A New Attacking Technique called “Bashware” can able to Bypass all Windows Based Security Software solutions by abusing the New Windows 10 Future called Windows Subsystem for Linux (WSL) and Injecting the Backdoor.
WSL is Compatibility Layer for running Linux binary executable on Windows 10 based Computers that helps to Enable the bash terminal available for Windows OS users.
This Flow can able to allow any Malware’s to bypass the Advanced security solutions, Next Generation Anti Virus software, inspection tools, Anti-Ransomware solutions.
This means that Bashware may potentially affect any of the 400 million computers currently running Windows 10 PC globally.
Also Read : Vault 7 Leaks: CIA Hacking Tool “Angelfire” Secret Document Revealed to Compromise WindowsOS – WikiLeaks
How Does it Bypass the security Futures
Presently Available security software Futures is not that much Effectively Monitoring the processes of Linux Executable’s running on Windows OS.
This will leads to open a backdoor to the hackers and run their Malicious code by abusing the WSL futures which allow hiding from the current intelligence that is given by the security vendors.
Bashware Technique Mainly abusing the “Netcat” utility Futures that is used for reading and writing to network connections using TCP or UDP.
Netcat has some list of Futures including port scanning, transferring files, and port listening, and also it can be used as a backdoor.
In some case, Security Software like Anti-Virus is not allowed the Netcat Futures to get Executed.
By Default, 1337 port is closed because it leads to create a Backdoor and allow the Trojan services to run on the Windows Computers.
Once Bashware Execute the Malware, then it will Bypass all the security solutions and it will later Enable the WSL Future.
https://www.youtube.com/watch?v=4ki6dbEePaw&feature=youtu.be
End of the Execution will Successfully open the Netcat Listener port(1337) that will helps to Attackers to Open a Backdoor.
Windows Inspection Tools such as Task Manager will not Identify the Malicious Payload Process. Instead of that, it can only show the WSL Loader process.
Advanced Process Monitoring Tool also not Detecting the Malicious Payload Process which is Running behind of the WSL Process.
According to Checkpoint Software, a hybrid concept which allows a combination of Linux and Windows systems to run at the same time but allow them to use the features provided by WSL to hide from security products that have not yet integrated the proper detection mechanisms
Security industry to take immediate action and to modify their security solutions to protect against this new method to Mitigate this Actives. Checkpoint Said.
