Forgot your password?
typodupeerror
Security Software

Six Rootkit Detectors To Protect Your PC 108

Posted by samzenpus
from the rate-them dept.
An anonymous reader writes "InformationWeek has a review of 6 rootkit detectors.This issue became big last year when Sony released some music CDs which came with a rootkit that silently burrowed into PCs. This review looks at how you can block rootkits and protect your machine using F-Secure Backlight, IceSword, RKDetector, RootkitBuster, RootkitRevealer, and Rookit Unhooker."
This discussion has been archived. No new comments can be posted.

Six Rootkit Detectors To Protect Your PC

Comments Filter:
  • Print version. (Score:5, Informative)

    by antdude (79039) on Wednesday January 17, 2007 @10:07PM (#17658130) Homepage Journal
    Click here [informationweek.com] to going to next pages. :)
  • by 42Penguins (861511) on Wednesday January 17, 2007 @10:11PM (#17658176)
    "helpful" activex popup ads:
    Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!
    • by Jesus_666 (702802) on Wednesday January 17, 2007 @11:48PM (#17658954)
      "helpful" activex popup ads:
      Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!


      Damn. I've been googling for hours now - do you have an idea where I can get the Linux or OS X version of Pwn0r T0olbar or maybe the source? I want to be protekted from teh threts too!
      • by rvw (755107) on Thursday January 18, 2007 @05:42AM (#17661060)

        "helpful" activex popup ads:
        Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!


        Damn. I've been googling for hours now - do you have an idea where I can get the Linux or OS X version of Pwn0r T0olbar or maybe the source? I want to be protekted from teh threts too!

        To get this level of protection you should install Windows. These toolbars, you probably won't even have to install them. They come all by themselves.

      • by deviceb (958415)
        Pwn0r T0olbar v2 is coming out soon -just wait for it

        I cleaned a box recently.. with a tape measure the internewb's IE bars measured 5" vertical. I should have got a screen shot for the most Pwn3d browser award..
  • by Indes (323481) on Wednesday January 17, 2007 @10:15PM (#17658206) Homepage
    ... And dates back to the days of Unix. "

        Whew. Good thing GNU is Not Unix.
  • On debian/ubuntu (Score:5, Informative)

    by delirium of disorder (701392) on Wednesday January 17, 2007 @10:19PM (#17658260) Homepage Journal
    apt-get install chkrootkit [chkrootkit.org] rkhunter [rootkit.nl]
    • Re: (Score:2, Interesting)

      by MrShaggy (683273)
      They forgot a decent anti-root kit

      MAC-OSX.. see it has six letters to.

      Is there a decent one for OS-X?
  • by tgbrittai (599035) on Wednesday January 17, 2007 @10:21PM (#17658276) Homepage
    Ironically enough, it was one of the independent tools -- Rootkit Unhooker -- that turned out to be the best.

    It's interesting that programmers working outside of a corporate environment produce such amazing products. Hmmm... I wonder what's up with that?

    • You just trolling? If you read the article you would know that they were all free.
      • Re: (Score:1, Funny)

        by Anonymous Coward
        You just trolling? If you read the article you would know that they were all free.

        Yeah, but this one is free as in vodka.
    • by tgbrittai (599035)
      D'oh! So much for skipping to the last page of the article.
    • by ubuwalker31 (1009137) on Wednesday January 17, 2007 @10:56PM (#17658542)
      Is it just me, or am I being overly cautious not wanting to download a rootkit detector from Chinese and Russian software developers? Are these programs opensource? Are they safe? Anyone?
      • Re: (Score:3, Insightful)

        by gooman (709147)
        I swear, that's the first thought that ran through my head.
        I'm sure they'll detect every rootkit except the one they install.

        Why am I so paranoid?

        Oh yeah, I run Windows.

      • Re: (Score:1, Funny)

        by Anonymous Coward
        Considering the piece of shit OS you're using from American developers, why not?

