The modernization of businesses and increased Internet usage have led to massive cyber threats such as ransomware attacks. Hackers are now using advanced ways to disguise and expose user data. That’s why users started to use data room due diligence to keep their data protected.
However, one cyberattack which has never been out of the fashion for cyber attackers is web shell attacks.
According to Microsoft, between August 2020 and January 2021, there were 140,000 web shell attacks compared to 77,000 a year before that period. So, you can understand that it is not an old attack forgotten by cyber attackers but has become more brazen with time.
For example, one of the most popular web shell malware that targets Microsoft Server Exchange is China Chopper. However, there are many other web shell attacks like China Chopper that you may encounter. So, what are these shell attacks, and how to prevent one for your systems?
Well, here we are with a discussion on web shell attacks and how to protect your systems against them.
What is a Web Shell Attack?
According to NSA, a web shell attack is a malware deployed through software by cyber attackers. Attackers can use it to implement corrupt system commands sent over HTTP and HTTPS.
Web shell attacks can cause severe risks to your data on the web server. Executing shell attacks needs a simple alteration or adding a specific file to the existing web application. That’s why security is one of the essential web hosting features.
Hackers have continued access to a compromised network through such attacks. It uses the communication between a disguised channel and server to join the legitimate traffic.
Web shell malware is capable of evading security tools and anti-virus software too. Cyber hackers use web app vulnerabilities and upload specific files in the compromised systems to get backdoor access. In addition, shells can act as relay nodes for hackers who use them to extract data and execute arbitrate system commands.
Further, hackers chain several web shells across compromised systems and route the traffic from internal networks. Such attacks are not limited to internet-facing systems; they can even target your CMS for data extraction and admin controls of the web app.
Reasons for web shell attacks
Web shell attacks occur due to several reasons that include:
- Security patch management issues in web applications.
- Lack of security in web-based system management.
- Compromised servers due to lack of adequate data access policies.
- Configurational issues in the network configurations.
- Problems with the communication channel between server and browser.
However, the causes of web shell attacks differ according to the type of attack. So, let’s first discuss the type of attack and later different methods to prevent it.
Types of Web Shell Attacks
Hackers use multiple types of web shell attacks to inject malicious codes into the web app. Let’s first discuss the most popular one: China Chopper!
- China Chopper is a web shell hosted on the web server that allows access to an enterprise network without the infected system commanding back to a remote server. In other words, it is a web shell that hackers leverage to launch a brute force attack against your plans.
- Web Shell by Orb (WSO) is a web shell that can be in the form of a PHP. It is uploaded as a code encoded through Base64 and compressed with Gunzip. Attackers notoriously gain access to the backdoor vulnerabilities, exploit them for data extraction, and then add a patch to restrict others through password protection.
- C99 is an advanced version of WSO. It targets PHP and allows attackers to access, delete, upload, edit, view files, and even change permissions of files. There can be multiple reasons for C99 web shell attacks like SQL injection (SQLi, which can be protected against with SQL database documentation), Remote File Inclusion (RFI), and others.
- B374K is another PHP-based web shell that allows attackers to add, delete, edit, upload, rename, and restrict access to specific files in a web server.
Now that we know what web shell attacks are and their types let’s understand how it works.
How Does a Web Shell Attack Work?
Every web shell attack has three significant phases. Attackers first try to:
- Create a persistent mechanism for access.
- Then escalate privileges.
- And finally, execute a corrupt command.
The persistent mechanism
It is an initial phase where attackers leverage a backdoor vulnerability to gain access to a web server. Once they are in, it’s total control. After that, hackers try and plugin every loophole that can allow admins to gain back control.
With a persistent mechanism, hackers don’t need to look for a new vulnerability to gain access to the web server. Further, they patch the backdoor vulnerability exposed to gain access and restrict it from other users or admins.
Escalation of privileges
Making changes in software or websites needs root access. However, web shell attackers exploit user permissions which are restricted. So, they need to escalate privileges that allow them to make changes in source code, reset access permissions and inject new malicious codes.
Privilege escalations also provide attackers the facility of restricting others from accessing the server. In other words, attackers equip their authority on the server through privilege escalations. They gain such authority through root account access. As a result, hackers can exploit system vulnerabilities and have root account access.
Hiding in plain sight
The next phase in a web shell attack is to route the traffic to targeted nodes. Attackers stay anonymous during this phase by accessing compromised networks. But, first, they analyze the routers, traffic sources, live hosts, and firewalls.
Such data allows attackers to plan their attacks on specific network targets. During these targeted attacks, hackers pivot several systems making them hard to trace.
Networking servers
Lastly, hackers connect multiple servers to a bot network, allowing them to control the system. A common recipe for DDOS attacks, attackers leverage the bot network to execute commands through a command and control server. Such a server is connected to a web shell and does not directly target the system but exploits valuable resources.
Now that we know how web shell attacks work and what they do let’s discuss ways to prevent them.
Top 4 Ways To Prevent Web Shell Attacks
Web shell attacks are caused due to web application backdoor vulnerabilities that hackers expose. So, one of the most effective methods to prevent such attacks is to secure your web applications.
1. Use web application firewalls (WAF)
A web application firewall applies security policies predefined to secure web applications. It helps in creating a shield between the internet and your web applications. A proxy machine secures the identity of the client machine using a reverse-proxy approach.
In other words, WAF protects your server against web shell attacks by ensuring that clients pass through a firewall. In addition, most WAFs operate through a set of security policies that filters malicious traffic from reaching the server.
Similarly, another critical approach that you can employ is securing the communication between your server and browser.
2. Leverage the SSL encryptions
SSL/TLS encryptions provide secure communication between the browser and server to avoid man-in-the-middle (MITM) attacks. Hackers can use web app backdoor vulnerabilities to access networks and execute MITM. You can request an SSL certificate from a trustworthy certificate authority and implement SSL monitoring to check its validity.
After thorough vetting, a CA will provide you with an SSL certificate, which is not just a sign of security but employs encryptions to safeguard against web shell attacks. The best aspect is the SSL certificate cost, which is considerably lower and fits right into your budget.
However, SSL certifications and WAF are not the only methods to protect your systems against web shell attacks.
3. Endpoint Detection and Response (EDR)
EDRs can help you detect web shells through system calls or anomalies in the process lineages. Many EDR solutions offer logging, monitoring, and automating querying interfaces for enhanced security. EDRs also help detect specific abnormal characteristics in the network flow.
For example, you can detect unusual, more significant responses or data exfiltration, recurring peak data access, and geographically disparate requests. These indicators are enough to devise a security plan against web shell attacks.
4. Employ zero-trust network
Think of an airport with multiple layers and security checks. A zero-trust network follows the same principle by using the zero-trust security model. Accessing data in a zero-trust network requires thorough verification and authentication of users. While conventional network approaches are hard to access from outside, once a user is inside the network, data accessibility becomes easier.
Hackers exploit this attribute of conventional network systems and change access permissions once inside the server. The zero trust model is based on a simple rule- trust no one! So, every user, whether inside the network or outside, needs to pass through rigorous authentication.
Conclusion
Web shell attacks are still the most popular choice for many attackers, so you need effective ways to detect them. Proper detection, identification of root cause, and prevention of such attacks need elaborate planning.
So, here are some approaches you can take along according to the type of attack and work. However, which method suits your system will depend upon specific requirements, so analyze the web app first.
