from Hacker News

New malware abuses Microsoft IIS feature to establish backdoor

by xook on 2/16/23, 10:16 PM with 59 comments

• by jimbobimbo on 2/16/23, 11:51 PM

  FTA: "In order to use this technique, an attacker needs to gain access to the Windows system running the IIS server by some other means. In this particular case, it is unclear how this access was achieved."

  See also "It rather involved being on the other side of this airtight hatchway" series by Raymond Chen:

  https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10...

  https://devblogs.microsoft.com/oldnewthing/20211207-00/?p=10...

• by Dwedit on 2/17/23, 3:22 AM

  So in other words, this is something that someone has to run on the computer, then it injects itself into IIS. Not a remote vulnerability, just an entry point for monitoring HTTP requests once you have code execution in there.

• by sublinear on 2/16/23, 11:07 PM

  People use IIS?

• by danielodievich on 2/17/23, 1:47 AM

  Nobody sane runs FREB at full prod load on public sites. It's not installed by default. It is highly useful for troubleshooting but not at production traffic. Seems like if you're inside IIS already by some mystic hack you already own the space.

• by greatgib on 2/18/23, 11:41 AM

  It's 2023, if you are still using IIS you are highly incompetent and you deserved to be rooted...