[flagged]
What's described here is no different to a malicious nginx or Apache module, like this one from eight years ago: https://github.com/ChristianPapathanasiou/apache-rootkit
New malware abuses Microsoft IIS feature to establish backdoor
11–20 of 62 posts
Re: New malware abuses Microsoft IIS feature to establish backdoor
#12People use IIS?
What's wrong with using IIS?
Re: New malware abuses Microsoft IIS feature to establish backdoor
#13People use IIS?
Yep. From what I've seen, usually it's a case of a company building something which uses it a long time ago, and not bothering to switch to an alternative because 'If it works don't fix it'. It may not be the newest and shiniest, but if it's working well then no need to move to something else.
I have customers with DOS (6.2, so quite modern) controlling machines.
I ended up wedging a Samba daemon between that and PCs running Windows 10. I mount the DOS box's share via mount.smbfs and re-export it via Samba. The machine is on a rather sparse VLAN!
I have many other horrors on isolated VLANs across the UK to worry about ...
Re: New malware abuses Microsoft IIS feature to establish backdoor
#14Re: New malware abuses Microsoft IIS feature to establish backdoor
#15People use IIS?
What's wrong with using IIS?
Nothing at all. It is an extremely capable webserver.
In common with all web servers, advice found via search varies in quality and unfortunately, being Windows based: IIS really suffers. The GUI is pretty intimidating (IIS Manager - both of them) and there are things that can only be done via registry, config files and dark magic.
IIS gets a lot of undeserved stick in my opinion.
Re: New malware abuses Microsoft IIS feature to establish backdoor
#16People use IIS?
I used to work for a .NET shop (pre .NET Core) doing F#, and we used IIS.
In the company Slack, I said something like "Serious question; is there something that IIS does better than something like Nginx or any other open source server?"
One of the most senior engineers responded back with "crashing".
Re: New malware abuses Microsoft IIS feature to establish backdoor
#17Nobody sane runs FREB at full prod load on public sites. It's not installed by default. It is highly useful for troubleshooting but not at production traffic. Seems like if you're inside IIS already by some mystic hack you already own the space.
Re: New malware abuses Microsoft IIS feature to establish backdoor
#18FTA: "In order to use this technique, an attacker needs to gain access to the Windows system running the IIS server by some other means. In this particular case, it is unclear how this access was achieved." See also "It rather involved being on the other side of this airtight hatchway" series by Raymond Chen: https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20…
"it is unclear how this access was achieved"
Not a good line in a write up like this. Windows does write n store an awful lot of logs by default. However thanks to circular logging with log sizes from the 1990s on critical logs, you can easily lose information.
I can't remember what the defaults are (connects to 2016 AD DC) ... 20Mb for %SystemRoot%\System32\Winevt\Logs\Security.evtx . On a tiddly setup like mine (20 odd users), that will last ... less than a day.
I ship the logs elsewhere for proper evaluation etc but 20Mb? Yes, you can fiddle with the default sizes via group policy and you probably should but 20Mb really is off of the 1990s. OK so all the "core" logs seem to be 20Mb each and there are the rest under /Microsoft/Windows with varying sizes. I probably ought to look at what a PC logs these days - probably the same silly sizes.
Re: New malware abuses Microsoft IIS feature to establish backdoor
#19People use IIS?
It's usually the right choice if the software runs on a Windows host. Why add a whole bunch of third party problems on top?
A lot of enterprise software is built in .NET for Windows, and as the expectation of web-based UIs for said software has increased... honestly I'd be surprised if IIS usage wasn't increasing in overall uses (though not in market share, for certain).
Re: New malware abuses Microsoft IIS feature to establish backdoor
#20Nobody sane runs FREB at full prod load on public sites. It's not installed by default. It is highly useful for troubleshooting but not at production traffic. Seems like if you're inside IIS already by some mystic hack you already own the space.
This malware is enabling FREB then injecting malware into it. The point is to hide the exploitation better than simply injecting a custom module. You don't need to be running FREB previously.
Plus I don't find the "nobody does [XYZ]" when talking about a supported feature of a popular product reassuring, there's always a somebody or the feature would have been removed since it costs money to support and maintain it.