        Besides, Russians are hardcore. They can do what they damn well like!
      • Re: (Score:2, Funny)

        by pipatron (966506)
        It's not just you. It's a well known fact that all Chinese and Russian developers are evil communists that only release free code to promote their evil communist way of sharing! Remember what the RIAA told you [users.du.se].
      • To add to this: Some of the most sophisticated spamming trojans come from the Russian mob. These spamming trojans include rootkit detectors so that they clean other hackers' crap off of a zombie freeing up more resources for the spam bot.

        It stands to reason that some of the best trojan-cleaning products come from Russia--they are the ones writing the trojans!
  • Security solutions (Score:4, Insightful)

    by chris(pinecone) (1037932) <ccool2ax@NOSPam.gmail.com> on Wednesday January 17, 2007 @10:28PM (#17658304) Journal
    Shouldn't these tools be a part of already-existent anti-virus solutions? Why another application for rootkits if trojans, virii, and spyware detection are (usually) in the same package? It's not like rootkits are new threats.
    • by jomama717 (779243)
      Norton AV 2007 boasts rootkit protection [symantec.com].
      • Re: (Score:2, Informative)

        by Anonymous Coward
        When it's not being exploited [sans.org]
      • by Macthorpe (960048) on Thursday January 18, 2007 @03:37AM (#17660238) Journal
        Norton AV 2007 boasts rootkits

        Fixed for you :P

        (Yes I know it's not true, but you'd have to pay me severely large amounts of money to expose my system to anything by Symantec)
      • by Gazzonyx (982402)
        It also boasts an extra 3 minutes to boot up time, except on the larger corp. edition which seems to run more quickly with a smaller footprint.


        I stopped using Symantec products when Peter Norton stopped coding them; that is to say, when I was 11 years old running windows 98.

        • by jomama717 (779243)
          Yeah - I've about had it with the startup hit (mine is more like +7 minutes - ugh), if it's not corrected soon I may bail. Wasn't meant as an ad, just pointing out that they have rootkit detection, which is one of the reasons I went with it in the first place.
  • by Afecks (899057) on Wednesday January 17, 2007 @10:33PM (#17658362)
    Hey, thanks for the mention in the article but that is a really old version you've used to test! The last version I've released publicly is AFX Windows Rootkit 2005, it's open source and can be found on http://www.rootkit.com/ [rootkit.com] the other more recent versions I've sold privately.

    Now on the subject of rootkit detection. Most of these use the method based on Microsoft's Strider: GhostBuster. Which uses a low-level method to gather seemingly clean system information then gathers the same information using a high-level method. The idea is that rootkits will have only hooked the high-level methods so there should be a difference in results. Whatever is listed in the low-level results and not listed in the high-level results is displayed as "hidden information". Effectively they are using the rootkit's own hiding functions against itself to detect it. If the rootkit doesn't hide itself to avoid detection it's still made itself visible.

    The problem is that you put yourself in an arms race with who can hook system information at the lowest level. Luckily since we (the sysadmin) have access to the hardware and presumably the attacker does not, a hardware method of gathering system information would be the best. You can bet money that we are going to be seeing hardware level rootkit detectors sooner or later.

    The final problem is that a backdoor can be hidden without using these rootkit methods. By hooking incoming socket connections we can make a hidden backdoor that creates no new processes, threads, files, registry keys or any other permanent data. I and others have released POC code already. Also, making the same attack persist after reboot is only a matter of disabling SFC and altering userinit.exe, explorer.exe or whatever you like. Your rootkit detector will come up clean everytime.
    • Do you have any more information on hooking socket connections as mentioned in your post? That sounds pretty neat and I'd like to research it, so since you've heard of it I figured you might have a good link to two.
    • Re: (Score:2, Insightful)

      by EvanED (569694)
      Also, making the same attack persist after reboot is only a matter of disabling SFC and altering userinit.exe, explorer.exe or whatever you like. Your rootkit detector will come up clean everytime.

      But if you don't hide files, you leave yourself as open to signature-based detection as viruses are, so your typical virus scan should pick it up. Even if you can obfuscate yourself well enough to hide from signature-based scans, if you alter system files like userinit or explorer, you are vulnerable to tripwire-l
    • Will a complete system format and OS re-install from CDs erase any possible re-entry?
    • I'd like a rootkit detector that detects Windows rootkits, but runs from a live Linux distribution on a CDROM or a USB key. So I reboot a machine that I suspect is infected and do the rootkit scan without running any software from the hard disk. Seems to me that this would be a cheap way to do the "hardware level rootkit detection" of which you speak: provided that the Linux distribution was clean, a rootkit would not be able to hide itself on the disk.

