Security

Ask something
Discussion Locked

Maybe new IIS web server exploit???

0 helpful
1 reply

by joseph moore

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Saw this article on MSN a short time ago:
http://tinyurl.com/2t3xl
"Government and industry experts warned late Thursday of a mysterious, large-scale Internet attack against thousands of popular Web sites. The virus-like infection tries to implant hacker software onto the computers of all Web site visitors.
" Industry experts and the Homeland Security Department were studying the infection to determine how it spreads across Web sites and find adequate defenses against it.
''Users should be aware that any Web site, even those that may be trusted by the user, may be affected by this activity and thus contain potentially malicious code,'' the government warned in one Internet alert.
"The mysterious infection appeared to target at least one recent version of software by Microsoft Corp. to operate Web sites, called its Internet Information Server, popular among businesses and organizations."
(story by the Associated Press)

The SANS Internet Storm Center was talking about this today also:
http://isc.sans.org/diary.php?date=2004-06-24

I'm concerned. Sure, the MSN article does sound a little exaggerated, but there could be something to this. Maybe??? I've checked my IIS web servers, and there OK. I'm gonna keep an eye on them over the night (it's almost 10PM CST Thursday night right now).

Anyway, I hope this comes out to be nothing.....

1 reply

by joseph moore

http://tinyurl.com/258ua

That link will take you to the Google portal for a USENET discussion of this at microsoft.public.inetserver.iis.security

Now, I can't seem to get it to link to the 1st post in the thread; it takes you to post #19. Let me warn you on something these posts:

DON'T VIEW THEM IN "ORIGINAL FORMAT"!!!!

The exploit code that will download and run the trojan file is posted in this USENET forum. The fools actually posted the Javascript code from their compromised IIS web servers!

If you view the posts in "original format", then it will try and download the trojan file onto your computer! My XP box is fully patched, but this Javascript exploit has no fix currently, so it did try and download/install the trojan. Symantec caught it, luckily!!!

But there were 19 posts (as of this writing) with people with infected IIS web servers that had this Javascript being presented to their clients when they browsed their web server.

This discussion is closed to new replies.