applications that do anything useful on Windows.
... nevermind, too easy.
a two-headed beast that can do a little Linux and can also be used to attack the Linux side of the system.
FTFY
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
This is just crazy talk. If I'm running Windows I obviously don't care about security.
I'm an American. I love this country and the freedoms that we used to have.
Just like Linux you need to have special privileges to change anything important with the ACL lists of NTFS just like ext3.
I highly doubt malware will target this. I mean besides those using SQL insertion exploits for server databases no one targets Linux on the desktop. No one is going to be running a server with this anyway.
http://saveie6.com/
They have a hypervisor. It is called Hyper-V if you care and supported Ubuntu for awhile now.
http://saveie6.com/
I have the best firewall of them all - scissors and aluminum foil
I just don't know which one will be extinguished, Windows or Linux, or if it's mutually assured destruction
We've pretty much written Windows off years ago.
Windows applications could inject code, modify memory and add new threats to a Linux application running on Windows.
Windows has been able to do that to itself for years. No Linux needed.
Have gnu, will travel.
> The Linux in Windows 10
There is _no_ 'Linux' in Windows 10. Linux is the kernel used by 'Linux distros' and other stuff, such as Android.
Windows 10 has an emulation layer that looks like Linux, just as WINE isn't a Windows kernel but it looks like one.
Ubuntu bash and other stuff isn't running on 'Linux' it is running on Microsoft's emulation.
I'm not sure if many people will install this functionality to begin with aside from developers, the target may be too small to justify
Twinstiq, game news
Windows Subsystem for Linux processes cannot directly interact with either the win32 subsystem or processes.
Windows Subsystem for Linux Overview [img] :: https://msdnshared.blob.core.windows.net/media/2016/04/LXSS-diagram-1024x472.jpg or WSL System Calls & [img] :: https://msdnshared.blob.core.windows.net/media/2016/06/syscall_graphic.png
So, basically what he is saying is that if you can run software on a machine then you'll also be able to run software on that machine.
Or am I missing something?
Captain Obvious award for Alex Ionescu, the chief architect at cybersecurity company Crowdstrike. Congratulations!
Very few people (except developers) will have WSL running on their machines. WSL is isolated from Win32 except via FS access. Just based on it's current state, WSL is practically impossible to exploit thansk to it's limitations. Alex Ionescu is (was?) a ReactOS 'developer'. He has a beef against Microsoft. Disclaimer, in a past life, I was a ReactOS core developer for a certain period of time in the late 90s to early 2000s.
Bullship
I can just picture Satya setting up a penguin underneath a stick-box trap (using a windows 10 box, of course)
And now the introduce the biggest security swiss cheese of all...
I don't know if Linux vulnerability patches are obtained from Windows Update or through another Linux-centric mechanism.
After googling around a bit. stories about running a bash shell on windows pop up.
It isn't "running Linux" on windows. That would imply that there is a Linux kernel running that actually manages hardware. This impression of "running on hardware" is enhanced by the slashdot summary.
None of this. Windows is simply providing those Linux system calls that allows commandline apps to run. A story then mentioned that servers would not run. That's odd: When "bash" runs and say applications like ping, ssh and telnet, you'd have to go to great lengths to prevent another app like "apache" from running.
But if what I hear is true, this is only useful for the most basic of things, no graphical capabilities. I might be an old fart that uses the commandline a lot, but that becomes useful in combination with a bunch of graphical tools that display what I need to know on a graphical screen.
As to security: the implied trick of running a linux kernel that also has access to the windows block devices is very prone to bugs and security issues. But all that is not the case: It's just another program running in an operating system, using a slightly different set of API calls. If the emulated Linux system calls end up calling windows-internal stuff AFTER the "permissions checking" that normal windows calls would do then you have a problem. It tells a lot about how badly windows is layered.
This seems just a move to denigrate and undervalue the Windows brand. Nothing new to see, MS has been doing that for decades, keep walking.
That's Ok I have my windows 10 running in a sandboxed virtual machine under debian.
Ie. The way wine does it.
There are numbers ways to clear these problem..If any one need to check out the problem issued please go through the below link provided. @ http://www.kernelsphere.com/li...
problem solved
Politics is Treachery, Religion is Brainwashing
This is great news. Finally virus and malware writers will get access to Linux is such a way they can get their wares to run. Lack of viruses and malware has been one of the great stumbling blocks to providing a true like for like "Windows Experience" on Linux.
Can this be the tipping point that finally makes it the year of the Linux desktop ?
If you find a vulnerability in the Windows API, it means you can attack the Windows machine anyway, regardless of the method, with or without the Ubuntu add-on. It doesn't matter that you have several more applications some call Linux and maybe use them as carrier for the attack. If they aren't there, the atacker can easily use other apps to exploit the said vulnerability.
Who is this Ionescu "security expert", and what is he on?
The same approach they engineered around 20 years ago, with NT version 3.5, if not earlier? Darn them. Darn them to heck!
