Slashdot Mirror
SysInternals Releases RootkitRevealer
Brian writes "In the wake of news that Microsoft is developing prototype software to detect rootkits, SysInternals has released a free rootkit detection tool named RootkitRevealer for all Windows systems NT4+. RootkitRevealer works by "comparing the results of a system scan at the highest level with that at the lowest level," and detects every known rootkit at rootkit.com. They also report that it is impossible to know for sure that a given system is clean from within it, but that defeating their tool would require a level of sophistication not yet seen. You can download RootkitRevealer."
Every time I try to go to www.sysinternals.com to find the new Rootkit removal application, my system shuts down automatically.
Probably nothing to worry about.
I'm a big tall mofo.
No really, they have class utilities for free, thanks Sysinternals
Sample this!
Wow. Pop-up blocking, rootkit detection, basic network security... isn't it amazing how an enormous patent library and billions of dollars encourages so much innovation? It's like they're ten years ahead of everyone else.
Wait... no, the other way around...
Free Sony PSPs. It's real. It's here.
I didn't think people needed rootkits for windows...
>> RootkitRevealer works by "comparing the results of a system scan at the highest level with that at the lowest level,
So this is a rootkit in itself.
I don't know that I'd trust Microsoft anymore than anyone else running rootkits on my ststem.
This will be interesting as soon as spyware starts using rootkits in windows.
You know, Microsoft is securing (really) XP with the SP2, popups-blockers, restrictions on activex objects....which is great, but Microsoft has allowed a whole industry to grow - the spyware industry. There's lot of money there and they aren't going to stop so easily, they'll try other methods, and the fact that 99% of XP users runs with administrator privileges is too sexy, it allows you to reach the kernel, where you're god and you can bypass spyware/virus programs...(and if today's spyware is very poorly designed and can break your IE eve when they don't really wnat that, guess how systems will start to break if rootkits are started to use....)
defeating their tool would require a level of sophistication not yet seen
What, until tomorrow?
If you run linux you can use chkrootkit
The GeekNights podcast is going strong. Listen!
Yeah, but at the moment this is a BIG help for people, plus I'm sure that as new rootkits become availible they'll update this puppy. But it's not like linux doesn't have it's own rootkit detector http://sourceforge.net/projects/checkps/. Any server operating system is eventully going to have exploits if it's got any use, it's a fact of life, this tool helps find out if you got rooted, no more no less.
"RootkitRevealer works by "comparing the results of a system scan at the highest level with that at the lowest level," and detects every known rootkit at rootkit.com."
So its kinda like telling my computer to turn its head and cough, right? *squeeze*
-- Game Developers: Stop porting badly-textured games from crappy console systems!
...and goes by the alias "SysInternals".
Forget the vatican and mecca, point your browsers to http://www.sysinternals.com and pay homage.
As the sysinternals article suggests, boot from a known clean CD and do an "off-line" system scan. They make the point that it will never be possible to determine with absolute certainty that a system is clean from inside the system.
Floating face-down in a river of regret...and thoughts of you...
I don't know anything about rootkits, or this software, is it safe to delete everything it detects or is this for people that know exactly what they are looking for and you only delete a couple of things it finds?? In other words is it foolproof?? I'm sorry that was a bad question. How foolproof is it??
Viruses don't disable rootkits, they install them. Rootkits are replacement system programs/libraries to hide the intruder presence/activity on your computer
Linux is not Windows
While you're at it, download the Microsoft Baseline Security Tool. It's not quite the same, but it's an excellent tool for anyone looking to make their Windows box more secure. It can also scan computers on your network (that you have rights on), so you can easily find all the Windows boxes on your network that aren't up to date on their patches, have Guest accounts enabled, or other bad things.
You have enemies? Good. That means you've stood up for something, sometime in your life. --Winston Churchill
Funny enough, when I tried to run RootKit Revealer, I got the 'Root kit detection utility has encountered a problem and needs to close. We are sorry for the inconvenience.' Error. Not that that's suspicious, or anything like that...
RLU 180035, get yourself counted at http://counter.li.org
waiting for the whoppix project to produce a livecd distro I can just pop in...
The Answer
Mark Russinovich and Bryce Cogswell have been providing invaluable tools for years. Even if Microsoft released a rootkit detection package tomorrow, I would still use sysinternal's over anything Microsoft provides because "there is no anonymous team of programmers or writers behind Sysinternals". They put their name on everything they give away and sell.
When it comes to trust, people put their names on things they know are trustworthy. I can't count the number of times I've felt betrayed by Microsoft's products not doing what they're supposed to do, only to discover a flaw in their product that they knew about but didn't tell so as not to affect sales. I also can't count the number of times utilities such as NTFS for DOS have saved my butt in the field.
Way to go Sysinternals.
Ruby on Rails Screencast
Is it just me or do other people think this is just part of the on going line of propaganda to undermine current technology and make people more open to the idea of Trusted Computing, formally know as Palladium??? I know the current software isn't perfect but you'll never have a completely safe system, so longer as the user operating it has system administrator privileges. Trusted computing or the solution to the above problem is to implement security access that even the owner of the system is deemed untrustworthy.