      Do you know of such a thing? Do you plan to port your W
      • by mgblst (80109)
        THe way most rootkit revealers work, they need windows to be running. What you are after is some sort of Virus checker, that looks through the files on a harddrive, for a particular signature. Rootkit revealers are better in some ways, because they don't need a signature database, which can be incomplete.
        • by Cheesey (70139)
          Ah, they actually detect rootkits by detecting their attempts to hide? That is clever. Yes, I suppose that an offline scan could only really work using signatures, which is not a very good way to detect things.

          Thanks for clearing that up.
      • Re: (Score:3, Informative)

        by Afecks (899057)
        Actually I've written an article describing how to do what you speak of. The only piece of the puzzle you left out is that you need to scan the system from inside Windows first. Then boot into Linux and scan the hard drive from there so you can compare the results.

        The article can be found here here. [rootkit.com]
  • I didn't see one rootkit detector reviewed by InformationWeek that would work on my PCs, a Macbook and an iMac. Any suggestions?
    • Probably because the article was talking about Windows rootkit detectors, might be a good reason that you didn't see ones for OSX (I could see through your thinly-veiled attempt at a windows vs mac dig, but I'll play along). For OSX you might try http://www.chkrootkit.org/ [chkrootkit.org] as there are OSX rootkits in the wild, they've had a version out for quite some time now.
  • Oh.. well I guess rkhunter http://www.rootkit.nl/ [rootkit.nl] does not run on Windows. Nevermind. :-(
  • Wow.... (Score:4, Insightful)

    by Creepy Crawler (680178) on Wednesday January 17, 2007 @11:01PM (#17658582)
    Wow! Lets rate programs on diagnosing a potentially lying PC!

    This is just a stupid idea if anything. The purpose of a rootkit is to make a very hidden hole into a system. Doing this requires reprogramming and setting up the system in that nobody can diagnose itself. The key is to diagnose any sort of rootkit, one must run from known good binaries.

    Now, we dont have the source to Windows, but we have binaries. Well, lets MD5 the binaries and then compare to a known good (just installed, no network interfaces) installation. The differences are possible holes.

    No program can be trusted when the system it sits upon cannot be trusted. When system trust is gone, one must redeploy the system to regain trust.
    • Re: (Score:2, Informative)

      by jomama717 (779243)
      If a native app [microsoft.com] can analyze the disk volume directly it can identify malicious drivers and reveal them to a friendly Win32 application that can remove them after a reboot. This works for user mode and kernel mode rootkits, but if there's a BIOS rootkit you're pretty much screwed. See my previous post [slashdot.org], Norton AntiVirus 2007 operates in this way.
      • Re: (Score:3, Informative)

        by EvanED (569694)
        If a native app can analyze the disk volume directly it can identify malicious drivers and reveal them to a friendly Win32 application that can remove them after a reboot...

        There's no fundamental reason why they couldn't intercept the I/O requests from your native app and return false but consistent data there.

        It's just very difficult to do, which is why rootkits try to skirt detection based on the Strider: Ghostbuster method (do a low-level scan of the on-disk filesystem data structures, compare to the res
      • Re:Wow.... (Score:4, Insightful)

        by Creepy Crawler (680178) on Thursday January 18, 2007 @12:00AM (#17659048)
        ---If a native app can analyze the disk volume directly it can identify malicious drivers and reveal them to a friendly Win32 application that can remove them after a reboot.

        Oh bother... If I had a Kernel Level rootkit, I can SHIM all your commands through it and filter what I want you to see. You can guarantee that I will hide my program ID, memory used, swap used, location on fixed disks, and any network data transmitted/received. As far as you know, the system will be "ok". But it'll be OK, because you can analyze the volume directly!!

        ---This works for user mode and kernel mode rootkits, but if there's a BIOS rootkit you're pretty much screwed.

