Six Rootkit Detectors To Protect Your PC 108
An anonymous reader writes "InformationWeek has a review of 6 rootkit detectors.This issue became big last year when Sony released some music CDs which came with a rootkit that silently burrowed into PCs. This review looks at how you can block rootkits and protect your machine using F-Secure Backlight, IceSword, RKDetector, RootkitBuster, RootkitRevealer, and Rookit Unhooker."
Print version. (Score:5, Informative)
+avoid (Score:2)
Rootkit Unhooker says it is infected. (Score:2)
Re: (Score:2)
The program cannot be trusted. (Score:2)
Certainly it means that the program cannot be trusted. Note that there is a new version since yesterday evening.
I can see... (Score:5, Funny)
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!
Re:I can see... (Score:5, Funny)
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!
Damn. I've been googling for hours now - do you have an idea where I can get the Linux or OS X version of Pwn0r T0olbar or maybe the source? I want to be protekted from teh threts too!
Re:I can see... (Score:5, Funny)
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!
Damn. I've been googling for hours now - do you have an idea where I can get the Linux or OS X version of Pwn0r T0olbar or maybe the source? I want to be protekted from teh threts too!
To get this level of protection you should install Windows. These toolbars, you probably won't even have to install them. They come all by themselves.
Re: (Score:1)
I cleaned a box recently.. with a tape measure the internewb's IE bars measured 5" vertical. I should have got a screen shot for the most Pwn3d browser award..
"The concept of the rootkit isn't a new one, (Score:5, Funny)
Whew. Good thing GNU is Not Unix.
Re: (Score:3, Funny)
Whew. Good thing GNU is Not Unix.
I'm not seeing what your point is, can you explain? Or am I trying to overanalyze a throw-away comment? I do that sometimes...
Re: (Score:3, Funny)
Re:"The concept of the rootkit isn't a new one, (Score:4, Funny)
Re: (Score:2, Funny)
>Whew. Good thing GNU is Not Unix.
Which is why "The concept of the rootkit isn't a GNU one"
On debian/ubuntu (Score:5, Informative)
Re: (Score:2, Interesting)
MAC-OSX.. see it has six letters to.
Is there a decent one for OS-X?
Summarized: The free one is the best! (Score:5, Informative)
It's interesting that programmers working outside of a corporate environment produce such amazing products. Hmmm... I wonder what's up with that?
Re: (Score:1)
Re: (Score:1, Funny)
Yeah, but this one is free as in vodka.
Re: (Score:1)
Nervous about these... (Score:5, Insightful)
Re: (Score:3, Insightful)
I'm sure they'll detect every rootkit except the one they install.
Why am I so paranoid?
Oh yeah, I run Windows.
Re: (Score:1, Funny)
Besides, Russians are hardcore. They can do what they damn well like!
Re: (Score:3, Funny)
Re: (Score:2, Funny)
Re: (Score:2)
It stands to reason that some of the best trojan-cleaning products come from Russia--they are the ones writing the trojans!
Security solutions (Score:4, Insightful)
Re: (Score:1)
Re: (Score:2, Informative)
Re:Security solutions (Score:4, Funny)
Fixed for you
(Yes I know it's not true, but you'd have to pay me severely large amounts of money to expose my system to anything by Symantec)
Re: (Score:1)
I stopped using Symantec products when Peter Norton stopped coding them; that is to say, when I was 11 years old running windows 98.
Re: (Score:1)
Re: (Score:2, Funny)
2. Windows Defender is freeware.
3. Windows Defender is malware removalal tool, not a firewall.
4. You're tool late, I already laughed.
I am the author of AFX Windows Rootkit 2003 (Score:5, Informative)
Now on the subject of rootkit detection. Most of these use the method based on Microsoft's Strider: GhostBuster. Which uses a low-level method to gather seemingly clean system information then gathers the same information using a high-level method. The idea is that rootkits will have only hooked the high-level methods so there should be a difference in results. Whatever is listed in the low-level results and not listed in the high-level results is displayed as "hidden information". Effectively they are using the rootkit's own hiding functions against itself to detect it. If the rootkit doesn't hide itself to avoid detection it's still made itself visible.
The problem is that you put yourself in an arms race with who can hook system information at the lowest level. Luckily since we (the sysadmin) have access to the hardware and presumably the attacker does not, a hardware method of gathering system information would be the best. You can bet money that we are going to be seeing hardware level rootkit detectors sooner or later.
