npiperelay is flagged as malicious software about wsl-vpnkit HOT 5 CLOSED

This is a real bummer to see. wsl-vpnkit was addressing a real need but there is no way that my group can use it with the security risk that npiperelay presents. :-(

I hope that you can find a safer alternative...

from wsl-vpnkit.

That linked analyze by virustotal, is that for your own build? I don't recognize the file hash..

Your link contained a lot of detections: 25 security vendors and 1 sandbox flagged this file as malicious.

When I upload npiperelay.exe from the published release v0.1.0 there are fewer detections:

• x64: 5 security vendors flagged this file as malicious (https://www.virustotal.com/gui/file/ff41951c3f519138bb0e61038d7155c6c38194d4d8a3304f46c67c4572ee8bec/detection)
• x86: 7 security vendors flagged this file as malicious (https://www.virustotal.com/gui/file/e5e718baab3be97138acbc9641c2b5270fc42a01188eb4ead371844a0eb6df7f/detection)

Also, it is a very small code base: The v0.1.0 release contains only 234 lines of go code, plus a single, very common, third party dependency. So I wouldn't worry too much, or at all, that it actually does include any sort of malicious code.

from wsl-vpnkit.

The file hash from the link was provided to me by my security team, who were analyzing active processes on my machine if that matters. I can't recall what version I had installed and was since compelled to purge it from my laptop, but it was from the release page.

The real concern is that in larger, traditional organizations, trad infosec teams don't bother investigating such issues beyond a basic report in whatever tool they use (here virustotal). If the report says it's potentially dangerous that's all they need to invoke a blanket ban, which is what's happened on my end.

from wsl-vpnkit.

v0.2.5 replaces the npiperelay.exe with the v0.1.0 binary.

I was building it with a newer version of Go in previous versions, but the performance improvement was negligible, so it wasn't worth it if it's detected as malware by so many additional AVs.

v0.3.0 removes the need for npiperelay.exe. wsl-gvproxy.exe in v0.3.0 came back with

3 security vendors and no sandboxes flagged this file as malicious

https://www.virustotal.com/gui/file/74696ca9e3eb502760e2c9f7eeac42c1785e2c29c7354c4263f51e498c13a379

from wsl-vpnkit.

In case anyone was wondering, I've been running the new package for a few weeks now, not a peep from the folks over in security. Windows users in big companies rejoice, WSL2 is once again in our toolbox :D

from wsl-vpnkit.