Menu
Check your BITS, because deleting malware might not be enough

Check your BITS, because deleting malware might not be enough

Rogue Windows Background Intelligent Transfer Service jobs can linger after malware clean-up and re-infect systems

Attackers are abusing the Windows Background Intelligent Transfer Service (BITS) to re-infect computers with malware after they've been already cleaned by antivirus products.

The technique was observed in the wild last month by researchers from SecureWorks while responding to a malware incident for a customer. The antivirus software installed on a compromised computer detected and removed a malware program, but the computer was still showing signs of malicious activity at the network level.

Upon further investigation, the researchers found two rogue jobs registered in BITS, a Windows service that's used by the OS and other apps to download updates or transfer files. The two malicious jobs periodically downloaded and attempted to reinstall the deleted malware.

Even though it's not very common, attackers have abused BITS to download malware since as far back as 2007. An advantage of using this approach is that BITS is a trusted service and is not blocked by the computer's firewall.

However, the new Trojan program discovered by SecureWorks -- part of the DNSChanger malware family -- also abuses a little-known BITS feature to execute the downloaded file. This removes the need for malware to already exist on the system.

After completing the transfer, the rogue job executes a command as a BITS "notification" action. The command creates and launches a batch script called x.bat, which completes the BITS job, checks if the file has been saved and loads it in the computer's memory as a DLL.

Through this technique, the attackers created "self-contained, download-and-execute BITS tasks that persisted even after the original malware was eliminated," the SecureWorks researchers said Monday in a blog post.

Another problem is that while the Windows event log showed information about the previous BITS malicious transfers, the logged information about the pending tasks was limited. The researchers had to use other tools to parse the BITS jobs database to see the full details.

BITS jobs expire after 90 days but can potentially be renewed. In the case investigated by SecureWorks, the computer had been infected on March 4 and was cleaned by antivirus software 10 days later. The BITS job remained until it was discovered in May.

Companies should consider enumerating active BITS tasks on computers that continue to generate network or host security alerts after malware remediation, the researchers said. One way to do this is to execute the bitsadmin client from a cmd.exe session with elevated privileges by typing: bitsadmin /list /allusers /verbose.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments