Slashdot Mirror
Windows Rootkits
GuidoJ writes "The Register is running an article by Kevin Poulsen of SecurityFocus Online about rootkits in Windows NT. While rootkits are a well-known issue in Unix and Linux systems, they have rarely been found on compromised Windows machines. According to the article, Windows NT backdoors have always been 'trivial', and they have caused enough havoc already. Imagine what a stealthy rootkit could do!"
I thought Windows WAS a rootkit.
..There's a-dooin's a-transpirin'
What I mean, is that what are you going to do from a windows remote terminal? I mean honestly, it's not that cool to have a windows terminal server session open (presuming that service is even set up), and even though you can telnet into windows, hacking in DOS just isn't 1337 enough. :P
Watch as I type edit and the screen goes blank!
Karma: Chameleon (mostly due to the fact that you come and go).
I thought this was called "Windows Update"...
Stop by my site where I write about ERP systems & more
...is approaching parity with Linux.
alias uptime="echo '5:33pm up 22342352324 days, 6:28, 2124315623 users, load average: 2432.40, 12312.31, 123123.19'"
quote:
"The stealth driver in my mind is the scary concept," says Mertens. "You can hide an elephant with it."
So the first thing they do is hide the \winnt folder?
.
Have you read the moderator guidelines? Well, have you, PUNK? (and I want a Karma: Gnarly option)
Aha! I compromised a process running as root (for example). What shall I do now? I know, I'll insmod IHAX0REDUGOOD.so after dld'ng it from my xoom.com warez page. Oooh, now I can install zombieslaved and use IHAX0REDUGOOD to prevent anyone from seeing it.
So what about this is more difficult than windows? An API must exist for a driver to be loaded, therefore it can be exploited. The tool that interacts with a user installing a driver uses this API, the rootkit bypasses all possible interaction (and uses its priveledged position to hide its existance)
Fuck Beta. Fuck Dice
Jon Littman wrote an interesting book about Kevin Mitnick entitled The Fugitive Game. In it he partly addresses the situation of an FBI informant and not-so-l33t hax0r, Kevin Poulsen. 100 to 1 this is the same l33t hax0r. Way back in the day--1990--Poulsen was described as not very l33t:
Now I grant you that 13 years is a lot of time for someone to change and learn to abandon stupid sensational media tactics. But look at the substance of the linked slashdot article : "I wrote a rootkit for Windows, I'm cool, and I ran a script kiddie workshop so lots of people can do it! By the way, I screwed up the old code. But the new ones the evil hax0rs will make will be really bad. .. So hire me as a consultant!"...um, yeah, right.
We recently had heard in the office over one of the Yellow Machine that's made by Anthology Solutions.
For what the article say, it is more a BSODkit than anything else.
But why would you do that? Delerious you are! That would be so hard to command.Compare that to a simple telnet session.
Why install a rootkit when there are so many other, much easier vulnerabilities to exploit? I mean, come on... What haxx0r has time to write a rootkit, when they have oodles of options at their fingertips? It's the difference between a script kiddie and a real h@xx0r..
If it were me, I would just find a buffer overflow, and have some fun..
Slashdot.. Land of nerds, trolls, and FlameBait..
hey, be careful, actually knowing how w2k and xp work could get you banned from slashdot.
Vote Quimby!
A simple windows r00tkit can be found here. :)
Karma: pi (Mostly due to circular reasoning in posts).
His name is Kevin Poulsen...
His name is Kevin Poulsen...
His name is Kevin Poulsen...
Gates' Law: Every 18 months, the speed of software halves.
Did you ever try to boot a CD-R on a machine that doesn't support bootable CD's? It's not much fun.
I heard that they put code in Windows XP that will drink your last beer, leave the toilet seat up, and sleep with your wife while you are at work.
Manipulate the moderator system! Mod someone as "overrated" today.
Is that like pouring a bucket of water into the ocean? Or bringing a boxed lunch to an all-you-can-eat buffet?
"I'm absolutely, one hundred percent positive that there's probably ten more that we haven't seen publicly,"
Any sufficiently simple magic can be passed off as mere advanced technology.