        Sure. If you have to run a "checking program" on a corrupted system, what makes you think you'll get good results? I keep drilling this point, but all you do is give dumb comments. And bios rootkit? Good luck with that one. You all might wannna give LinuxBios some help if you can flash WORKING hacked firmwares to the multitudes of X86 boxes. Oh... you mean diddle with the ACPI tables. Welllll.. Bah.

        ---See my previous post, Norton AntiVirus 2007 operates in this way.

        I ignore ads.
        • Re: (Score:2, Insightful)

          by EvanED (569694)
          Oh bother... If I had a Kernel Level rootkit, I can SHIM all your commands through it and filter what I want you to see. You can guarantee that I will hide my program ID, memory used, swap used, location on fixed disks, and any network data transmitted/received

          If that's ALL you hide, then you'll be found by all of these tools.

          You ALSO have to mess with low-level I/O requests; if an application can say "I want block #17" you need to be able to mutate the returned data if it's a directory block or something l
          • ...Oh bother... If I had a Kernel Level rootkit, I can SHIM all your commands through it and filter what I want you to see. You can guarantee that I will hide my program ID, memory used, swap used, location on fixed disks, and any network data transmitted/received

            ---If that's ALL you hide, then you'll be found by all of these tools.

            Wrong. If I control the CPU as kernel level, I can do anything I want. Next of all, if I use custom tools, good luck trying to find them. Well, the only way to find them would to
            • Re: (Score:3, Insightful)

              by EvanED (569694)
              Wrong. If I control the CPU as kernel level, I can do anything I want.

              That's true.

              The OS is too untrustworthy after you hook it on a network (in Windows case especially).

              Windows is no more vulnerable once you've got a kernel hook than Unix/Linux/whatever is. If anything, Linux is more vulnerable because figuring out the appropriate places to hook in Windows is a lot harder without source.

              ("Security through obscurity" is a bad idea -- but obscurity can be a layer and be helpful as long as you design and impl
    • by rastos1 (601318)
      This is just a stupid idea if anything. The purpose of a rootkit is to make a very hidden hole into a system. Doing this requires reprogramming and setting up the system in that nobody can diagnose itself.
      The idea is that the rootkit is not perfect. If the diagnostic tool says: "found", you know there is a problem. If it says "not found" you don't know anything. Just like you did not knew before running the tool.
    • by repvik (96666)
      So? My rootkit detects attempts to md5sum my binaries, and makes sure the program returns the expected md5sum ;-)
  • by Stormwatch (703920) <rodrigogirao&hotmail,com> on Wednesday January 17, 2007 @11:01PM (#17658584) Homepage
    Do NOT buy music from stores. Instead, get them from torrents. It's safer!

  •   Those who don't know, BitDefender Antivirus has rootkit detection and removal since v10. It was released back in Aug-Sept 2006.
  • Blue Pill (Score:3, Interesting)

    by Asztal_ (914605) on Wednesday January 17, 2007 @11:37PM (#17658868)
    Can any of them detect blue pill [blogspot.com]?
    • Re: (Score:3, Informative)

      by Cheesey (70139)
      Apparently one of them attempts to. From TFA:

      The single most intriguing feature is the "Virtual Machine Detector," which uses the time elapsed between two low-level CPU instructions to determine if the operating system is running directly on the PC or in a virtual machine.

      There are actually a few other ways to detect if you are running inside a VM, e.g. use of a non-priviledged instruction that reveals information about memory mappings (here [codeproject.com]). However, there is still an arms race: the rootkit programmer mig

      • by EvanED (569694)
        There are actually a few other ways to detect if you are running inside a VM, e.g. use of a non-priviledged instruction that reveals information about memory mappings (here).

        That only would detect VMWare-style virtualization; to the best of my knowledge, the hardware virtualization that's now in chips (VT and whatever AMD calls theirs) should eliminate this possibility and force you to go with timing tests.
        • by Asztal_ (914605)
          Even so, blue pill alters the fake clock value when it exits its own, slower, subroutines. You need an external time source. (As far as I know, this is the only weakness). So yes, it's not totally undetectable. Here's where I read about it [virtualization.info].
    • Can any of them detect blue pill?
      That blue pill is easy to detect ... just look for signs of priapism.
  • IceSword120_en.zip [80.190.139.91] -- Somewhat faster download for IceSword (at least until it gets Slashdotted)
  • ...the Mac version of these tools?