What will they think of next?
Both Linux and Windows accessing hardware directly so that Linux performs well.
What's the logical next step?
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
That should make porting WINE easy!
Seriously speaking, it seems the short of it is that WSL should be disabled if AppLocker is desired. I suspect that wouldn't upset too many folks, as I imagine the intersection of audience that uses AppLocker and the audience that would use WSL is non-existent. AppLocker is a pretty extreme lockdown to inflict on your users, and I can't imagine those admins wanting to use Linux applications.
WSL can be disabled, so I don't think this is as large a deal as the article wants it to be. In fact I assume the default is disabled.
XML is like violence. If it doesn't solve the problem, use more.
Linux is a kernel. The Linux kernel is not used in this emulation layer, instead it emulates Linux system calls on the Windows kernel. So, there is very little if any Linux in this scheme. Its not Linux.
I don't think this is a wise use of Canonical's resources, a better use would have been greatly enhancing and accelerating Wine development with a goal of getting it to 99% app compatability within 2 years and as well funding a project to provide a driver compatability layer to allow Windows drivers to run on Linux. This would make it easier for people to make a complete move to Linux and to bring their apps and hardware with them, rather than creating a reason for people to stay on Windows.
And Microsoft does it again!
When will we ever learn.
Until something happens, like SteamOS getting a large number of followers and dropping Windows support, requiring the use of the WSL to run Steam. Or people wanting to run server software for free but not wanting to do a separate Linux install. Etc.
Something may yet happen. Do not take the future lightly young padawan...
Come on Windows, if you have nothing to hide (visible by Linux), you have nothing to worry about right?
Okay, I can see running Windows under Linux, but why run Linux under Windows? It seems like that's the worst of both worlds.
Just cruising through this digital world at 33 1/3 rpm...
No mother fuckers. No.
Never use anything Windows near Linux unless it is a for sure locked down Windows (you have to be very pro) and you are running VM's of Linux. On a bare metal Linux forget you ever heard of Windows.
Microsoft ANNIVERSARY anniversary ANNIVERSARY heyy ANNIVERSARY 10
Fuck you FBI. Dead spies.
I only bothered upgrading my HP workstations to Windows 10 (for free) is so that I can install windows 10 on a hard drive and run Ubuntu GNU/Windows.
John_Chalisque
They have a hypervisor. It is called Hyper-V if you care and supported Ubuntu for awhile now.
Yep, and it has since it was called VirtualPC before they bought it from Connectix.
The question is, why, oh, why didn't they just USE VPC/Hyper-V to do this, rather than create some creaky, leaky SHIM?
Alex is the guy that got Wime and ReactOS in trouble a few years back by disassembling WinXP code and copy/pasting it in those projects. We're still paying for his bullshit. Don't give this fraud any credence.
I was playing with "Ubuntu for Windows" on Windows 10 last week. While it is an interesting effort (and I was able to upgrade from the default Ubuntu 14.04 (Trusty Tahr) userland to the 16.04 (Xenial Xerus) userland with minimal dificulty), performance does not match that of a Lubuntu 16.04 VM on the same hardware running in VMWare Player. I was running repeated Monte Carlo-type simulations, and the same scripts and executables took twice as long to run under Ubuntu for Windows vs. the VM.
So, while interesting, it is still beta (and is labeled as such, and requires "developer mode" to be enabled in Windows 10), and it's not quite ready for prime time yet.
So is it essentially a new POSIX interface?
No it's not the whole POSIX interface (that used to exist and be called something along the lines like "Unix Services for Windows", but got in practice over taken in popularity by Cygwin - a translation layer between POSIX source code and regular Win32 interface).
WSL implements only a very small subset of Linux kernel's API calls.
Just barely enough to get some Ubuntu user space running, so you can still use Windows to write and test your code before deploying to some Linux cloud.
(instead of using Mac OS X or a real Linux desktop or a VM like everybody else.
There currently nearly no filesystem support (except for the special drivers that Microsoft has written to support passing Windows's local drivers under Linux).
There is very limited network support (you can run apache and even SSH. But forget about NFS)
There's no media at all (no X. no audio. no USBHID/libinput. nowayland/DRM/Mesa hardware/Whatever. no nothing. Its main purpose is to test linux code before deploying to the cluster, so don't expect anything fancy).
No even fabric dummy drivers (that's a bit limiting for the intended purpose...)
Nothing from the Linux kernel internals (no scheduler, etc.)
So maybe with some extensive hacking you could write a zombie node that can take part in some mass spamming or DDOS.
(Basically, anything that you could implement as a not so fancy network daemon under any other OS).
But that's about it. Don't except to circumvent some Windows protection by calling into WSL, it has no access to anything low-level.
(e.g.: Forget about trying to reflash the firmware using some linux sysadmins tools under WSL, or making some advanced stealth keylogger)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
It doesn't have hardware access.
It only understands a very limited subset of all the API calls offered by the Linux kernel.
