7 ms·
As the article says, most were infected through misconfigured JBoss installations, which exposed the JMX control console to the web. The article also implied th
by 21 11y ago
As the article says, most were infected through misconfigured JBoss installations, which exposed the JMX control console to the web. The article also implied that this is some sort of default JBoss setting.
So the initial infection had nothing to do with Windows.
- xenadu02 11y agoI'll also assume JBoss installs its services as SYSTEM, instead of creating limited-permission accounts. Microsoft historically hasn't done a good job of making it easy (and the default) to set things up this way though they take it a lot more seriously now. NTFS supports permission execute on ACLs and the system enforces them. I wish they had made a policy decision to default that to off and require you re-auth with admin credentials to set the bit. It would work more like +x/chmod/sudo does and prevent a decent number of such things.