    Oh, wait...

    • The review was for tools for the Windows PC, not the MAC or Linux. Sorry this was not more evident. The parent is (without knowlege) implying that the Mac is not vunerable to being rooted. And some fanbois are modding this funny? This might be funny, IF IT WERE TRUE! Not only are MAC rootkits possible, they exist. Do a google search before you post and it will prevent mistakes like this. (Yes I know, I run a risk of hardcore fans modding me down)
  • The F-Secure product is Blacklight.

    Wish I could remember the name to give the guy credit, but someone's pointed out that even booting from a CD doesn't necessarily give you a trustworthy system if there's malware flashed onto a graphics card that the BIOS detects and configures before the CD takes over.
    • Re: (Score:1, Informative)

      by Anonymous Coward
      Of course modern OSes do not use the BIOS any more... plus Windows has HAL (hardware Abstraction Layer) and Ctrl+Alt+Del login to protect against this.
      • by Dog-Cow (21281)
        That's not true. Even Linux still uses the BIOS. And that's besides the point. The BIOS runs when the computer boots, so any embedded code has a chance to setup the system to suit itself.
  • That when the rootkit, undid me

      The warning box, I did not see

      OK I clicked on, I spent freely

      then My Ruin passed on, gleefully.

      --A user's lament

      snarkth
  • by shanen (462549) on Thursday January 18, 2007 @02:25AM (#17659894) Homepage Journal
    It's really a philosophic problem. Microsoft sees the OS as a weapon against the competitors, and when you're building weapons, of course you make them as powerful as possible and of course safety gets a lower priority. (Microsoft's highest priority has always been on the money, however.) The problem is that the results are overpowered OSes that real experts can use in ways that completely overwhelm us normal mortals. Heaven help the little old lady who just wants to visit her church's website on Sundays.

    As regards the article, I read most of it, and might finish it later, but I wasn't too impressed with it or with the rootkit-detection tools that I've experimented with in the past. I'm supposed to be something of a computer expert, and I've certainly been using them long enough, but I regard myself as pretty much a helpless infant in these areas. If the NSA is planning to root my computer because I regard Dubya as an asinine embarrassment to my nation, I don't seriously expect to be able to do anything about it. Sure, I can use an expert's tools in many cases, but that doesn't make me any match for a real expert with corresponding tools. Or returning to the weapon metaphor, I may have a great gun, and even be competent enough in using it, but I'm sure that a seriously experienced killer would have little trouble taking me out, even with an inferior weapon.

    In conclusion, "It's a poor craftsman who blames his tools", but it's also a poor craftsman who can't tell the difference...
    • Microsoft sees the OS as a weapon against the competitors, and when you're building weapons, of course you make them as powerful as possible and of course safety gets a lower priority.

      And like any good weapons vender, you self-limit your product (so wayward purchasers lose the ability to maintain it without your help), backdoor it (so you can cripple it if purchasers have the audacity to try to improve it themselves so they can cut your support/upgrade strings) and only release it when you yourself have
  • - and I don't just mean converting the poor user to Linux either -- I mean things like Knoppix [knopper.net] with clamav [slashdot.org] which allow you to search for signs of rootkits without having the rootkit, itself, get in your way.

    Once you've pulled out those pieces, then you can hopefully boot (what's left of) Windows, run some of the Windows-centric anti-virus ware in hopes of finding those pieces that clamav didn't find.

  • In Soviet Russia, Rootkit detects You!
  • "...and Rookit Unhooker."

    I for one welco- eh. To hell with it.

    Kangaroos are more than welcome to obtain low-level access to my OS. I've got mad respect for their built-in pockets.

    Genetics wasn't as friendly to me. I had to BUY my Scott-E-Vest.
  • ...on this sort of thing, Security Now [grc.com]. They had a good explanation last year of all the things the Sony "rootkit" did, like hiding files with the prefix "$sys$". The podcasts are pretty short (20 mins), definitely worth a listen to ease your morning commute.