Just barely enough so you install ubuntu and test some linux code before deploying on a Linux powered cloud.
Some limited network is as best as you could get. Nothing much fancy beyond that.
You could run Apache or SSH but don't set your hopes to high (not even NFS).
Completely forget any hope about keyloggers, reflashing firmware using linux sysadmin tools, etc.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
There are a few differences.
Cygwin is a userspace library that translates nearly whole POSIX API to win32 API calls.
WSL is simply Windows' own kernel offering directly a new API, in addition to Win32/Win64/etc. much like Microsoft's older Unix subsystem for Windows.
The size is also different.
Cygwin features nearly the whole POSIX.
WSL is just about the strict minimum subset of Linux API calls so you can run a few Ubuntu elfs unmodified.
It's just so you can test some code locally before deploying it on a Linux cloud.
You'll get the ability to load ELFs, and some very limited network and filesystem access. And that's it. Nothing fancy.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
here after known as winbuntu
If you just need a Web apps, go with a Chromebook. Nothing is perfect, but there is just not much running to hack. If you just want Office, stay away from Ubuntu userland. It's another thing to maintain and update, and yes an additional exploit vector. In the meantime I am psyched that I can run various home servers on my gaming box rather than having to tinker with a separate old laptop stashed on some shelf.
...I was just nitpicking about small minutes details.
having Linux user-space components running on top of a translation layer is not new either. Cygwin has been doing it for ages.
Ubuntu on Windows doesn't run atop a translation layer. There's no "in between" layer, it's the NT kernel that exports a few extra API calls. It's first class citizens just like Win32 or the old Unix interface, not a translation layer like Cygwin, Mingw.
And Cygwin has been offering way much more for ages (complete POSIX).
WSL is more comparable to Mingw (which is the bare strict minimum subset of POSIX to get basic software to compile in Windows - just like WSL is a bare strict minimum of Linux API calls to get basic ELFs to run in Windows)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
They can do it if you have the professional edition of Windows 8/10.
I use it because it is cheaper than VMWare workstation and it is a real type 1 hypervisor like VMWare ESX. Not a crappy one like VirtualPC (different product), Virtualobx, or VMware workstation.
That is one thing I wish Linux had as a host. ESX is not cheap nor free for real type1 with no obscure drivers as the guests can use the host hardware natively.
http://saveie6.com/
You don't think they have implemented that as a translation layer in the NT kernel?
Not according to their docs and blog posts.
NT kernel is horribly complicated beasts.
It can exports its internal as different sets of API.
The idea back then was:
- to allow multiple sets of API
Back then the idea was to support win32 *and* OS/2 both at the same time (this one is defunct nowadays). Then UNIX came. And now WSL)
- so they can freely hack the internals without being held back by an API model
That's the situation with WSL. Because proc forking sucks under Windows, whereas it comes more or less for free under Linux, Microsoft has come with a new feature they call Pico thread, which is even lighter than linux at multiple-process (but is worse at isolating/compartimentalizinge - no big deal for a feature which targets developpers, not end-users). These Pico threads aren't exposer in the current Win64 and Win32 apis. But these pico threads are what is exposed to make processes in WSL.
So the route is not Linux -> translated into Win32, but directly Linux -> NT kernel, skip the intermediate translation layer.
Cygwin on the other hand is entirely implemented as a user-space component. It runs to user space, and translate POSIX calls to Win32 calls.
(And you could run Cygwin on top of any Win32 provider. Like order versions of Windows, or like Wine - like done for testing).
(Whereas for WSL you need a very specific version of the Windows 10 kernel that actually feature that extra Linux-like minimal API that isn't available anywhere else).
Well, it is MS with their massively bloated kernel API, so maybe they did do it natively and since it is closed-source, we may never know.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I personally loath that we all call every *nix distribution Linux. To me it's akin to calling all Windows releases (WinNT). Not that I have a better suggestion for hoe to refer to these systems. I have to constantly remind my friend that his problems are Ubuntu and/or Unity related and how the problem of the software he's running isnt unique to "Linux" nor is it "Linux's" fault or responsibility for these issues. When he says "I like Linux but..." accompanied with something like "...what are these black borders after I suspend my machine?" or "... The software center doesn't have X and I need to add a PPA? What's a PPA?" I remind him that it's not the Kernels fault you are seeing black borders around all Windowed apps or don't have "X" in the Ubuntu software center. Nor is it the Kernels fault when your latest proprietary NVIDIA drivers don't work with your Window Manager and you need to manually install an earlier BLOB. We all keep calling it "the Linux desktop" but isn't it more apt to say "the unity desktop"? I just get tired of how we all group all Linux kernel based computing experiences and software collections as "Linux". Two users will experience an entirely and monolithicly different, unique, and either good or poor (mostly subjective) experience when one uses Ubuntu,Unity,LightDM and the other uses Gentoo,MATE,Marco,SDDM or any other permutation that comprises "the Linux desktop."