Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

Windows Subsystem For Linux 2 Bypasses The Windows 10 Firewall

Windows Subsystem For Linux 2 Bypasses The Windows 10 Firewall

The Windows Subsystem for Linux 2 will bypass the Windows 10 firewall and any configured rules, raising security concerns for those who use the feature.

In a blog post today, Mullvad VPN explained that their product includes an ‘Always require VPN’ option that blocks Internet access via the Windows Firewall unless connected to the VPN.

After Mullvad received a tip from a user, it was determined that WSL2 Linux distributions bypass the Windows 10 firewall and its configured rules, and prevent the VPN’s  ‘Always require VPN’ security feature from working.

WSL 2 bypasses the Windows firewall

Mullvad states that they tested this issue with multiple VPN products, and the problem exists in all of them.

The problem is that this has nothing to do with VPN software and is simply how the Windows Subsystem for Linux 2 was developed.

The first version of the Windows Subsystem for Linux (WSL 1) uses a Linux-compatible kernel that translates Linux system into calls that work with the Windows NT kernel.

When using WSL 1, any network traffic is filtered through the Windows Advanced Firewall (WAF), and the Linux distro honors any configured rules.

With the release of WSL 2, Microsoft introduced a true Linux kernel operating in a Hyper-V virtual machine with a Hyper-V virtual network adapter.

Unlike WSL 1, WSL 2 traffic is sent to the correct connection, whether it’s your LAN Ethernet adapter or VPN, but it completely bypasses the Windows Firewall.

For example, I created a Windows Firewall rule that blocks all outbound traffic to port 80 (HTTP) and 443 (HTTPS), the default ports when connecting to web sites.

Windows Firewall rule to block outbound web connections
Windows Firewall rule to block outbound web connections

When enabled, this rule blocked all outbound connections to websites from Windows 10 and WSL 1 Linux distributions.

On the other hand, when I tested from a WSL 2 Ubuntu distribution, I had no problems connecting to Google.com as it bypassed the Windows Firewall’s filtering.

WSL 2 distribution bypassing the Windows Firewall
WSL 2 distribution bypassing the Windows Firewall

To make sure that this was not a strange configuration on my end, numerous other people helped Bleeping Computer test the bypass, and they confirmed that it was happening on their end as well.

Also Read: Data Storage Security Standards: What Storage Professionals Need To Know

What’s the big deal?

The main concern with WSL 2 bypassing the Windows Firewall is that no one knows about it.

If you are coming from WSL 1, you would expect your outbound connections from WSL Linux distributions to be filtered through the Windows Firewall, as that is the usual behavior.

Once you upgrade to WSL 2, though, it no longer honors your firewall configuration, and any security that relies on it no longer works.

As WSL 2 distributions can support a wide array of Linux applications, including server implementations like Docker, it does make sense to be seen as an independent operating system that does not rely on the Windows Firewall.

It is necessary, though, that users know that their configured Windows Firewall rules will be ignored.

The good news is that WSL 2 supports Linux firewall implementations like iptables that can control network traffic.

For example, after installing iptables, you can use the following command to block connections to port 80 and 443.

sudo iptables -A OUTPUT -p tcp --match multiport --dports 80,443 -j DROP

Once this rule is enabled, attempting to connect to a website from the WSL 2 Linux distro no longer works.

Also Read: 10 Principles On How To Build A Good Governance Model

iptables blocking connection to Google
iptables blocking connection to Google

The Windows Subsystem for Linux version 2 (WSL 2) is far more powerful than the first version, but with it comes security considerations that users should be aware of.

Suppose you rely on the Windows Firewall to control your network communications. In that case, you need to pay special consideration to how you configure your WSL 2 distributions so that you can replicate your configured Windows security.

BleepingComputer has contacted Microsoft with questions related to this story but has not heard back.

H/T YCombinator Hacker News
Special thanks to @CVEandABV, @5eanT, @tppetkov, @sundhaug92, and @IISResetMe for their help testing WSL 2 distros against the Windows Firewall.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us