Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New malware abuses Microsoft IIS feature to establish backdoor

symantec-enterprise-blogs.security.com

Post reply on HN
Print view View original

41–50 of 62 posts

Re: New malware abuses Microsoft IIS feature to establish backdoor

#41

Post by DoctorOW »

Someone1234 wrote: post #22
tenebrisalietum wrote: post #7

Earlier quoted context omitted.

I think Stackexchange does.

In 2009, they certainly did. Since then, they migrated to .Net "Core"[0] which can run on any OS/web-server. Per [0] they initially kept IIS, but once you're on .Net Core+ that certainly isn't a requirement and there may be good licensing or performance reasons to migrate (even with headless Windows Server/IIS). I did find an article from last year that said they still had a monolithic architecture and were still on-…

They're hiring people with Windows Server experience. They're at the very least somewhat IIS.

Source: https://stackoverflow.co/company/work-here/4866168

Re: New malware abuses Microsoft IIS feature to establish backdoor

#42

Post by the8472 »

jiggawatts wrote: post #31
pram wrote: post #27

Earlier quoted context omitted.

Unironically: the fact that Microsoft has spent millions of man-hours building a complete alternative server ecosystem to UNIX/Linux continually blows my mind. Web servers, containers, virtualization, databases, languages, automation, security, etc. It's like NIH maximalism.

Conversely, from the perspective of people that started with computers in the 1990s, it's bizarre how Linux keeps failing to copy Windows. At one point something like 95% of PCs were Windows, and the rest were mostly Apple Macs. Similarly in the server space, you would be surprised to hear that the majority of servers were Windows for quite a while. Note that I didn't say web servers , because not all the world is HT…

> There is still no equivalent to Microsoft Exchange, Group Policy, Enterprise PKI, and a bunch of other things in the Linux world.

Which also means fewer attack vectors.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#43

Post by bilekas »

jimbobimbo wrote: post #5

FTA: "In order to use this technique, an attacker needs to gain access to the Windows system running the IIS server by some other means. In this particular case, it is unclear how this access was achieved." See also "It rather involved being on the other side of this airtight hatchway" series by Raymond Chen: https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20…

This.. As far as I see it, if there is already access to the machine, all bets are off.

However in fairness they didn't say it was an exploit more that it's just a stealthy 'clever' malware.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#44

Post by msm_ »

gerdesj wrote: post #18
jimbobimbo wrote: post #5

FTA: "In order to use this technique, an attacker needs to gain access to the Windows system running the IIS server by some other means. In this particular case, it is unclear how this access was achieved." See also "It rather involved being on the other side of this airtight hatchway" series by Raymond Chen: https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20…

"it is unclear how this access was achieved" Not a good line in a write up like this. Windows does write n store an awful lot of logs by default. However thanks to circular logging with log sizes from the 1990s on critical logs, you can easily lose information. I can't remember what the defaults are (connects to 2016 AD DC) ... 20Mb for %SystemRoot%\System32\Winevt\Logs\Security.evtx . On a tiddly setup like mine (20…

Analyses like this are not usually performed by insiders. People that write them are external researchers (in this case, Symantec's) that have limited (or zero) insight into actual logs on the target system. There is some coordination with the attacked organisation, but requesting "please find the attack vector for us" or "just send us all your logs" is out of the question. So, unless the attack is really high profile, sometimes it's easier to just accept that you don't know something.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#45

Post by msm_ »

Dylan16807 wrote: post #33
gerdesj wrote: post #18

Earlier quoted context omitted.

"it is unclear how this access was achieved" Not a good line in a write up like this. Windows does write n store an awful lot of logs by default. However thanks to circular logging with log sizes from the 1990s on critical logs, you can easily lose information. I can't remember what the defaults are (connects to 2016 AD DC) ... 20Mb for %SystemRoot%\System32\Winevt\Logs\Security.evtx . On a tiddly setup like mine (20…

My desktop has a 20MB security log that goes back 16 days, which seems like enough. If anything, stop spamming tens to hundreds of duplicate messages when credentials are read or group membership is enumerated. System has 8 months, application has 10 months, and setup has 26 months.

It's absolutely not enough for APT investigation. Average attacks lengths are in months, infections sometimes span multiple years. Especially since we're talking about a backdoor (ransomware operators tend to move more quickly)

Re: New malware abuses Microsoft IIS feature to establish backdoor

#46

Post by rbanffy »

CompuHacker wrote: post #3
sublinear wrote: post #2

People use IIS?

Yeah! I run an unpatched IIS FTP server on Windows 10 from 2016. When FileZilla stopped connecting to it for reasons I can't even imagine, I enabled SSL using some slightly modified arcane commands I found on a forum post from 2011 to generate a self-signed certificate, convert it between two different formats, and finally use it to accept connections from only some of the still available FTP clients for Windows, whi…

I hope this is humor. I really do.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#47

Post by adolfojp »

pram wrote: post #27
sublinear wrote: post #2

People use IIS?

Unironically: the fact that Microsoft has spent millions of man-hours building a complete alternative server ecosystem to UNIX/Linux continually blows my mind. Web servers, containers, virtualization, databases, languages, automation, security, etc. It's like NIH maximalism.

>It's like NIH maximalism.

UNIX was not an option for most people which is one of the reasons why NT killed the Unix workstation market and Microsoft software like IIS, MS SQL and Exchange was already established when Linux gained mainstream adoption.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#49

Post by rbanffy »

joenathanone wrote: post #12
sublinear wrote: post #2

People use IIS?

What's wrong with using IIS?

It really depends on your use.

If you already paid for your Windows license, not that much. The way it ties into the OS is a bit concerning to me but, apart from that, it's OK.

I think the question can be formulated in a different way: what's RIGHT with using IIS? What does IIS offer you that other web servers don't? Easy AD integration is the one thing that crosses my mind, and I can't think of anything else besides "it's already there".

If you plan on scaling out, however, licensing costs will grow quickly. If you run .NET Core apps, the built-in HTTP server is very fast and runs on Linux as well. Same story with Spring apps - using Netty/Jetty or even Tomcat is easy and makes your app very self-contained.

I think the big nope for me is that it is from the "Pets" era, before servers were "cattle", which was compounded by containerization and tools like Kubernetes and OpenShift. IIS just doesn't look like it fits into that new model.

Re: New malware abuses Microsoft IIS feature to establish backdoor

#50

Post by avidphantasm »

jiggawatts wrote: post #31
pram wrote: post #27

Earlier quoted context omitted.

Unironically: the fact that Microsoft has spent millions of man-hours building a complete alternative server ecosystem to UNIX/Linux continually blows my mind. Web servers, containers, virtualization, databases, languages, automation, security, etc. It's like NIH maximalism.

Conversely, from the perspective of people that started with computers in the 1990s, it's bizarre how Linux keeps failing to copy Windows. At one point something like 95% of PCs were Windows, and the rest were mostly Apple Macs. Similarly in the server space, you would be surprised to hear that the majority of servers were Windows for quite a while. Note that I didn't say web servers , because not all the world is HT…

Not sure about the numbers, but there were also A LOT of NetWare servers serving Windows (and Mac) clients back in the day.
Post reply on HN