Slashdot Mirror
Microsoft Warns of Impossible to Clean Spyware
darkjedi521 writes "The Inquirer has a story that the next generation of Windows spyware and exploits are starting to make use of "kernel rootkits". A paper at Microsoft Research has details on a prototype detection tool. Computerworld has more details, as well." From the article: "Newer rootkits can intercept system calls that are passed to the kernel and filter out queries generated by the software. This makes them invisible to administrators and to detection tools..."
Sounds almost malaprop. "It works, I threatened to rip a copy of Ghostbusters II onto my HD and I heard a tiny scream! My spyware aragorn!"
However the paper admits that the only way to be sure that you have killed a kernel rootkit is to completely erase an infected hard drive and reinstall the operating system from scratch.
That sounds rather drastic. How about drilling a hole through it, smashing it with a sledgehammer and throwing it into the Tiber while you're at it? Microsoft seems to be making a stronger case all the time for not exposing a Windows PC to the internet. Maybe it is time to look at a Mac.
Microsoft's XBox Firewire
A feeling of having made the same mistake before: Deja Foobar
A programmer is a machine for converting coffee into code.
There's a very simple SOP for Windows users that will completely eliminate the need for a fix:
1. Buy new PC
2. DO NOT PLUG IN NETWORK CABLE
3. Image drive to external storage wth Ghost or the like
4. Unplug external storage
5. Plug in network cable
6. Connect to Internet. Save any info needed for storage.
7. Unplug network cable
8. Print all info obtained in step 6
9. Plug external storage back in
10. Restore image made in step 3
11. File hardcopies in cabinet
12. Knock back 3 or more shots of your favorite liquor
13. Unplug network cable
14. Return to step 3 for new Internet sessions
What could be simpler?
They are the ones who made it impossible to delete Internet Exploiter after all.
Beep beep.
Well, at least Windows is catching up. We've had rootkits on linux forever! :)
Karma: SELECT `karma` FROM `users` WHERE `userid`=138474;
Boot a clean kernel from removeable, non-writeable media (closed-session CD or write-protected floppy) when doing the rootkit detection. (some details are left to the reader as an exercise)
...rootkits for Linux are also a bitch to find and get rid of. It's only because we have had this risk for longer that we have good tools to find, remove and otherwise manage the risk... but how many Linux users actually do this?
Probably the same five who spool logs to another sever as well as write-only tape and run everything in chroot I suspect.
Beep beep.
In the old pre OS X days, most Mac viruses were INITs (AKA Extensions) which are rewritten system calls. I remember a virus from the olden days which was an INIT that spread through a DiskInsertionEvent.
"Only in their dreams can men truly be free 'twas always thus, and always thus will be."
--Tom Schulman
Funny how many people seem to take this lightly. The way I see it:
Reinstall Windows
Reinstall all Software, include some pesky registrations
Update all drivers to where you were before hand
Put back all your customizations, default settings, etc.
Yeah, not impossible, but makes a boot to the head sound appealing.
A feeling of having made the same mistake before: Deja Foobar
Install SP2 before you connect a Windows XP machine to the internet.
The last time I connected a fresh Windows XP RTM box to the internet, it was infected with MS Blaster in 6 minutes.
Windows XP Service Pack 2 on CD FREE
"TK-421, why aren't you at your post?"
Can you install a linux rootkit by viewing a web page in Mozilla / Konqueror?
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
As far as I know, rootkits like that have been the norm rather than the exception on Linux and, I think, the BSDs for some time. I don't know about the other UNIXes and UNIX-like OSes (like MacOS/X), but I'd be surprised if it wasn't the case to some extent there too.
It's been widely recognised for a while that if your system is cracked, the only way to be fairly sure you've cleaned it is to reformat it and start again then *carefully* restore data from backups. I don't see how this is news.
You're telling me that when joe user installs his linux version of kazaa and it pops up the message, you must install with root... enter password... linux solaris, mac, anything will be immune to the malware? I think not. Users dont read popups. If they are prompted for root... they will type it in.
Ive even seen macromedia flash boxes pop up to alert you that IE has blocked their activeX script, and the user should do the following steps to install the plugin. And people do.
Big deal! Linux has had this for like... ever now!
;-)
Oh wait...
Have a Happy.
With Linux, you can boot from a live CD and validate every file and package on your system.
You can even chroot the system, wipe the boot sector and re-install the kernel.
This might be "impossible" to clean on Windows, but on Linux, it's just really annoying.
There does exist a tool called "linkd" in the Windows 2003 Server resource kit, which allows you to set mount points via the command line.
So you install a system. Use two partitions. Pull the drive. Install 2nd drive on working windows machin. Copy the "Documents and Settings" to the second partition of the newly installed drive. Then use linkd to create a "Documents and Settings" mount point from one partition to the other.
As a semi-serious builder/hobbyist, when I build a system, I use preconfigured sysprep images where I have already done this (the mount point linkage IS copied by programs like ghost that support NTFS5). I can restore a single partition or the whole disk. Either way. I distribute a restore DVD to my customers that can fix their spyware- and virus-hosed Windows installs without killing all the pictures they took with their digital camera etc.
It took me a bit of fiddling to make sure I have the process right, but for the number of times it's saved me two hours' work, I almost want to cry.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
> Yeah, not impossible, but makes a boot to the head sound appealing.
Well, you can make a custom XP CD slipstreamed with SP2 including all of your drivers and programs that get installed automatically.
It's not quick, and it's not for Mom and Pop, but once it's done, reinstalling is a breeze and the time spent pays off the first time you use it.
Actually, most *NIX rootkits have been intercepting system calls to the kernel and replacing common command tools that might be used to detect and remove them for ages. I haven't heard of one that can avoid detection by the likes of Chkrootkit and Rootkit Hunter yet, other than by being brand new of course. Naturally, that doesn't automatically mean that it's impossible to write one though.
UNIX? They're not even circumcised! Savages!
Unless there's something really new and complex going on here, not only is this not new, but IT professionals already have ways of dealing with it. In our case, on a live system with one reboot required. I wouldn't call it minor, certainly (10 minutes of downtime is 10 minutes of downtime), but... hell, if script kiddies have been using this for months and months...
Easy enough I thought, I'll just remove physically the file and the process. But no; the file wasn't ANYWHERE. Yes, I unchecked the "Hide protected system files" checkbox and I was on SHOW HIDDEN FILES, so ALL files were displayed. Heck, a dir /s on the root of the filesystem didn't even work... I thought that it would be possible that the file has another name, renamed itself to that, made its dirty business then renamed itself. I fired up Filemon (from Sysinternal) and sure enough, I see plenty of activity from a process named elitegfk.exe but STILL no sign of the file and/or process. I scanned the registry, and regedit.exe took 2 seconds to complete the scan... !
I was on the verge of reformatting the system when I thought about something: I accessed the laptop through the admin share (\\computer\c$); sure enough, the file was there, sitting quietly sitting in c:\winnt\system32 (Win2k system)...
The spyware prevented its own display through taskmgr, explorer and regedit. Regedt32 didn'T work, I got a virtual memory low error when I tried to scan the registry. The ONLY way I could see the file was through Filemon AND through the file sharing...
I'm guessing next one will palliate to those things by attaching themselves to the most common troubleshootings tools like regmon and attach themselves to the SMB protocol to make sure they can't be displayed through the shares...
This is getting ridiculous. Yes, you'll tell me to switch to Firefox, but we can't; I work in an artistic company with 1000+ PC and non-tech-savyy users, and tons of internal apps that were developped either with .Net or massive ACtiveX and other MS-only stuff, so we can't switch everything to Firefox, and having 2 browsers isn't a viable option either, since most of our users would simply get confused.
Anyway.
Why do these people compile and install trojan software? Don't they do a code review before installation?
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I don't think a *nix kernel rootkit has ever existed, where a program can modify the kernel and is impossible to remove.
+ kernel&btnG=Google+Search
It would have taken all of 30 seconds to google in advance:
http://www.google.com/search?hl=en&q=unix+rootkit
--A closed mouth gathers no foot.
Yes UNIX system have had rootkit problems for a long time.
However, how did those rootkits get installed? Typically through holes in services, like FTP server exploits or web server exploits or whatever.
But OSX has none of those running by default. That's right, none. So while in theory possibly you could develop an exploit against, say, Apache on the Mac (the port you'd most likely be able to get to) it wouldn't reach many people at all, and so the user base would have to be quite huge to make it worth the effort to even try.
The other potential vector is user apps like the browser or users simply running a silly program. But there the app has a greater hurdle, as no users on OSX are "root" users and thus are unable to easily install a rootkit. At best you'll get an admin user to possibly type in his passsword, but that will again affect a lot less people as not so many will be willing to type in an admin password just to see blinky the fish swim around on-screen. Compare and contrast with so many Windows users that run Admin because some games require it.
Lastly, let's say a rootkit does get through. Software update runs on every Mac by default every week, so Apple has a chance to go after it that way. Possibly of course they can intercept what Software Update is doing, but it adds another layer of compexity to what they are doing.
Yes possibly the same thing can be done on a Mac. Just as someone can break into a car stored in a private garage - but it's a lot less likeley than if you leave your car parked on the street in an iffy neighborhood, which is what all Windows boxes are nowadays. With SP2 all the've done is decided to park under the streetlight instead of in the shadows.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Step 1 - Install linux -end
Good Karma, Bad Karma, doesnt matter to me... I'm still going to say whats on my mind!
