How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was:

written in Python
compiled to an ELF exe using PyInstaller in Debian in WSL
and "injected into a running process using Windows API cal… Continue reading How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

Is DSA-1024 safe to sign package repositories ? What are the reasons?

I recently found that the latest release of a major Linux distribution (MX Linux) uses DSA-1024 in /etc/apt/trusted.gpg and in /etc/apt/trusted.gpg.d/*.gpg
It also probably uses SHA-1 as the signature algorithm (which is the most common on… Continue reading Is DSA-1024 safe to sign package repositories ? What are the reasons?

Researchers flag 7-years-old privilege escalation flaw in Linux kernel (CVE-2021-33909)

A vulnerability (CVE-2021-33909) in the Linux kernel’s filesystem layer that may allow local, unprivileged attackers to gain root privileges on a vulnerable host has been unearthed by researchers. “Qualys security researchers have been able to in… Continue reading Researchers flag 7-years-old privilege escalation flaw in Linux kernel (CVE-2021-33909)

How to protect the host system against a rootkit on a virtual machine?

I need to create a virtual machine (Debian 10) with Virtualbox on a Linux host system. The VM will be used as an office desktop to access the Internet via browser and therefore needs to use the Internet-connection that is provided by the h… Continue reading How to protect the host system against a rootkit on a virtual machine?