Anti-Malware and Patching

On March 2, 2021, Microsoft released emergency fixes for four flaws in Exchange Server, the program many companies, schools, and towns run on their own computers to handle their email. Used together, the flaws gave anyone on the internet who could reach an Exchange server control of it, with no account and no password. Microsoft blamed a group based in China, which it called Hafnium. Security researchers traced Hafnium's attacks back to early January, against a small number of targets, weeks before any fix existed. The United States and its allies went further in July 2021, saying hackers working for China's Ministry of State Security had carried out the January attacks.

Other groups had the attack too, some in the last days of February, before the fixes came out. Once the fixes were public, many more joined, scanning the whole internet for Exchange servers that hadn't been updated yet. On each server they broke into, they usually left a web shell: a small file in the server's web folder that answers commands sent from a browser, so that they could come back later.

Suppose a school district installed the patches on March 9, a week after they came out. What did that do for its Exchange server, and what didn't it do?

The patch closed the four flaws, so from March 9 on nobody could break in through them. But the patch only changed Exchange; it didn't look for anything already left on the server. If someone had broken in before the patch went on, during that week or in the weeks of attacks before the fixes existed, their web shell was still in the web folder, still working. Microsoft told every Exchange owner to check for exactly that, and released a one-click tool that blocked the main flaw until the patch could go on and scanned the server for what attackers had left.

The video game studio keeps its source code on its build server, running a code-sharing program from an outside vendor. One morning the vendor emails every customer: a flaw allows an outsider to run commands on the server without signing in, attackers are already using it, and a patch is available. The IT lead installs the patch within the hour.

Next the IT lead runs a full anti-malware scan with the newest signatures. A signature is a fingerprint of a known piece of malware: a sequence of bytes inside the file, a hash of the whole file, or a telltale pattern in its code. Security companies published signatures for the Exchange web shells within days, and anti-malware that had them could find a web shell left behind on a patched server.

The scan finds nothing. A clean scan says that no file matches a known signature, which is good news, though not proof: a web shell written fresh for one target may match no signature until someone has seen it. So the IT lead also checks the places the vendor's notice pointed to: the server's access log and the folders the attackers were said to use.

By April, nearly all servers had been patched or protected, and owners had cleaned web shells off thousands of them. Hundreds of U.S. servers still held web shells their owners hadn't managed to remove. On April 13, 2021, the Justice Department announced that the FBI, with a court's permission, had sent commands through the attackers' own web shells telling each one to delete itself. It then set about notifying each owner by email. The FBI's commands removed the web shells and nothing else: they installed no patch, and they didn't look for other malware the attackers might have left. That part was still up to the owners.