SysInternals Releases RootkitRevealer

Brian writes "In the wake of news that Microsoft is developing prototype software to detect rootkits, SysInternals has released a free rootkit detection tool named RootkitRevealer for all Windows systems NT4+. RootkitRevealer works by "comparing the results of a system scan at the highest level with that at the lowest level," and detects every known rootkit at rootkit.com. They also report that it is impossible to know for sure that a given system is clean from within it, but that defeating their tool would require a level of sophistication not yet seen. You can download RootkitRevealer."

Comments

handy

[diegocgteleline.es]

This will be interesting as soon as spyware starts using rootkits in windows.

You know, Microsoft is securing (really) XP with the SP2, popups-blockers, restrictions on activex objects....which is great, but Microsoft has allowed a whole industry to grow - the spyware industry. There's lot of money there and they aren't going to stop so easily, they'll try other methods, and the fact that 99% of XP users runs with administrator privileges is too sexy, it allows you to reach the kernel, where you're god and you can bypass spyware/virus programs...(and if today's spyware is very poorly designed and can break your IE eve when they don't really wnat that, guess how systems will start to break if rootkits are started to use....)

Re:handy

[Tim C]

The real problem isn't people running as adminstrator; I do so at work and at home with no problems. The problem is naive computer users who run/install content from untrsuted sources, don't run (up to date) AV software, don't use a firewall, etc.

Even a system with zero exploits will not be safe from an incautious/careless user with the admin password. Even if all IE, ActiveX, etc holes are plugged, malware will still be installed piggy-backing on or masquerading as legitimate software installations.

MS hasn't allowed the industry to grow, they just gave it a nice, easy start in life. The crap would still have been developed without their inadvertant help.

Re:handy

[skubeedooo]

I meant more in terms of privacy than persitancy. For example, if someone gets access to your bank details, you could become very poor very quickly. I'm not sure what bank policy is about this, but i imagine you are treading on thin ice. If one's home-made films stored on one's home computer got stolen, this could also causea big problem. There are lots of other important privacy things like this (unrelated to big-brother tinfoiling bullshit); i'm sure you can think of more.

Re:A level of sophistication?

[LiquidRaptor]

Yeah, but at the moment this is a BIG help for people, plus I'm sure that as new rootkits become availible they'll update this puppy. But it's not like linux doesn't have it's own rootkit detector http://sourceforge.net/projects/checkps/. Any server operating system is eventully going to have exploits if it's got any use, it's a fact of life, this tool helps find out if you got rooted, no more no less.

Re:Rootkit?

[slavemowgli]

Why not? The purpose of a rootkit is usually not so much to take over a box (trivial on a standard windows installation), but rather to hide the fact that such a take-over occured.

Re:Sysinternals is great

[cnettel]

Agreed.

One can note that Microsoft is stopping some kinds of hooking of individual kernel functions in the AMD64 release of XP. It's motivated by the fact that it won't break binary compatibility with existing code, as it would be broken anyway, and that it leads to sounder use of the API. It makes some rootkitting harder, and tools like regmon (not filemon, as it can hook as a filesystem filter driver). It doesn't make any of it impossible, though. It should really be noted that some of the low-level tools from sysinternals use very similar techniques to what a rootkit would do, just that they do it for monitoring and not with falsification of data as intent.

Reputation Counts

[Ridgelift]

Mark Russinovich and Bryce Cogswell have been providing invaluable tools for years. Even if Microsoft released a rootkit detection package tomorrow, I would still use sysinternal's over anything Microsoft provides because "there is no anonymous team of programmers or writers behind Sysinternals". They put their name on everything they give away and sell.

When it comes to trust, people put their names on things they know are trustworthy. I can't count the number of times I've felt betrayed by Microsoft's products not doing what they're supposed to do, only to discover a flaw in their product that they knew about but didn't tell so as not to affect sales. I also can't count the number of times utilities such as NTFS for DOS have saved my butt in the field.

Way to go Sysinternals.

Incompatible?

[gr8_phk]

"It should really be noted that some of the low-level tools from sysinternals use very similar techniques to what a rootkit would do, just that they do it for monitoring and not with falsification of data as intent."

I can see it now. The future Microsoft product (which might come free with the OS) will say this other tool is a rootkit and remove it. This area of security should be very interesting to watch.

How do you REMOVE a rootkit?

[Eric_Cartman_South_P]

This is good and all, but how do you remove a Rootkit if it finds one?

Re:A level of sophistication?

[Anonymous Coward]

What is to stop a rootkit from putting itself in the BIOS or the firmware of your hard drive or CD drive? How would you detect a rootkit living in the flash memory on your Nvidia card? I doubt most people are going to be desoldering chips to check for rootkits which is what would be required.

Re:Like a partition?

[Technician]

Would standard MBR scans catch that?


It would be hard to hide from any Linux Live CD's. You boot a read only file system (not modifiable by a bug), load a trusted application (FDISK or Disk Druid) and check the partition table. Not much can hide from a scan from a non-compromised OS.

Re:Call to arms

[Phisbut]

Good idea, but i'm waiting for the first batch of viruses or whatever to disable this rootkit.

Other than nothing that RootkitRevealer is not a rootkit itself, it's also nice to see that Sysinternals knows the weakness of their products, how it can be exploited, and how it is very very unlikely that it will be.

It is theoretically possible for a rootkit to hide from RootkitRevealer. Doing so would require intercepting RootkitRevealer's reads of Registry hive data or file system data and changing the contents of the data such that the rootkit's Registry data or files are not present. However, this would require a level of sophistication not seen in rootkits to date. Changes to the data would require both an intimate knowledge of the NTFS, FAT and Registry hive formats, plus the ability to change data structures such that they hide the rootkit, but do not cause inconsistent or invalid structures or side-effect discrepancies that would be flagged by RootkitRevealer.

The complete opposite of security by obscurity. I like that.

memory hog

[v1x]

I suppose this program loads the entire system hives into the memory at the same time, but my task manager is showing this program using 89Mb RAM & 82Mb virtual memory right now while the scan is running.

Now, if I had to defeat this detection utility, maybe all I need is something that monitors processes that use RAM in this fashion.