FBI Accessing Private Servers to Subvert Cyberattacks

April 30, 2021 by Reece Nations
FBI Accessing Private Servers to Subvert Cyberattacks
The. J. Edgar Hoover FBI Building in Washington, D.C. (Photo by Dan McCue)

WASHINGTON — In a covert operation to undercut hacking groups’ attempts to exploit vulnerabilities in Microsoft’s Exchange email program, the FBI has begun accessing hundreds of vulnerable computers in the United States to remove malicious web shells. 

Web shells, interfaces that grant control over a web server by implementing arbitrary code executions, can be uploaded to servers to enable remote access to hackers. From January to February 2021, hackers began exploiting previously unknown vulnerabilities in Microsoft Exchange Server software to access e-mail accounts and place web shells. 

“The FBI conducted the removal by issuing a command through the web shell to the server, which was designed to cause the server to delete only the web shell [identified by its unique file path],” officials from the Department of Justice said in a written statement. 

The hacking of Microsoft’s software is believed to have been carried out by a team from the Russian Foreign Intelligence Service to gain a backdoor into SolarWinds programs, TWN previously reported

Top cybersecurity experts sounded alarm bells once news of the hacking broke, likely prompting the court-authorized FBI operation to delete the harmful code. In retaliation to the hack, the White House expelled 10 Russian diplomats from the country, although cybersecurity experts have signaled the need to ramp up the industry workforce and educational pipeline to prevent future cyberattacks. 

“This operation is an example of the FBI’s commitment to combating cyber threats through our enduring federal and private sector partnerships,” Tonya Ugoretz, acting assistant director of the FBI’s Cyber Division, said in a written statement. “Our successful action should serve as a reminder to malicious cyber actors that we will impose risk and consequences for cyber intrusions that threaten the national security and public safety of the American people and our international partners. The FBI will continue to use all tools available to us as the lead domestic law enforcement and intelligence agency to hold malicious cyber actors accountable for their actions.” 

Because of the swift and clandestine nature of the operation, the owners of affected Microsoft Exchange servers could be left unaware of the FBI’s actions on their networks. In the Justice Department’s release announcing the operation, the agency said the FBI is “attempting to provide notice” to the owners or operators of the computers. 

Although the FBI’s operation succeeded in eliminating malicious web shells, it did not patch any Microsoft Exchange Server vulnerabilities or search for additional malware or hacking tools left behind by cyberattacks. The Justice Department strongly encourages network defenders to review Microsoft’s remediation guidance on detection and patching, the agency said in a release. 

“Combating cyber threats requires partnerships with private sector and government colleagues,” Acting U.S. Attorney Jennifer Lowery of the Southern District of Texas said in a written statement. “This court-authorized operation to copy and remove malicious web shells from hundreds of vulnerable computers shows our commitment to use any viable resource to fight cyber criminals. We will continue to do so in coordination with our partners and with the court to combat the threat until it is alleviated, and we can further protect our citizens from these malicious cyber breaches.” 

A+
a-
  • cyberattacks
  • cybersecurity
  • FBI
  • law enforcement
  • private servers
  • In The News

    Health

    Voting

    Cybersecurity

    Americans Reporting Nationwide Cellular Outages From AT&T, Cricket Wireless and Others

    A number of Americans are dealing with cellular outages on AT&T, Cricket Wireless, Verizon, T-Mobile and other service providers, according... Read More

    A number of Americans are dealing with cellular outages on AT&T, Cricket Wireless, Verizon, T-Mobile and other service providers, according to data from Downdetector. AT&T had more than 73,000 outages around 9:30 a.m. ET, in locations including Houston, Atlanta and Chicago. The outages began at approximately... Read More

    States and Congress Wrestle With Cybersecurity at Water Utilities Amid Renewed Federal Warnings

    HARRISBURG, Pa. (AP) — The tiny Aliquippa water authority in western Pennsylvania was perhaps the least-suspecting victim of an international... Read More

    HARRISBURG, Pa. (AP) — The tiny Aliquippa water authority in western Pennsylvania was perhaps the least-suspecting victim of an international cyberattack. It had never had outside help in protecting its systems from a cyberattack, either at its existing plant that dates to the 1930s or the... Read More

    December 6, 2023
    by Dan McCue
    HHS Unveils Next Steps to Enhance Cybersecurity of Health Care Records

    WASHINGTON — The bad guys in cyberspace want your health care records.  Between 2018 and 2022, there was a 93%... Read More

    WASHINGTON — The bad guys in cyberspace want your health care records.  Between 2018 and 2022, there was a 93% increase in large breaches in the health care sector, with a 278% increase in large breaches involving ransomware, according to the Department of Health and Human... Read More

    Insider Q&A: Pentagon AI Chief on Network-Centric Warfare, Generative AI Challenges

    The Pentagon's chief digital and artificial intelligence offer, Craig Martell, is alarmed by the potential for generative artificial intelligence systems... Read More

    The Pentagon's chief digital and artificial intelligence offer, Craig Martell, is alarmed by the potential for generative artificial intelligence systems like ChatGPT to deceive and sow disinformation. His talk on the technology at the DefCon hacker convention in August was a huge hit. But he's anything... Read More

    October 31, 2023
    by Tom Ramstack
    US Workforce Unprepared for AI, Technology Experts Tell Senate

    WASHINGTON — President Joe Biden’s executive order Monday setting regulatory standards for artificial intelligence prompted witnesses at a Senate hearing... Read More

    WASHINGTON — President Joe Biden’s executive order Monday setting regulatory standards for artificial intelligence prompted witnesses at a Senate hearing Tuesday to say it is only a first step in a process likely to transform American workplaces. “Artificial intelligence will not only disrupt lives, it will... Read More

    July 18, 2023
    by Tom Ramstack
    Congress Told AI Holds Great Risks and Benefits for US Military

    WASHINGTON — Artificial intelligence experts warned Tuesday during a congressional hearing of ominous dangers for the United States if it... Read More

    WASHINGTON — Artificial intelligence experts warned Tuesday during a congressional hearing of ominous dangers for the United States if it falls behind in developing the technology but a bright future by taking the lead. One of the greatest risks would be defending against a foreign enemy... Read More

    News From The Well
    scroll top