Slashdot Log In
Six Rootkit Detectors To Protect Your PC
Posted by
samzenpus
on Wed Jan 17, 2007 10:05 PM
from the rate-them dept.
from the rate-them dept.
An anonymous reader writes "InformationWeek has a review of 6 rootkit detectors.This issue became big last year when Sony released some music CDs which came with a rootkit that silently burrowed into PCs. This review looks at how you can block rootkits and protect your machine using F-Secure Backlight, IceSword, RKDetector, RootkitBuster, RootkitRevealer, and Rookit Unhooker."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Print version. (Score:5, Informative)
+avoid (Score:2)
I can see... (Score:5, Funny)
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!
Re:I can see... (Score:5, Funny)
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!
Damn. I've been googling for hours now - do you have an idea where I can get the Linux or OS X version of Pwn0r T0olbar or maybe the source? I want to be protekted from teh threts too!
Parent
Re:I can see... (Score:5, Funny)
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!
Damn. I've been googling for hours now - do you have an idea where I can get the Linux or OS X version of Pwn0r T0olbar or maybe the source? I want to be protekted from teh threts too!
To get this level of protection you should install Windows. These toolbars, you probably won't even have to install them. They come all by themselves.
Parent
"The concept of the rootkit isn't a new one, (Score:5, Funny)
Whew. Good thing GNU is Not Unix.
Re: (Score:3, Funny)
Whew. Good thing GNU is Not Unix.
I'm not seeing what your point is, can you explain? Or am I trying to overanalyze a throw-away comment? I do that sometimes...
Re: (Score:3, Funny)
Re:"The concept of the rootkit isn't a new one, (Score:4, Funny)
Parent
On debian/ubuntu (Score:5, Informative)
Re: (Score:2, Interesting)
MAC-OSX.. see it has six letters to.
Is there a decent one for OS-X?
Summarized: The free one is the best! (Score:5, Informative)
It's interesting that programmers working outside of a corporate environment produce such amazing products. Hmmm... I wonder what's up with that?
Nervous about these... (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
I'm sure they'll detect every rootkit except the one they install.
Why am I so paranoid?
Oh yeah, I run Windows.
Re: (Score:3, Funny)
Security solutions (Score:4, Insightful)
Re: (Score:2, Informative)
Re:Security solutions (Score:4, Funny)
Fixed for you
(Yes I know it's not true, but you'd have to pay me severely large amounts of money to expose my system to anything by Symantec)
Parent
I am the author of AFX Windows Rootkit 2003 (Score:5, Informative)
Now on the subject of rootkit detection. Most of these use the method based on Microsoft's Strider: GhostBuster. Which uses a low-level method to gather seemingly clean system information then gathers the same information using a high-level method. The idea is that rootkits will have only hooked the high-level methods so there should be a difference in results. Whatever is listed in the low-level results and not listed in the high-level results is displayed as "hidden information". Effectively they are using the rootkit's own hiding functions against itself to detect it. If the rootkit doesn't hide itself to avoid detection it's still made itself visible.
The problem is that you put yourself in an arms race with who can hook system information at the lowest level. Luckily since we (the sysadmin) have access to the hardware and presumably the attacker does not, a hardware method of gathering system information would be the best. You can bet money that we are going to be seeing hardware level rootkit detectors sooner or later.
The final problem is that a backdoor can be hidden without using these rootkit methods. By hooking incoming socket connections we can make a hidden backdoor that creates no new processes, threads, files, registry keys or any other permanent data. I and others have released POC code already. Also, making the same attack persist after reboot is only a matter of disabling SFC and altering userinit.exe, explorer.exe or whatever you like. Your rootkit detector will come up clean everytime.
Re: (Score:2)
Re:I am the author of AFX Windows Rootkit 2003 (Score:4, Informative)
Parent
Re: (Score:2, Insightful)
But if you don't hide files, you leave yourself as open to signature-based detection as viruses are, so your typical virus scan should pick it up. Even if you can obfuscate yourself well enough to hide from signature-based scans, if you alter system files like userinit or explorer, you are vulnerable to tripwire-l
Re: (Score:2)
Re:I am the author of AFX Windows Rootkit 2003 (Score:5, Informative)
The complicated answer is, for a little while. The reason is that there are rootkits being developed that are designed to store itself in your video card. The idea is that after the hard drive is reformatted the video card will load this rootkit back into the kernel. Right now it's highly unlikely.
Parent
Re: (Score:3, Informative)
The article can be found here here. [rootkit.com]
Something is missing (Score:2)
Re: (Score:2)
Wow.... (Score:4, Insightful)
This is just a stupid idea if anything. The purpose of a rootkit is to make a very hidden hole into a system. Doing this requires reprogramming and setting up the system in that nobody can diagnose itself. The key is to diagnose any sort of rootkit, one must run from known good binaries.
Now, we dont have the source to Windows, but we have binaries. Well, lets MD5 the binaries and then compare to a known good (just installed, no network interfaces) installation. The differences are possible holes.
No program can be trusted when the system it sits upon cannot be trusted. When system trust is gone, one must redeploy the system to regain trust.
Re: (Score:2, Informative)
Re: (Score:3, Informative)
There's no fundamental reason why they couldn't intercept the I/O requests from your native app and return false but consistent data there.
It's just very difficult to do, which is why rootkits try to skirt detection based on the Strider: Ghostbuster method (do a low-level scan of the on-disk filesystem data structures, compare to the res
Re:Wow.... (Score:4, Insightful)
Oh bother... If I had a Kernel Level rootkit, I can SHIM all your commands through it and filter what I want you to see. You can guarantee that I will hide my program ID, memory used, swap used, location on fixed disks, and any network data transmitted/received. As far as you know, the system will be "ok". But it'll be OK, because you can analyze the volume directly!!
---This works for user mode and kernel mode rootkits, but if there's a BIOS rootkit you're pretty much screwed.
Sure. If you have to run a "checking program" on a corrupted system, what makes you think you'll get good results? I keep drilling this point, but all you do is give dumb comments. And bios rootkit? Good luck with that one. You all might wannna give LinuxBios some help if you can flash WORKING hacked firmwares to the multitudes of X86 boxes. Oh... you mean diddle with the ACPI tables. Welllll.. Bah.
---See my previous post, Norton AntiVirus 2007 operates in this way.
I ignore ads.
Parent
Re: (Score:2, Insightful)
If that's ALL you hide, then you'll be found by all of these tools.
You ALSO have to mess with low-level I/O requests; if an application can say "I want block #17" you need to be able to mutate the returned data if it's a directory block or something l
Re: (Score:2)
---If that's ALL you hide, then you'll be found by all of these tools.
Wrong. If I control the CPU as kernel level, I can do anything I want. Next of all, if I use custom tools, good luck trying to find them. Well, the only way to find them would to
Re: (Score:3, Insightful)
That's true.
The OS is too untrustworthy after you hook it on a network (in Windows case especially).
Windows is no more vulnerable once you've got a kernel hook than Unix/Linux/whatever is. If anything, Linux is more vulnerable because figuring out the appropriate places to hook in Windows is a lot harder without source.
("Security through obscurity" is a bad idea -- but obscurity can be a layer and be helpful as long as you design and impl
Re: (Score:2)
Easier solution... (Score:5, Funny)
Got it (Score:2)
Those who don't know, BitDefender Antivirus has rootkit detection and removal since v10. It was released back in Aug-Sept 2006.
