(untitled)

I had an idea the other day was thinking about how feasible it would be to design some of Windows malware that would silently install a Linux distro onto the hard drive without disturbing the running Windows installation. The plan is that it would have to shrink the NTFS partition, then install GRUB and set up Linux ext4 partitions needed to boot into Linux by default, with the NTFS partition mountable. Does anybody think that this would be feasible?

Sounds very M$ FUD in its intention.

>>1343 I'm speaking more from a practical point of view, as in "would it be relatively possible", not "should someone actually do this". The other way around (Linux -> Windows) is likely very possible, as once the kernel is in memory you could start up the Windows installer in a KVM and mount the drive in that. But where's the fun if it's so easy?

>>1340 Hypervisor based rootkits are the thing. https://theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.html I'm not sure why you want to go through all the trouble of repartitioning the disk and formatting it ext4 though. Linux is capable of running straight from RAM (lookup initramfs).

>>1344 Well once you have admin access on windows with the malware you can take advantage of its disk resizing tool to make space. From there it could be possible to place linux in that empty space using a partition tool as discussed in http://www.techovity.com/how-to-create-ext2ext3-linux-partition-from-windows/ Install GRUB using something like https://superuser.com/questions/381285/how-to-install-grub-from-inside-windows-7

>>1345 >Linux is capable of running straight from RAM I know it is, but that's not the point. The point is to convert a running Windows machine to boot into Linux by default. And in order to not be mean it'd be nice to let the user/victim still have access to all their old files. I don't think that virtualization the Windows installation is necessary, especially given that escalating to SYSTEM privileges isn't extremely difficult (whether by abusing bugs or social engineering). It might be worth it to spin up a hidden VM for running an unattended installer for the new OS, though. As long as there was a way to already configure it with the hostname, user account(s), etc. >>1346 Do you know if there are APIs in the kernel for resizing partitions? I would assume so. I don't think that installing a GRUB-like bootloader from inside Windows would be necessary if the installer is already virtualized.

>>1348 >The point is to convert a running Windows machine to boot into Linux by default. I think the user might notice something is happening if you do that... Is this more like an idea for a prank than actual black hat malware?

>>1349 You could call it a prank, yes. Obviously they'd notice once they booted into not-Windows, but at that point it would be too late to do much of anything. By shrinking the partition you leave their files accessible (and hopefully Windows still bootable), but really edge them towards using the Linux installation. For most people this probably wouldn't be an issue, as (for example on Ubuntu) Firefox already is installed and pinned to the application menu. If you don't want to call it a prank then perhaps it can be considered a "security vaccination".

>>1350 I'm sorry I got the wrong end of the stick. Please ignore >>1345 and >>1349

>>1350 If you want to prank them you should install ponyOS. Kernels are magic. If it's someone you know and it's a desktop, you could just plug a usb into one of the internal usb ports while they are out and have it boot to usb since they probably have no bios password.

>>1350 > Security vaccination You do realize that the linux desktop is absolutely rotten from a security perspective, right? From an insecure display server to lack of sandboxing, as well as atrocius code quality as evidenced by https://scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html, not to mention the soykafton of kernel 0-days. The only thing protecting us from a mass malware outbreak is low marketshare and lack of clueless users, and both of these "protections" would be weakened by your malware. There are many reasons to use desktop Linux, but security is not one of them.

>>2007 >From an insecure display server to lack of sandboxing Fedora uses Wayland + SELinux by default. I don't see how you have a leg to stand on here but I'll wait for your response. >soykafton of kernel 0-days. I agree with that. >There are many reasons to use desktop Linux, but security is not one of them. It depends if you know what you are doing. All desktop operating systems are biased towards getting things done over security. That doesn't mean there are no security controls behind the scenes that a competent user can use to protect themselves. Linux has good ones, even without Grsec and PAX. I do agree with your general point that forcing someone to install Linux isn't going to make them much safer.

>>1340 interesting thought... you could build an image that would use cron to probe all of the hardware on boot and it could then look for ntfs volumes and write a line to it's fstab and mtab. You'd of course need to include the ntfs-3g driver. From the Windows side you'd need to make a partition and you could use something like dd for windows to image the partition with your linux image. Then write over the boot sector with GRUB then set flags to boot to the Linux volume. The thing is this is very noisy. There would be a lot of disk, memory and CPU bound tasks (imagine how resource intensive something like this would be on HDD). Then you have to ask why you are doing this? If you can create a partition obviously you'll need Administrator/SYSTEM level access anyways. so what would be that advantage of exploiting this way over just using Windows to dump the payload? in Win 10 you could install the LSFW or cygwin (for everything) if you need a BASH based attack. it just seems excessive.

>>2008 > Fedora uses Wayland + SELinux Didn't think about that, guess I'm too debian-centric. That still doesn't fully address critical components suffering from atrocious code quality (although it does help mitigate, and I guess the windows sources don't look better either).

>>2012 Debian has AppArmor if you don't like SELinux. And Firejail. If you don't like Wayland you can use Xpra or Xephyr to isolate windows. I get that most of this isn't on by default but the tools are all there so I don't think it's fair to say Linux is insecure fullstop. >critical components suffering from atrocious code quality There aren't many alternatives though. All software has bugs, even if everything does get rewritten in Rust someday. Accepting that bugs happen and containing the damage they can cause is also part of security and Linux does a good job of that in my opinion.

Windows can boot into a virtual hard drive using a feature called "native boot." If you exploit native boot it will be 100% non destructive. There's no need to create partitions, fuarrrk with the bootloader, or do anything else that would probably just brick the computer in most cases. I don't know how practical or possible it is to do this with Linux though. I've only used it to boot from Windows into another Windows environment which has worked like a charm every time, but you know how Microsoft is.

>>2007 To state, security on computers is heavily dependent on the users practices and habits more than their os. The dummy who will open an excel file from a telephone scammer without thinking on Windows will still do the same dumb thing on linux, I would just have to write the virus to detect the unix system. The security on linux is based more on someone willing to call out the deficiencies and fix them or offer a replacement/alternative to avoid situations like what Microsoft seems to have going on internally.

>>2014 >Windows can boot into a virtual hard drive using a feature called "native boot." This is Windows bootloader and kernel mounting root from a special image file instead of a partition. That's obviously not going to boot anything but Windows. https://technet.microsoft.com/en-us/library/gg318048(v=ws.10).aspx >There's no need to create partitions, fuarrrk with the bootloader, or do anything else that would probably just brick the computer in most cases. Don't project your own incompetence onto everyone else. Just because you don't understand how to do something correctly doesn't make it inherently dangerous or difficult.

>>1350 >edge them towards using the Linux installation That'd probably make tech muggles even more afraid of linux

>>2012 >>2013 openSUSE coming with AppArmor by default, and SUSE involved in AppArmor development for many years. It is quite handy, although not complicate enough as SELinux, but easier to understand and config.