Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New malware abuses Microsoft IIS feature to establish backdoor

symantec-enterprise-blogs.security.com

Post reply on HN
Print view View original

31–40 of 62 posts

Re: New malware abuses Microsoft IIS feature to establish backdoor

#31

Post by jiggawatts »

pram wrote: post #27
sublinear wrote: post #2

People use IIS?

Unironically: the fact that Microsoft has spent millions of man-hours building a complete alternative server ecosystem to UNIX/Linux continually blows my mind. Web servers, containers, virtualization, databases, languages, automation, security, etc. It's like NIH maximalism.

Conversely, from the perspective of people that started with computers in the 1990s, it's bizarre how Linux keeps failing to copy Windows. At one point something like 95% of PCs were Windows, and the rest were mostly Apple Macs. Similarly in the server space, you would be surprised to hear that the majority of servers were Windows for quite a while. Note that I didn't say web servers, because not all the world is HTTP.

There is still no equivalent to Microsoft Exchange, Group Policy, Enterprise PKI, and a bunch of other things in the Linux world. SAMBA copies Active Directory, but it's a direct clone, not a unique product.

Not to mention that SQL Server isn't somehow "copying" UNIX. Its performance and feature set blows most of the open-source databases out of the water, with only Postgres having superior features (but not performance).

Microsoft essentially invented OLAP with SQL Analysis Services, and they still have the most popular products in that space, such as Power BI.

Etc...

Re: New malware abuses Microsoft IIS feature to establish backdoor

#33

Post by Dylan16807 »

gerdesj wrote: post #18
jimbobimbo wrote: post #5

FTA: "In order to use this technique, an attacker needs to gain access to the Windows system running the IIS server by some other means. In this particular case, it is unclear how this access was achieved." See also "It rather involved being on the other side of this airtight hatchway" series by Raymond Chen: https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20…

"it is unclear how this access was achieved" Not a good line in a write up like this. Windows does write n store an awful lot of logs by default. However thanks to circular logging with log sizes from the 1990s on critical logs, you can easily lose information. I can't remember what the defaults are (connects to 2016 AD DC) ... 20Mb for %SystemRoot%\System32\Winevt\Logs\Security.evtx . On a tiddly setup like mine (20…

My desktop has a 20MB security log that goes back 16 days, which seems like enough. If anything, stop spamming tens to hundreds of duplicate messages when credentials are read or group membership is enumerated.

System has 8 months, application has 10 months, and setup has 26 months.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#35

Post by tester756 »

jiggawatts wrote: post #31
pram wrote: post #27

Earlier quoted context omitted.

Unironically: the fact that Microsoft has spent millions of man-hours building a complete alternative server ecosystem to UNIX/Linux continually blows my mind. Web servers, containers, virtualization, databases, languages, automation, security, etc. It's like NIH maximalism.

Conversely, from the perspective of people that started with computers in the 1990s, it's bizarre how Linux keeps failing to copy Windows. At one point something like 95% of PCs were Windows, and the rest were mostly Apple Macs. Similarly in the server space, you would be surprised to hear that the majority of servers were Windows for quite a while. Note that I didn't say web servers , because not all the world is HT…

>Not to mention that SQL Server isn't somehow "copying" UNIX. Its performance and feature set blows most of the open-source databases out of the water, with only Postgres having superior features (but not performance).

The tooling around SQL Server is decent

Re: New malware abuses Microsoft IIS feature to establish backdoor

#37

Post by unxdfa »

sublinear wrote: post #2

People use IIS?

Yes. It’s pretty unavoidable if you have the usual corporate behemoth ASP.Net ball and chain which has been dragged along begrudgingly for the last 20 years. And no it’s not going to be ported to .Net Core for ages because it has some proprietary component or library plugged into it and the vendor ceased to exist ten years ago and your entire business relies on it being patched by a involuntary black hat with mono Cecil to remove the licensing code. Plus everyone who wrote it is either dead or left so even small changes require a week of reverse engineering.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#38

Post by pram »

jiggawatts wrote: post #31
pram wrote: post #27

Earlier quoted context omitted.

Unironically: the fact that Microsoft has spent millions of man-hours building a complete alternative server ecosystem to UNIX/Linux continually blows my mind. Web servers, containers, virtualization, databases, languages, automation, security, etc. It's like NIH maximalism.

Conversely, from the perspective of people that started with computers in the 1990s, it's bizarre how Linux keeps failing to copy Windows. At one point something like 95% of PCs were Windows, and the rest were mostly Apple Macs. Similarly in the server space, you would be surprised to hear that the majority of servers were Windows for quite a while. Note that I didn't say web servers , because not all the world is HT…

If we're talking about the 1990s, SQL Server/Sybase ran on UNIX. Not to mention it's just a fork of Ingres lol

Re: New malware abuses Microsoft IIS feature to establish backdoor

#40

Post by louthy »

alexjplant wrote: post #28
louthy wrote: post #14

Earlier quoted context omitted.

Nothing, it’s just standard tech snobbery

It's snobbery to have an opinion? In terms of both static and application web servers I've personally administered nginx, Apache, IIS, Tomcat, Wildfly and Websphere and mention them here in descending order of preference with regard to capability and DX. As you can see IIS falls squarely in the middle of the pack and is actually a distant third in my opinion. The only compelling reason to use it a decade ago was to h…

> It's snobbery to have an opinion?

Of course not and I didn't say any such thing. The original comment "People use IIS?" is clearly a passive-aggressive dig at MS, its tech, and those that use it (as is so often the case in tech circles). It's quite pathetic and childish. If I misunderstood that, then I apologise to the author, but I'd argue it still adds nothing to the discourse even if it was asked honestly.

It doesn't mean you can't hold an opinion on the relative merits of any one piece of tech. But this "my computer is better than your computer" immature schoolboy nonsense is pervasive in tech circles and is extremely tedious.

I have no love for IIS, but it's a perfectly capable webserver and is clearly still used. The idea that the .NET world have all moved over to .NET Core is also a wishful one unfortunately, I still maintain my open-source libraries for the legacy framework as I know there's plenty of places that can't just 'flip the switch' to .NET Core. It's not quite as bad as Python's V3 moment, but it's up there.

Post reply on HN