Blue Pill (Score:3, Interesting)
Re: (Score:3, Informative)
There are actually a few other ways to detect if you are running inside a VM, e.g. use of a non-priviledged instruction that reveals information about memory mappings (here [codeproject.com]). However, there is still an arms race: the rootkit programmer mig
Faster IceSword Link (Score:2)
Correction, and possible next step in arms race (Score:2)
Wish I could remember the name to give the guy credit, but someone's pointed out that even booting from a CD doesn't necessarily give you a trustworthy system if there's malware flashed onto a graphics card that the BIOS detects and configures before the CD takes over.
Root of the problem with Windows (Score:4, Interesting)
As regards the article, I read most of it, and might finish it later, but I wasn't too impressed with it or with the rootkit-detection tools that I've experimented with in the past. I'm supposed to be something of a computer expert, and I've certainly been using them long enough, but I regard myself as pretty much a helpless infant in these areas. If the NSA is planning to root my computer because I regard Dubya as an asinine embarrassment to my nation, I don't seriously expect to be able to do anything about it. Sure, I can use an expert's tools in many cases, but that doesn't make me any match for a real expert with corresponding tools. Or returning to the weapon metaphor, I may have a great gun, and even be competent enough in using it, but I'm sure that a seriously experienced killer would have little trouble taking me out, even with an inferior weapon.
In conclusion, "It's a poor craftsman who blames his tools", but it's also a poor craftsman who can't tell the difference...
What about Linux? (Score:2)
Once you've pulled out those pieces, then you can hopefully boot (what's left of) Windows, run some of the Windows-centric anti-virus ware in hopes of finding those pieces that clamav didn't find.
Hunting down the bad guys like Dirty Harry. (Score:3, Insightful)
I can only surmise that there is certain "sexiness" to malware detection; much the same way that fancy home alarm systems are the first thing that many think of when contemplating home security.
In the home security market, advertisements depict evil prowlers dressed in sweat-suits busting through the back door of the house, while a frightened soccer mom with her five year old daughter cower upstairs. The alarm sounds, the prowler runs away, and a call comes in from the alarm provider, asking if they are ok. Quite dramatic. Quite unrealistic too.
In the information security market there are no soccer moms, and the prowlers don't run around in matching sweat-suits, but the theme is similar. "Buy our product - it will catch intruders when they enter and save you." Again - quite dramatic, and quite unrealistic.
In the real world, people forget to turn on their alarm systems, or they forget to change the batteries, or intruders know how to disable them without triggering them.
In the real world, people also forget to update their AV/IDS signatures, or turn their security product off for various reasons - usually convenience-related, or like the prowler in the home, malware simply disables the security solution on it's way in.
Just as in securing a home, we would be better off if we first focused on installing heavy doors and deadbolts on all outside entrances, in the virtual world, we would be better off focusing on the barriers that malware must overcome to gain entry to our systems and access to our information and resources.
This is far from an original thought, but I'll say it anyway as it deserved to be repeated. The security industry is a joke. It's is filled by people who either don't understand the basic pricipals of information security, or do but choose to to sell 'sexy' solutions anyway. I once ran into the author of a somewhat popular Windows security product on a messageboard and was shocked at his aparent lack of understanding of how his platform of choice, Windows, worked.
I supposed this is more of a Windows problem than anything else. Not a problem with Windows, the operating system, but a problem with WIndows, the culture.
Re: (Score:2, Informative)
Re:Rootkit (Score:4, Insightful)
Parent
Re: (Score:2, Interesting)
I would not bet my life on that. Even though I consider the default security in my choice of GNU/Linux distro to be tighter than OS-X, I still use Knoppix (a CD based GNU/LINUX OS) for internet banking. It is the only TRUE assurance of safety from being rooted.
Re: (Score:2)
1. Boot with a Knoppix CD to do banking
2. Virus hides in Video
3. You reboot, virus installs itself and PROFIT!
Mark
Re: (Score:2, Funny)
2. Windows Defender is freeware.
3. Windows Defender is malware removalal tool, not a firewall.
4. You're tool late, I already laughed.
change mod from (Score:2, Insightful)