Windows Subsystem for Linux (version 2) is getting more and more traction lately with new features being added such as GUI mode over Wayland (WSLg). It seems to me Microsoft really pushes for WSL usage, however, I am worried about the underlying security.
I have read several articles which put me into panic mode.
Running Sensitive Apps in WSL: (SAFE + SAFE) < SAFE https://www.cyberark.com/resources/threat-research-blog/running-sensitive-apps-in-wsl-safe-safe-safe
Some excerpts from the above:
The loopback attack, for the WSL 2 VM, is a Local Privilege Escalation vulnerability that is explicitly enabled by the “Lightweight Utility VM” features of WSL 2. This vulnerability does not exist if an equivalent Linux system is run in a full VM under Windows.
The main security risk identified here is credentials theft or theft of other sensitive data processed by Linux applications running inside WSL.
An additional consideration is the security programs that may be active in the machine. To the best of my knowledge and at the time this blog was published, there is currently no known Windows security program that protects Linux files (inside the WSL file system).
Any security programs that might be implemented inside the WSL VM (e.g., maybe protecting SSH keys) will not be active while the attack is carried out.
The use of Hyper-V no doubt improves the efficiency of the system, however its use of “.vhdx” image files makes behavioral and binary analysis almost impossible. This lack of coverage, short of installing an agent on the virtual machine itself, seriously impacts a hunter’s ability to categorize the presence of such a component.
TLDR - WSL is unusable for any kind of work with sensitive data, that is almost any kind of commercial work, and current antivirus programs aren't able to sufficiently defend against these threats.
I'm not a security expert, so I thought I would ask here. Since WSL undergoes a lot of development and the articles are more than a year old, has any of these issues been adressed by Microsoft as of middle 2021?
Seems strange to me they would focus so much on new features and not fix anything this critical. Or is it just me overreacting and this is not really such a big issue? Should I be worried and avoid using WSL 2 for commercial work?