Citrix Adds a Linux-Powered Escape Hatch For Compromised Windows PCs

Citrix's Desktop as a Service (DaaS) product includes a lightweight, hardened second operating system called UniconOS (once called "eLux") to offer Windows customers a write-protected file system Citrix says is secure against computer viruses and other malware. Nerds.xyz reports: According to the company, the environment remains isolated from the Windows filesystem and uses Secure Boot protections covering the shim, bootloader, kernel, and initial RAM filesystem. That separation matters when ransomware encrypts Windows or a faulty update leaves the operating system trapped in a boot loop. Instead of repairing Windows immediately, an employee can boot into UniconOS and use Citrix DaaS to access virtual applications and desktops.

Citrix SecurAccess with Chrome Enterprise provides access to internal web applications under the organization's existing security policies. In other words, UniconOS does not actually fix the damaged Windows installation. It gives employees another route to their applications while the IT department investigates or repairs Windows... [T]he installer shrinks the Windows volume, creates a new partition, copies UniconOS onto it, and registers the necessary boot entries. Windows remains the default operating system during ordinary use, although administrators can configure boot delays and fallback behavior...

The approach could prove useful following a widespread ransomware attack or another defective Windows update resembling the CrowdStrike incident of 2024. Recovery would happen independently on every compatible endpoint instead of requiring IT employees to physically handle thousands of computers.
Thanks to Slashdot reader BrianFagioli for sharing the news.

Dual Boot = News ?

[El Fantasmo]

Really people? I know sometimes Slashdot gets accused of ads as stories, but this is a joke. This is an ad for a Citrix.

Dual boot options to chose a different operating system has been around for decades. You don't need a special version from Citrix to be able to boot into a Linux OS and use VDI, app gateways etc.

Re:

[aaarrrgggh]

There is a meaningful difference in that it is a secured boot option. Not sure what that means if your UEFI is compromised or if a virus is stored within other hardware, but it is something.

A lot of organizations need good "limp mode" strategies for when things go to shit. Ideally those allow you to use what systems are still unscathed rather than reverting to pen and paper. This can be one of those solutions for places that are invested in Citrix [still, for some reason], and is a little lower risk than te

LOL!

[SlashbotAgent]

Recovery would happen independently on every compatible endpoint instead of requiring IT employees to physically handle thousands of computers.

LOL! How do you think that would work?

Good luck even talking end users through getting a second OS booted. And after they get it booted, then what? They're going to fix their non-bootable Windows system, without IT, from a Linux environment that they've probably never seen in their entire life?

IT will have to fix each one individually. The only time savings that this might provide is if it provides IT remote access to the system once it's booted. That's something we used to inject into the Windows recovery environment. Then they switched to PXE booting an OS with remote access and recovery options. But today, big IT fleets are using vPro and can access the machine remotely even if it's powered off and has no OS. They still have to fix every one, but they don't have to
physically touch the machine with their smelly fat fingers.

Re:

[drinkypoo]

It seems like a better solution would be to virtualize the Windows installation in the first place, and then you can do whatever you want with it later if it's compromised. While IT is checking it over to determine whether it's time to revert it to a snapshot or actually try to gather data from it, you can be using an alternate system of whatever kind. The user ought to ideally be basically unaware that anything has happened (why would you boot into Linux when a user is used to Windows?) except that they do

You invented the live distro / rescue disc again

[xack]

Live distros have been doing this for decades now. It's nice that we have a new option, but Linux has been saving Windows from itself for longer than Windows XP existed.

Re:

[ChunderDownunder]

I inherited a Lenovo machine that booted Linux from 'ROM', i.e. a secret partition on the SATA drive accessible from a button on startup.

I think it was a Windows 7 starter edition machine that was so underpowered it was a proof of concept if you got fed up with the main OS it would boot into 'lightweight' Linux.

So yeah baking a live CD into recovery partition is nothing new.

If you can run the apps in Linux

[FudRucker]

Then why bother with MS_Windows? Time to put that worn out old horse in the glue factory

Install a backdoor to fight malware?

[shess]

I get what they think they are doing. But you can't really achieve security by layering ill-thought-out systems on top of each other. I'm sure the new system does not at any security holes. I'm sure that the two systems together don't create any security holes one of them alone wouldn't have had. I'm sure.

Re:

[organgtool]

I get what they think they are doing. But you can't really achieve security by layering ill-thought-out systems on top of each other.

I'm not disputing that these systems are at least slightly less secure because having two operating systems on a device inherently increases the attack surface. However, I do dispute the term "layered" because my understanding is that the two operating systems are designed to be as independent as possible.

I'm sure that the two systems together don't create any security hole

It's a good idea in theory

[OrangeTide]

But I'd also caution against making promises that you can't keep.

and provides a write-protected file system which makes it secure against computer viruses and other malware.

Unless it's a floppy disk that has a hole that breaks the circuit to the write head, it's not actually "write protected"
I remember when motherboards had a jumper you had to move in order to apply a BIOS update. I suspect most people found this inconvenient or too complicated for end-users, but it was also a lot harder to put irremovable malware into computer back then.

Re:

[drinkypoo]

It's probably just encrypted, that provides the security-focused part of write protection, at least while it's not been unlocked for boot.

Computers used to have stuff in ROM, stuff used to be a lot smaller, you used to be able to burn your own ROMs and put them on your own boards and have it be meaningful. But none of that is true today of course any more than that you could put a useful amount of storage on a floppy.

Read/write protection on flash is mostly done in firmware and therefore could theoretically

Desktop as a Service?

[MpVpRb]

WTF?
Will the madness ever end?

Re:

[hazem]

It's actually an old idea. Back in the 90s I worked in a school computer lab where on one floor there were Sun workstations students used. On the floor above, there were Tektronix "dumb" terminals that connected over the network to the workstations downstairs providing users a keyboard, mouse, and monitor. The workstations on the first floor were providing "remote desktop" to those terminals... essentially "Desktop as a Service".

Open Source Is Making the Market More Interesting

[organgtool]

I find it interesting how many companies are attempting to use the flexibility of open source technologies to make up for the many shortcomings of Windows. Open source technologies are becoming more attractive for alternative solutions not just because they're generally more secure out of the box, but the ability to combine the many different features that are available provide a level of flexibility in which Windows could only dream. For instance, the use of immutable Linux distros, such as UniconOS, makes it much harder for a valid user or an attacker to damage or compromise the system. In addition to that, in Linux it's possible to combine file systems that can take snapshots (ZFS, Btrfs, etc) with boot loaders that can boot from specific snapshots to easily revert back to a usable system after a botched update (I bet the sysadmins who had to clean up after the Crowdstrike debacle would have appreciated that option!).

Meanwhile, Windows stagnates with no viable options to compete with these technologies. It makes we wonder if Microsoft will ever even attempt to catch up or just continue to slowly cede functionality to Linux and other open source alternatives. I'm not suggesting that Linux will take over any markets, but if I was running a company I would do everything in my power to make my users forget that competition even exists, not let my products stagnate to the point where the market becomes desperate to explore every possible alternative.

I don't expect this product to be particularly popular, but I do find it interesting that Citrix recognizes the problem and is attempting to use open source to resolve it.

Re:

[Mirnotoriety]

> Meanwhile, Windows stagnates with no viable options to compete with these technologies. ..

How dare you, there's: System Restore, UEFI Secure Boot, VSS, Windows Autopilot, Windows Deployment Services, Windows Recovery Environment, Windows Sandbox, Windows virtualization ..