> Groups known to exploit web shells most effectively include teams with links to Chinese intelligence, including one nicknamed Shell Crew. That's just silly.

> Groups known to exploit web shells most effectively include teams with links to Chinese intelligence, including one nicknamed Shell Crew. That's just silly. It is very common when exploiting web apps to utilize a web shell to persist your access and then to work from that to implement better and more permanent access. Web shells are easy to find and they make a lot of noise (POSTs in the web logs). They are very easy to spot in any org that has their web/app roots under version control, so advanced adversaries will use them temporarily - not install 30 of them > One of the tools used by the hackers—China Chopper—has a Chinese-language interface, but is also in use outside China, people familiar with the malware said. China Chopper is an old web shell[0]. It works by having a very thin server component that simply runs an eval of a POST variable. Most of the intelligence is in the thick client (read about it at the links below - its pretty cool but by no means advanced). While it was developed in China - the interface is in English[1]. There isn't even much of an interface, as it will reconstruct the server file explorer, shell, db connection etc. You can't identify China Chopper from just the server component, since it is a simple: <% Runtime.getRuntime().exec(request.getParameter("password")) Most decent scanners will have a signature for "exec("[1] This is what I still don't understand about the Equifax hack. They had an entire infosec team, ran a SOC, had all sorts of high-end product installed (including complete traffic logs) yet someone could exfil 10GB+ of data using a known web app exploit and simple web shell. There is more to this story, and it will be told in what happen once the attackers penetrated the first web server and how they were able to pull of the lateral moves to get to the credit database. I sense there is going to be some horrible security practice and hygiene on the internal network that allowed this to happen (think broad permissions, full database access, no db query monitoring, no encryption internally, etc.). [0] https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html https://www.fireeye.com/blog/threat-research/2013/08/breakin... [1] http://informationonsecurity.blogspot.com.au/2012/11/china-chopper-webshell.html http://informationonsecurity.blogspot.com.au/2012/11/china-c... [2] https://www.tenable.com/pvs-plugins/9488 https://www.tenable.com/pvs-plugins/9488