Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New malware abuses Microsoft IIS feature to establish backdoor

symantec-enterprise-blogs.security.com

Post reply on HN
Print view View original

21–30 of 62 posts

Re: New malware abuses Microsoft IIS feature to establish backdoor

#21

Post by doubleg72 »

CompuHacker wrote: post #3
sublinear wrote: post #2

People use IIS?

Yeah! I run an unpatched IIS FTP server on Windows 10 from 2016. When FileZilla stopped connecting to it for reasons I can't even imagine, I enabled SSL using some slightly modified arcane commands I found on a forum post from 2011 to generate a self-signed certificate, convert it between two different formats, and finally use it to accept connections from only some of the still available FTP clients for Windows, whi…

Arcane commands? Sounds like a fairly typical process to me, and a fairly typical use case. We do something similar with our Avaya CM and phone configuration and backups.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#22

Post by Someone1234 »

tenebrisalietum wrote: post #7
sublinear wrote: post #2

People use IIS?

I think Stackexchange does.

In 2009, they certainly did.

Since then, they migrated to .Net "Core"[0] which can run on any OS/web-server. Per [0] they initially kept IIS, but once you're on .Net Core+ that certainly isn't a requirement and there may be good licensing or performance reasons to migrate (even with headless Windows Server/IIS).

I did find an article from last year that said they still had a monolithic architecture and were still on-prem (as opposed to cloud/Azure). So, maybe, still on IIS? They certainly did for YEARS.

[0] https://www.infoq.com/news/2020/04/Stack-Overflow-New-Archit...

Re: New malware abuses Microsoft IIS feature to establish backdoor

#23

Post by throwanem »

gerdesj wrote: post #15
joenathanone wrote: post #12

Earlier quoted context omitted.

What's wrong with using IIS?

Nothing at all. It is an extremely capable webserver. In common with all web servers, advice found via search varies in quality and unfortunately, being Windows based: IIS really suffers. The GUI is pretty intimidating (IIS Manager - both of them) and there are things that can only be done via registry, config files and dark magic. IIS gets a lot of undeserved stick in my opinion.

You're not really making a strong case here for that "undeserved".

Re: New malware abuses Microsoft IIS feature to establish backdoor

#24

Post by tbrownaw »

jimbobimbo wrote: post #5

FTA: "In order to use this technique, an attacker needs to gain access to the Windows system running the IIS server by some other means. In this particular case, it is unclear how this access was achieved." See also "It rather involved being on the other side of this airtight hatchway" series by Raymond Chen: https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20…

But I don't see this being presented as a way to break in. I'd presented as a way to be sneaky about listening for commands once you're already in.

The "airtight hatchway" series is about things being presented as ways to break in, when they actually require you to already be in.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#26

Post by calvinmorrison »

robotnikman wrote: post #8
sublinear wrote: post #2

People use IIS?

Yep. From what I've seen, usually it's a case of a company building something which uses it a long time ago, and not bothering to switch to an alternative because 'If it works don't fix it'. It may not be the newest and shiniest, but if it's working well then no need to move to something else.

And here's a great point to install a proxy web server like nginx, add rate limiting, filtering, whatever you want, at least the ancient IIS/whatever http server is not publically facing

Re: New malware abuses Microsoft IIS feature to establish backdoor

#27

Post by pram »

sublinear wrote: post #2

People use IIS?

Unironically: the fact that Microsoft has spent millions of man-hours building a complete alternative server ecosystem to UNIX/Linux continually blows my mind. Web servers, containers, virtualization, databases, languages, automation, security, etc. It's like NIH maximalism.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#28

Post by alexjplant »

louthy wrote: post #14
joenathanone wrote: post #12

Earlier quoted context omitted.

What's wrong with using IIS?

Nothing, it’s just standard tech snobbery

It's snobbery to have an opinion? In terms of both static and application web servers I've personally administered nginx, Apache, IIS, Tomcat, Wildfly and Websphere and mention them here in descending order of preference with regard to capability and DX. As you can see IIS falls squarely in the middle of the pack and is actually a distant third in my opinion. The only compelling reason to use it a decade ago was to host .NET applications in an officially-supported manner (and even then it meant contending with licensing, weird logging behavior, arcane MMC-controlled XML-based configuration, Windows Server itself, etc). In the age of .NET Core there's no reason at all.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#30

Post by sebazzz »

ocdtrekkie wrote: post #19
sublinear wrote: post #2

People use IIS?

It's usually the right choice if the software runs on a Windows host. Why add a whole bunch of third party problems on top? A lot of enterprise software is built in .NET for Windows, and as the expectation of web-based UIs for said software has increased... honestly I'd be surprised if IIS usage wasn't increasing in overall uses (though not in market share, for certain).

OP is obviously in some kind of bubble. IIS isn't as used as much as it used to be but it is still used a lot and not the COBOL of Web servers.
Post reply on HN