New malware abuses Microsoft IIS feature to establish backdoor
symantec-enterprise-blogs.security.com
New malware abuses Microsoft IIS feature to establish backdoor
1–10 of 62 posts
Re: New malware abuses Microsoft IIS feature to establish backdoor
#2People use IIS?
Re: New malware abuses Microsoft IIS feature to establish backdoor
#3People use IIS?
Yeah! I run an unpatched IIS FTP server on Windows 10 from 2016. When FileZilla stopped connecting to it for reasons I can't even imagine, I enabled SSL using some slightly modified arcane commands I found on a forum post from 2011 to generate a self-signed certificate, convert it between two different formats, and finally use it to accept connections from only some of the still available FTP clients for Windows, which excluded Windows Explorer, but only some of the time.
Why, should I not be using IIS?
Re: New malware abuses Microsoft IIS feature to establish backdoor
#4[flagged]
Re: New malware abuses Microsoft IIS feature to establish backdoor
#5FTA: "In order to use this technique, an attacker needs to gain access to the Windows system running the IIS server by some other means. In this particular case, it is unclear how this access was achieved."
See also "It rather involved being on the other side of this airtight hatchway" series by Raymond Chen:
https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10...
https://devblogs.microsoft.com/oldnewthing/20211207-00/?p=10...
Re: New malware abuses Microsoft IIS feature to establish backdoor
#6People use IIS?
Even worse, some companies choose to ship software that require the use of IIS.
Re: New malware abuses Microsoft IIS feature to establish backdoor
#7People use IIS?
I think Stackexchange does.
Re: New malware abuses Microsoft IIS feature to establish backdoor
#8People use IIS?
Yep. From what I've seen, usually it's a case of a company building something which uses it a long time ago, and not bothering to switch to an alternative because 'If it works don't fix it'. It may not be the newest and shiniest, but if it's working well then no need to move to something else.
Re: New malware abuses Microsoft IIS feature to establish backdoor
#9People use IIS?
CarbonBlack App Control required it as of 2021 I believe.
Re: New malware abuses Microsoft IIS feature to establish backdoor
#10People use IIS?
Yeah! I run an unpatched IIS FTP server on Windows 10 from 2016. When FileZilla stopped connecting to it for reasons I can't even imagine, I enabled SSL using some slightly modified arcane commands I found on a forum post from 2011 to generate a self-signed certificate, convert it between two different formats, and finally use it to accept connections from only some of the still available FTP clients for Windows, whi…
Ahhh - hello DevOps!