The Web attack that was stopped dead in its tracks on Friday when a Russian Web site was taken offline remained under investigation Monday by a host of security firms still puzzled over the method used to infect a number of Microsoft Internet Information Services servers.
But the evidence now is leading them to accept Microsoft's explanation that the IIS 5.0 servers were hacked manually and that the server software doesn't have an unknown vulnerability.
"Nobody yet knows how these servers were infected," said Ken Dunham, director of malicious code research at iDefense. "But if it was a widespread vulnerability, how come there weren't more servers infected? If that was the case, we should have heard reports by now about lots of other computers" being infected with the malicious JavaScript code.
Microsoft released a statement Saturday claiming that the attack--which infected an unknown number of IIS servers, which, in turn, delivered malicious code to any Internet Explorer user who surfed sites hosted by those servers--"is not a worm or virus. In other words, this attack is a targeted manual attack by individuals or entities towards a specific server."
Symantec's Corp.'s research, said Oliver Friedrichs, a senior manager with the company's virus response team, also leans toward manual hacks. "That's what it looks like," he said. "It's certainly not a worm or an automated exploit."
Microsoft said that all the compromised servers were running IIS 5.0 unpatched against a vulnerability disclosed in April. Some security firms last week theorized that even patched IIS systems were vulnerable, but that now seems to have been a false alarm.
To realize the benefits of cloud-native software, an application must actually be cloud-native—designed to run in the cloud, interacting with disaggregated cloud services, fully manageable as code—to deliver the expected benefits.
By combining resources and expertise, the AI-Enabled ICT Workforce Consortium will offer a blueprint for how industries can adapt to an AI-dominated future.
IT leaders should heed the guidance of cybersecurity insurance providers who think businesses should prioritize security education, incident preparedness, regular internal audits, and ongoing vulnerability scanning and patching.