Damn.. now I'm going to have that theme song in my head all day.. :->
When there's something weird,
and it don't look good
Who ya gonna call?
MI-CRO-SOFT??! (Wait..)
I am the maverick of Slashdot
OSX is more secure in many ways. For those that know what they are doing... (they usually don't get infected but that's beside the point) you can use the "chflags schg " command as root to lock a file so that it cannot be modified. The flag can only be cleared in single-user mode. Standard linux distros with ext2/ext3/reiserfs don't have that. I'm not real up to speed on WinXP or 2003, so I don't know if they have a single user mode (or a real multi-user mode ). But OSX can be hardened to where you can be sure the kernel or critical libs cannot be updated.
Sure, there's Bart's Preinstalled Environment bootable-cd-maker but MS really should release a bootable CD of its OSes, complete with cleanup- and other system-maintenance tools, to the community. Heck, I wouldn't even mind typing in my MS-Windows serial number or inserting a floppy that had a key-holding file copied from my hard disk every time I boot. Heck, I'll even pay $5 for the media and give Microsoft my name and address for a tool this useful.
Knoppix rocks but there are some Windows-maintenance things that are much easier in a Windows-booted environment.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
R00tkits will get installed on Macs the same way they get installed on Linux: through a combination of two exploits. First, the hacker uses an exploit to obtain shell access with an unprivileged account Typical exploits include holes in Samba or CUPS (which OSX also uses), browser bugs (e.g. libpng overflows), holes in various daemons (if you use your OSX as a server), or even simply using a keylogger on a public machine to catch a user's password.
Then, the hacker uses a second exploit to elevate his local shell access to local root. Typical exploits of this nature include thread race conditions in the kernel, the kernel failing to properly sanitize input, or problems when a process is shifted from one kernel security infrastructure to another. The Linux kernel had a number of local root exploits in the past few months. IIRC Apple usually doesn't publish its list of security vulnerabilities (it just puts the fixes on Sofware Update, without fully explaining what they fix), so I can't comment on the security of the darwin xnu kernel.
Thus, I would say it's about as easy to install a rootkit on a Linux workstation as on an OSX desktop (and similarly, it's as easy to install a rootkit on a Linux server as on an OSX server). In other words, you need an unpatched system vulnerable to a specific pair of exploits, a clueless admin, and a skilled hacker -- which is not an impossible combination.
how flawed this operating system is.
Flaw #1: Any app can make arbitrary changes to the registry.
Flaw #2: Any app can make arbitrary changes to the system files.
Flaw #3: There is no "safe-mode" for core utilities, that would bypass any hijacking of system calls.
Now can anybody explain to me what was the point of having "system, readonly" attributes, if they can just be turned off?
Bill Gates never wanted to admit it. But this is just proof that Windows is nothing but MS-DOS "on steroids".
Till a few days ago, I thought Linux would be the doom of Microsoft, defeating it like David defeated Goliath. But it turns out.. Goliath is about to die from a genetic anomaly. His very nature gave him a short lifespan.
Oh joy...
One of the computers I support had a very nasty piece of spyware. I am not sure if it was exploiting the same things described by Microsoft, but it had the following symptoms:
1. The process would not show up in task manager
2. The related files would not show up in Explorer
3. The related registry keys did not show up in regedit
4. It some how was being called by Winlogin, so it ran even in safe mode.
The way I detected it was by using several Sysinternals utilities http://www.sysinternals.com/. I have a script that uses pslist to monitor all processes on the network and this spyware was not smart enough to hide from that. A remote regedit session enabled you to see the related registry files. I had to use BartPE http://www.nu2.nu/pebuilder/ to mount the drive and clean out the related files and registry keys.
For microsoft to make a statment such as this could only mean one thing, they intend to push for trusted computing. Watch for them to lobby the government(s) for this:
trusted computing
Enjoy,
It's just the normal noises in here.
Is this a joke? You boot off the CD and then the most complicated thing you have to do from there is choose your timezone. You don't have to know anything to install Windows XP...
OH BS... unless XP has the drivers you need bundled with it, you aren't connecting to a network, and you're only planning on using solitaire and not gaming, there's a lot of work to do to get a system installed right. Oh, hope the user doesn't start with a pre SP1 install.. connecting to the network will be really fun then.
Do not spread "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0" over the internet, thank you.
I think the root of the problem is that most Windows systems (unless centrally managed) are usually setup so that normal users are logged in with elevated priveleges. If they were logged in without supernatural priveleges then the damage done by the spyware, viruses, and trojans, would be limited just to your account and files (e.g. the rest of the system, and certainly the kernel, would be unaffected). So, it seems like the best strategy to fight spyware is to end the current practice of using the administrator account. I am sure that microsoft could even do something to discourage its use.