Data-stealing malware pretends to be Microsoft IIS server module

Trustwave’s SpiderLabs researchers have found a piece of malware that collects data entered into Web-based forms, pretending to be a module for Microsoft’s Internet Information Services (IIS) web-hosting software.

The malware, which is dubbed “ISN,” hasn’t been widely seen, but its characteristics are interesting, wrote Josh Grunzweig, a Trustwave malware researcher, on a company blog.

ISN is a malicious DLL (dynamic link library), which is installed as a module for IIS, Grunzweig wrote. ISN’s installer contains four versions of the DLL, one of which is served up depending on whether a victim uses the 32- or 64-bit version of IIS6 or IIS7+.

”This module is of particular concern as it is currently undetectable by almost all anti-virus products,” Grunzweig wrote.

If ISN’s installer is detected, it’s usually through “general heuristic detection,” Grunzweig wrote, which means security software is looking at aspects of it that are suspicious and flagging it, such as if it is sending data to another server.

”I’m using this post as a way of notifying anti-virus vendors so that specific detections for this malware may be written,” he wrote, adding that he thinks the malware is “pretty neat.”

via Data-stealing malware pretends to be Microsoft IIS server module | PCWorld.

———————————————-

Journal of Law & Cyber Warfare | www.jlcw.org The Journal of Law & Cyber Warfare provides a public peer-reviewed law publication to foster open discussion and education of technology, government and legal stakeholder in relation to the complex issue of cyber warfare.  Journal of Law & Cyber Warfare accepts articles written by military, technology, judges, government officials, academic and legal practitioners.  The Journal of Law & Cyber Warfare provides a public peer-reviewed law publication to foster open discussion and education of technology, government and legal stakeholder in relation to the complex issue of cyber warfare.  Journal of Law & Cyber Warfare accepts articles written by military, technology, judges, government officials, academic and legal practitioners. The Journal of Law & Cyber Warfare is honored by the world class caliber editorial board that is involved with the Journal. Thought leaders from forensics, law, warfare, and cyber security are on the Board. The Journal is always looking for interested thought leaders who believe they can contribute in a meaningful fashion to the development of cyber warfare scholarship.