    Also, getindi [getindi.com]!
  • A few weeks ago, I played around with some of those rootkit detectors. Cool things, if you want to learn about some OS internals. But: When the primary use of a rootkit detector is to uncover malware so that a virus killer can see it, why not just do an /external/ virus check from a boot CD? So, that is what I am doing now!
  • by toadlife (301863) on Thursday January 18, 2007 @06:55AM (#17661444) Journal
    I find it curious and a bit disconcerting when I see how much emphasis people place on the subject of malware detection in the realm of information security. What to do after malicious code finds it's way onto our systems, or into our networks is certainly something to consider, and any security plan would be incomplete without it, but this area takes up far too much of our time, given that other aspects of security bring a much more favorable cost/benefit ratio.

    I can only surmise that there is certain "sexiness" to malware detection; much the same way that fancy home alarm systems are the first thing that many think of when contemplating home security.

    In the home security market, advertisements depict evil prowlers dressed in sweat-suits busting through the back door of the house, while a frightened soccer mom with her five year old daughter cower upstairs. The alarm sounds, the prowler runs away, and a call comes in from the alarm provider, asking if they are ok. Quite dramatic. Quite unrealistic too.

    In the information security market there are no soccer moms, and the prowlers don't run around in matching sweat-suits, but the theme is similar. "Buy our product - it will catch intruders when they enter and save you." Again - quite dramatic, and quite unrealistic.

    In the real world, people forget to turn on their alarm systems, or they forget to change the batteries, or intruders know how to disable them without triggering them.

    In the real world, people also forget to update their AV/IDS signatures, or turn their security product off for various reasons - usually convenience-related, or like the prowler in the home, malware simply disables the security solution on it's way in.

    Just as in securing a home, we would be better off if we first focused on installing heavy doors and deadbolts on all outside entrances, in the virtual world, we would be better off focusing on the barriers that malware must overcome to gain entry to our systems and access to our information and resources.

    This is far from an original thought, but I'll say it anyway as it deserved to be repeated. The security industry is a joke. It's is filled by people who either don't understand the basic pricipals of information security, or do but choose to to sell 'sexy' solutions anyway. I once ran into the author of a somewhat popular Windows security product on a messageboard and was shocked at his aparent lack of understanding of how his platform of choice, Windows, worked.

    I supposed this is more of a Windows problem than anything else. Not a problem with Windows, the operating system, but a problem with WIndows, the culture.
  • by Anonymous Coward
    Someone said we could MD5 Windows binaries... Of course we can, though MD5 is so broken in this 21st century that you'd better use SHA-1 ;)

    Another dude said "but my rootkit detect attempt to MD5 and returns the correst sum". Kind of, it s even better than that for the best of the breed: they recognize themselves in *any* attempt to read the file and replace their code (that they recognized) with the code that the file is supposed to contain at that place. What I mean is: you don't specifically decide to
  • Make your normal user a Limited one, not an Administrator. Try the initial install of any software as that user. Certainly playing a CD isn't going to be able to install anything rootkit-like as a Limited user. Oh, and disable Autoplay on all removeable media devices.

    Yes, some programs still require Administrator access to install, although in some cases you just need to give the Limited account access to write in the global Startup menu folder or something similar, so this isn't a 100% cure-all.
  • Running a rootkit detection kit on a system containing a (good) rootkit is fruitless. There are now rootkits that can detect rootkit detectors and (since most rootkit revealers rely on the discrepancy between system API calls and "direct" access to the HD) simply "demask" while they're running, so the rootkit cannot be found.

    The only way to find a well written rootkit is to boot from a certainly uninfected bootdisk (or CD/DVD) and scan with it. Everything else is at best working against less sophisticated k
  • Now anyone who wants to write a rootkit has a much better set of test suites to test its non-detectability! I'm glad we're investing in the education and skill of malware writers...we may need those rich crack programmers for something someday.

CCI Power 6/40: one board, a megabyte of cache, and an attitude...

Working...