The final problem is that a backdoor can be hidden without using these rootkit methods. By hooking incoming socket connections we can make a hidden backdoor that creates no new processes, threads, files, registry keys or any other permanent data. I and others have released POC code already. Also, making the same attack persist after reboot is only a matter of disabling SFC and altering userinit.exe, explorer.exe or whatever you like. Your rootkit detector will come up clean everytime.
Re: (Score:2)
Re:I am the author of AFX Windows Rootkit 2003 (Score:4, Informative)
Re: (Score:2)
Re: (Score:2, Insightful)
But if you don't hide files, you leave yourself as open to signature-based detection as viruses are, so your typical virus scan should pick it up. Even if you can obfuscate yourself well enough to hide from signature-based scans, if you alter system files like userinit or explorer, you are vulnerable to tripwire-l
Re: (Score:2)
Re:I am the author of AFX Windows Rootkit 2003 (Score:5, Informative)
The complicated answer is, for a little while. The reason is that there are rootkits being developed that are designed to store itself in your video card. The idea is that after the hard drive is reformatted the video card will load this rootkit back into the kernel. Right now it's highly unlikely.
What I'd like... (Score:2)
Do you know of such a thing? Do you plan to port your W
Re: (Score:2)
Re: (Score:2)
Thanks for clearing that up.
Re: (Score:3, Informative)
The article can be found here here. [rootkit.com]
Re: (Score:2)
Something is missing (Score:2)
Re: (Score:2)
rkhunter anyone? (Score:1)
Wow.... (Score:4, Insightful)
This is just a stupid idea if anything. The purpose of a rootkit is to make a very hidden hole into a system. Doing this requires reprogramming and setting up the system in that nobody can diagnose itself. The key is to diagnose any sort of rootkit, one must run from known good binaries.
Now, we dont have the source to Windows, but we have binaries. Well, lets MD5 the binaries and then compare to a known good (just installed, no network interfaces) installation. The differences are possible holes.
No program can be trusted when the system it sits upon cannot be trusted. When system trust is gone, one must redeploy the system to regain trust.
Re: (Score:2, Informative)
Re: (Score:3, Informative)
There's no fundamental reason why they couldn't intercept the I/O requests from your native app and return false but consistent data there.
It's just very difficult to do, which is why rootkits try to skirt detection based on the Strider: Ghostbuster method (do a low-level scan of the on-disk filesystem data structures, compare to the res
Re:Wow.... (Score:4, Insightful)
Oh bother... If I had a Kernel Level rootkit, I can SHIM all your commands through it and filter what I want you to see. You can guarantee that I will hide my program ID, memory used, swap used, location on fixed disks, and any network data transmitted/received. As far as you know, the system will be "ok". But it'll be OK, because you can analyze the volume directly!!
---This works for user mode and kernel mode rootkits, but if there's a BIOS rootkit you're pretty much screwed.
Sure. If you have to run a "checking program" on a corrupted system, what makes you think you'll get good results? I keep drilling this point, but all you do is give dumb comments. And bios rootkit? Good luck with that one. You all might wannna give LinuxBios some help if you can flash WORKING hacked firmwares to the multitudes of X86 boxes. Oh... you mean diddle with the ACPI tables. Welllll.. Bah.
---See my previous post, Norton AntiVirus 2007 operates in this way.
I ignore ads.
Re: (Score:2, Insightful)
If that's ALL you hide, then you'll be found by all of these tools.
You ALSO have to mess with low-level I/O requests; if an application can say "I want block #17" you need to be able to mutate the returned data if it's a directory block or something l
Re: (Score:2)
---If that's ALL you hide, then you'll be found by all of these tools.
Wrong. If I control the CPU as kernel level, I can do anything I want. Next of all, if I use custom tools, good luck trying to find them. Well, the only way to find them would to
Re: (Score:3, Insightful)
That's true.
The OS is too untrustworthy after you hook it on a network (in Windows case especially).
Windows is no more vulnerable once you've got a kernel hook than Unix/Linux/whatever is. If anything, Linux is more vulnerable because figuring out the appropriate places to hook in Windows is a lot harder without source.
("Security through obscurity" is a bad idea -- but obscurity can be a layer and be helpful as long as you design and impl
Re: (Score:2)
Re: (Score:2)
Easier solution... (Score:5, Funny)
Got it (Score:2)
Those who don't know, BitDefender Antivirus has rootkit detection and removal since v10. It was released back in Aug-Sept 2006.
