Forum Moderators: open
“Today’s court-authorized removal of the malicious web shells demonstrates the Department’s commitment to disrupt hacking activity using all of our legal tools, not just prosecutions,” said Assistant Attorney General John C. Demers for the Justice Department’s National Security Division. “Combined with the private sector’s and other government agencies’ efforts to date, including the release of detection tools and patches, we are together showing the strength that public-private partnership brings to our country’s cybersecurity. There’s no doubt that more work remains to be done, but let there also be no doubt that the Department is committed to playing its integral and necessary role in such efforts.”
The FBI conducted the removal by issuing a command through the web shell to the server, which was designed to cause the server to delete only the web shell (identified by its unique file path). (...) This operation was successful in copying and removing those web shells. However, it did not patch any Microsoft Exchange Server zero-day vulnerabilities or search for or remove any additional malware or hacking tools that hacking groups may have placed on victim networks by exploiting the web shells.So basically the FBI was using the remote access functionality of one variety of malware to remove that specific malware. But they didn't patch the security issue in Exchange. That means that un-patched Exchange installations are still vulnerable for new attacks. And nothing changed for those who have been infected by other hacker groups.
The National Security Agency (NSA) said Tuesday that it had alerted Microsoft to "a series of critical vulnerabilities" in the Microsoft Exchange email application, prompting the company to issue a new patch.
In a blog post, Microsoft said it had "not seen" the vulnerabilities used against its customers, but urged users to install timely updates.
So basically the FBI was using the remote access functionality of one variety of malware to remove that specific malware. But they didn't patch the security issue in Exchange.
