FBI shuts down malware on hundreds of Exchange servers, opens Pandora’s box

A rather remarkable story has emerged, setting the scene for lively debates about permissible system access. A press release from the US Department of Justice Judge has revealed that the FBI were granted permission to perform some tech support backdoor removal. Bizarrely, they did this without letting the admins know beforehand.

A campaign targeting vulnerable Exchange servers has left web shells scattered everywhere. Those shells are backdoors. They allow attackers to access and creep around inside the compromised networks. Additionally, it seems that not all shells were properly locked down. They fell foul to password reuse. This means criminals figuring out the passwords to other criminals’ web shells could also potentially access the compromised servers. Having those shells lying around on systems for such a long time isn’t a great thing to happen.

When calls to fix systems go unheeded

Despite repeated warnings, and even one-click tools from Microsoft aiming to mitigate the issue, and no small amount of patching, some vulnerable servers remained. Some organisations missed or ignored the mass-massaging about the threat. Or perhaps they just didn’t know what to do to fix the problem. It’s likely that some also patched the vulnerability without also finding and removing the web shells.

This means lots of compromised exchange servers all over the place, just waiting for illicit access to begin all over again. What do you do in this situation? We’ll get to that but before we do, let’s talk about the perils of getting involved in situations. Any situation.

Getting involved in situations. Any situation.

People love to help. Members of the public often get involved in security issues alongside professional researchers and organisations. They may give tip-offs, or send files over, and most commonly, do some work in anti-phishing. It’s fairly easy to do, has a steady stream of ready-made content in their mailboxes to check out, and there’s a lot of places to report it to.

The problem is when individuals who mean well take it a step further without taking appropriate security measures. For example, a popular past time is filling up phish pages with bogus data. This is done to slow down phishers by making their data worthless. If folks aren’t careful, issues can arise.

At the extreme end, the same goes for vigilante style takedown tactics / breaking into servers / deleting data or “hacking back”. It might feel good to wipe large quantities of illegal content from a server you’ve taken control of which belongs to very bad people. But the law of unintended consequences has a way of biting the hand that feeds it. Even if your commands have exactly the effect you expect (and how often does that happen?), in one fell swoop you may have ruined an already ongoing law enforcement investigation, scrubbed the evidence needed to put someone in jail, and now you’re on the wanted list for breaking into a server and doing things you shouldn’t have been.

When the golden rule is broken

The golden “don’t do this” rule is “don’t touch servers and devices you have no permission to access”. It’s a great rule and helps keep people from getting into trouble, and it’s the backbone of computer misuse laws in both the US and the UK.

Where it gets a bit less clear, is when law enforcement agencies are granted permission from a Judge to access previously compromised servers and change things (in this case by deleting web shells). As per the release:

“the FBI conducted the removal by issuing a command through the web shell to the server, which was designed to cause the server to delete only the web shell (identified by its unique file path).”

The release mentions that “hundreds” of vulnerable computers had shells removed. These removals were done upfront with no knowledge of the system owners beforehand, according to the below:

The FBI is attempting to provide notice of the court-authorized operation to all owners or operators of the computers from which it removed the hacking group’s web shells. For those victims with publicly available contact information, the FBI will send an e-mail message from an official FBI e-mail account (@FBI.gov) notifying the victim of the search. For those victims whose contact information is not publicly available, the FBI will send an e-mail message from the same FBI e-mail account to providers (such as a victim’s ISP) who are believed to have that contact information and ask them to provide notice to the victim.

You weren’t home, so we left a message…sort of

It is rather alarming to think that a chunk of these system owners will probably go about their business for years to come with no idea the FBI stopped by to do a bit of digital tidying up. We also wonder how realistic it is to think ISPs will actually do some outreach. Even if they do, the business owners may think the mails are fake. Perhaps they’ll accept them as real, but still have no idea what to do about it. It’s surely unrealistic to think the ISPs will be able to take on an intermediary tech support role in all of this. If the goal is to have ISPs tell affected organisations to get in touch with the FBI directly, that’s still dependent on the victim not ignoring the ISP in the first place.

However you stack it up, it’s a bit of a mess.

“New” changes, a long time coming

The FBI requested a rule change for expanded access powers back in 2014, and it was granted in 2016. Essentially, we’ve known this would happen for some time but perhaps didn’t know quite what form it would take. While coverage of the proposed powers focused on “hacking” systems and talking about the issue in terms of offensive / surveillance capabilities, what we’ve ended up with is something a little different.

At the very least, I don’t think many expected the breakthrough story would be “they cleaned up compromised devices”. The question is, have we seen the opening of a Pandora’s box which really should have stayed shut?

General approval or generally derided?

Many of the arguments against this practice say there’s no real way to know if anything else on the servers was accessed or changed. There’s also the problem that solutions like this tend to breed their own additional complications. Just wait until scammers start pushing “FBI access required: problem detected” messages. It’ll be like the bad old days of fake antivirus pop-ups, except now the law enforcement mentioned is offering to help instead of send you to jail.

On the other hand: despite everyone’s best efforts to notify infected organisations and a massive splash of mainstream media coverage, it’s likely that lots of systems would simply have stayed compromised for a very long time to come if the FBI hadn’t done this. And it isn’t just the organisation that’s targeted that suffers, it’s everyone who depends on that organisation, and everyone who becomes a victim if the compromised system is used to launch further attacks.

So, where does the buck stop, and who specifically is going to stop it? Do you think this was a justified action? Is it acceptable in the most dire of situations, where no help is coming? Does it pave the way for overreach and the feeling your devices are under fire from all quarters?

We’d love to know what you think in the comments.

The post FBI shuts down malware on hundreds of Exchange servers, opens Pandora’s box appeared first on Malwarebytes Labs.