Microsoft urges patch application to fight IIS threat

Microsoft is telling systems administrators to make sure they have installed a previously announced patch to guard against security problems currently affecting Web sites using the company's Internet Information Services (IIS) 5.0 server.

According to an advisory released by Microsoft, companies that haven't yet installed Update 835732 detailed in Microsoft Security Bulletin MS04-011 appear to be at risk from the ongoing attack.

Users who have already deployed Windows XP Service Pack 2 RC2 appear to be protected, the company said.

The Microsoft advisory is in response to what appears to be a continuing attack against IIS 5.0 servers worldwide. The attack, first discovered yesterday by several security firms, involved a group of Russian hackers breaking into Web sites running IIS 5.0.

Stephen Toulouse, program manager at Microsoft's security response center, said the software vendor began investigating the problem after being told about it last night by customers.

All early indications point to IIS 5.0 servers being affected, he said, although Microsoft hasn't yet positively identified the flaw being exploited. Evidence so far suggests that the attackers are breaking into IIS servers via a previously disclosed buffer-overrun problem in the Private Communications Transport protocol, which is part of the Microsoft Secure Sockets Layer library.

That problem was addressed with the MS04-011 patch, which is why Microsoft recommends that users install it, he said.

Meanwhile, desktop systems can be infected via two vulnerabilities in Internet Explorer, one of which has an available patch and one that doesn't, Toulouse said.

Microsoft is working on a patch for the problem, Toulouse said, without specifying when the company might have one ready. But users who keep their systems updated with the latest antivirus patches or have the high-security setting turned on while browsing the Internet should be reasonably protected, he said.

Following Microsoft's advice would be a "prudent thing to do" for now, said Marty Lidner, an incident-handling team leader at the CERT Coordination Center at Carnegie Mellon University in Pittsburgh.

It would also be smart for administrators running IIS 5.0 to ensure there is no unusual JavaScript code appended to the bottom of the Web pages served up by their sites, said Russ Cooper, editor of "NT Bugtraq" and an analyst at Herndon, TruSecure.

He also urged them to "check to see if you have document footers enabled when they are not supposed to be."

According to an advisory by Computer Associates International, a Trojan horse program named JS. Toofer or JS. Scrob is installed on vulnerable IIS servers. When executed, this JavaScript attempts to access a file hosted on another server. When users visit compromised Web sites, their systems are directed by Scrob to download a file containing malicious code such as Trojan horses and keystroke loggers from a Russian Web site.

"IIS servers are first compromised and then configured to host malicious JavaScript in the footer of Web pages hosted on the server," Ken Dunham, director of malicious code at iDefense, said in a note earlier Friday. "End users simply surf Web sites hosted by the IIS server and get infected with additional malicious code."

Rather than being an attack targeted at specific sites, this appears to be an attempt by the hackers to find any vulnerable IIS server they can break into, Cooper said.

"My belief is that the attackers were trying to do this very quietly maybe using bots," he said. "They didn't really care what IIS boxes were getting compromised."

Confusion remains over how widespread the infections are. According to Lidner, CERT found infections on about 100 Web sites of varying sizes yesterday and informed their operators of the problem. But many other Web sites are likely to be infected that CERT is unaware of, he said.

The number also doesn't include end-user systems that may have been compromised from visiting infected Web sites.

According to Dunham, "hundreds of thousands" of computers are likely to have been infected in the past 24 hours.

As of this afternoon, the infection doesn't appear to have affected overall Internet performance, according to Keynote Systems, a Web performance measurement and management firm. "The Keynote Business 40 Internet Performance Index is not showing any performance or availability problems at this time for the Internet's top Web sites," the company said Friday.

The Russian Web site being used to download malicious code to infected systems is also no longer available, either as a result of law-enforcement action or because the hackers have been scared away, Lidner said. That fact alone makes the threat less potent for the moment, he said.

The incident once again serves to demonstrate the need for due diligence when it comes to security, Lidner said. "This stuff happens all the time. People tend to lose sight of that," he said.

Last September, for instance, a security breach at Atlanta-based Web hosting provider Interland Inc. resulted malicious code being appended to the bottom of Web pages hosted on the company's servers. As with the current threat, end users that visited infected Interland-hosted sites faced the risk of malicious code being downloaded on their systems from a Russian Web site.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jaikumar Vijayan

Show Comments



Victorinox Werks Professional Executive 17 Laptop Case

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?