Blue Pill (Score:3, Interesting)
Re: (Score:3, Informative)
There are actually a few other ways to detect if you are running inside a VM, e.g. use of a non-priviledged instruction that reveals information about memory mappings (here [codeproject.com]). However, there is still an arms race: the rootkit programmer mig
Re: (Score:1)
That only would detect VMWare-style virtualization; to the best of my knowledge, the hardware virtualization that's now in chips (VT and whatever AMD calls theirs) should eliminate this possibility and force you to go with timing tests.
Re: (Score:1)
Re: (Score:1)
Faster IceSword Link (Score:2)
Where can I download... (Score:1, Funny)
Oh, wait...
change mod from (Score:2, Insightful)
Re: (Score:2)
Correction, and possible next step in arms race (Score:2)
Wish I could remember the name to give the guy credit, but someone's pointed out that even booting from a CD doesn't necessarily give you a trustworthy system if there's malware flashed onto a graphics card that the BIOS detects and configures before the CD takes over.
Re: (Score:1, Informative)
Re: (Score:1)
Oh, we say to thee (Score:1)
The warning box, I did not see
OK I clicked on, I spent freely
then My Ruin passed on, gleefully.
--A user's lament
snarkth
Root of the problem with Windows (Score:4, Interesting)
As regards the article, I read most of it, and might finish it later, but I wasn't too impressed with it or with the rootkit-detection tools that I've experimented with in the past. I'm supposed to be something of a computer expert, and I've certainly been using them long enough, but I regard myself as pretty much a helpless infant in these areas. If the NSA is planning to root my computer because I regard Dubya as an asinine embarrassment to my nation, I don't seriously expect to be able to do anything about it. Sure, I can use an expert's tools in many cases, but that doesn't make me any match for a real expert with corresponding tools. Or returning to the weapon metaphor, I may have a great gun, and even be competent enough in using it, but I'm sure that a seriously experienced killer would have little trouble taking me out, even with an inferior weapon.
In conclusion, "It's a poor craftsman who blames his tools", but it's also a poor craftsman who can't tell the difference...
Re: (Score:1)
And like any good weapons vender, you self-limit your product (so wayward purchasers lose the ability to maintain it without your help), backdoor it (so you can cripple it if purchasers have the audacity to try to improve it themselves so they can cut your support/upgrade strings) and only release it when you yourself have
What about Linux? (Score:2)
Once you've pulled out those pieces, then you can hopefully boot (what's left of) Windows, run some of the Windows-centric anti-virus ware in hopes of finding those pieces that clamav didn't find.
Rootkit detects you (Score:1)
Spelling blunder from down under. (Score:1)
I for one welco- eh. To hell with it.
Kangaroos are more than welcome to obtain low-level access to my OS. I've got mad respect for their built-in pockets.
Genetics wasn't as friendly to me. I had to BUY my Scott-E-Vest.
There's an excellent podcast... (Score:2)
Also, getindi [getindi.com]!
an alternative approach (Score:1)
Comment removed (Score:3, Insightful)
on rootkit detection, MD5 etc. (Score:2, Informative)
Another dude said "but my rootkit detect attempt to MD5 and returns the correst sum". Kind of, it s even better than that for the best of the breed: they recognize themselves in *any* attempt to read the file and replace their code (that they recognized) with the code that the file is supposed to contain at that place. What I mean is: you don't specifically decide to
Avoid Rootkits (Almost) Altogether (Score:1)
Yes, some programs still require Administrator access to install, although in some cases you just need to give the Limited account access to write in the global Startup menu folder or something similar, so this isn't a 100% cure-all.
You can't find rootkits inside an infected system (Score:2)
The only way to find a well written rootkit is to boot from a certainly uninfected bootdisk (or CD/DVD) and scan with it. Everything else is at best working against less sophisticated k
Great! Better testing for Rootkits! (Score:1)
Re: (Score:2, Informative)
Re:Rootkit (Score:4, Insightful)
Re: (Score:2, Interesting)
I would not bet my life on that. Even though I consider the default security in my choice of GNU/Linux distro to be tighter than OS-X, I still use Knoppix (a CD based GNU/LINUX OS) for internet banking. It is the only TRUE assurance of safety from being rooted.
Re: (Score:2)
1. Boot with a Knoppix CD to do banking
2. Virus hides in Video
3. You reboot, virus installs itself and PROFIT!
Mark
Re: (Score:2)
I imagine it is theoretically possible... but to my understanding highly improbable.
The Bios would have to be reverse engineered, modified and reburned to add the code to execute the rootkit(even if it resided elsewhere). Since it seems that every motherboard has a different Bios image... this would be a lot of work.
Re: (Score:2)