I can see it now. The future Microsoft product (which might come free with the OS) will say this other tool is a rootkit and remove it. This area of security should be very interesting to watch.
For the same reason trackpads, wireless pointing devices, and such are called "mice", even though they look nothing like a mouse.... why solid state storage devices are called "flash disks" or "flash drives", even though there's nothing flat and circular in them and no moving parts... why the stuff in the middle of pencils is called the "lead", even though it's mostly graphite... why magazines featuring stories told with sequential art are called "comic books", even though they're usually not humorous.
http://alternatives.rzero.com/
Why are they called rootkits in windows, when the superuser is called "administrator" and not "root"?
The entity/app/device known as a rootkit was first popularized (so to speak) as a way for the intruder to hide his tracks and maintain root access on a Unix machine. If rootkits had first become popular (again, so to speak) on Win32 machines they likely would have been called adminkit or similar.
In a general techspeak sense, though, (root == full access); most techies have at least a nodding acquaintance with Unix so the idea of root makes sense regardless of the OS in question.
The cynical part of me would like to mention that in years past there really wasn't much need for rootkits on Win32 machines: if the intruder wanted to keep privileged access it would be relatively simple matter to acquire it again.
I want to drag this out as long as possible. Bring me my protractor.
Google and Sysinternals are the only two companies that always make me feel good about being a Computer Scientist.
If I were Google, I'd buy Sysinternals and have them help build GoogleOS.
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
Here are some good tools of their that I use frequently
Autoruns
http://www.sysinternals.com/ntw2k/freeware/autorun s.shtml shows a complete list of programs that start up automatically when windows starts.
Filemon
http://www.sysinternals.com/ntw2k/source/filemon.s html Filemon shows all filesystem access, so you can see which files programs are accessing. I have found it very useful in diagnosing software problems and fighting spyware.
Regmon
http://www.sysinternals.com/ntw2k/source/regmon.sh tml Like filemon, but for registry access. Shows keys being read and created.
Pagedefrag
http://www.sysinternals.com/ntw2k/freeware/pagedef rag.shtml Defrags the registry hive (most of the registry is stored on disk but is not typically defragmented by many tools) and paging file.
Also many others here
http://www.sysinternals.com/ntw2k/utilities.shtml
IMHO any windows admin should have this stuff installed. Many of the utils come with source code.
This is good and all, but how do you remove a Rootkit if it finds one?
What is to stop a rootkit from putting itself in the BIOS or the firmware of your hard drive or CD drive? How would you detect a rootkit living in the flash memory on your Nvidia card? I doubt most people are going to be desoldering chips to check for rootkits which is what would be required.
Hmm, it's interesting idea, and you could do it back in the Dos days - load above Dos, hook some vectors that allow you wake after it loads and the system is yours.
The problem is that Windows takes over completely - it switched into protected mode, overwrites all memory and generates its own interrupt vector table. Hiding from Windows wouldn't be too hard - you'd just hook the Bios to tell it not to use bits of memory when NTDETECT runs. The problem would be getting your code to run after Windows loads.
Actually, you could imagine a virus that virtualises the CPU (maybe with the Vanderpool stuff). That way you'd get called whenever Windows did some trappable operation like changing the page table. You'd wait until system structures has stabilised and then install your Api hooks.
It's non trivial though.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
For the hacker, priceless. This really accomplishes so little. Sure, here are your 'descreprancies', but they might not be that at all. Mostly Pointless. A good step, but only something the hackers will get control of well before this becomes mainstream.
No way will it let you remove itself. If you boot off of some sort of safe media and delete the thing, the computer no longer has the ability to read any of its data.
Yeah, I know I messed up the jargon, but I'm sure I'll be corrected on that. :P
Stop the Slashdot effect! Don't read the articles!
VMware is a very good way to neuter Windows and minimize some of its bad behavior. I've been beating the crap out of my windows development environment for two years straight with no re-installs of windows. My windows environment is hosted by SuSE Linux. I have reverted to a snapshot a couple of times, at a cost of a couple of minutes of downtime. Saving the original install off to somewhere safe is easy (just copy the virtual machine's directory somewhere else).
This sig kills fascists.
Would standard MBR scans catch that?
It would be hard to hide from any Linux Live CD's. You boot a read only file system (not modifiable by a bug), load a trusted application (FDISK or Disk Druid) and check the partition table. Not much can hide from a scan from a non-compromised OS.
The truth shall set you free!
Because "rootkit" sounds cool, like a plumber's tool or some sort of kinky sexual practice.
Just because you sold your soul to the devil that needn't make you a teetotaler. --The Devil and Daniel Webster
The hardware that the hosted OS sees is generic virtualized hardware. I've used the vm containing my Windows dev environment on 4 machines over the two years I've been using it. I haven't had to reconfigure W2K once. As long as the DVD (or other hardware) is seen by linux, then vmware will virtualize it and present it to the hosted OS as a generic dvd (or whatever is appropriate). For example, the dvd on my current notebook is a hitachi. It is presented to Windows as an NEC/Vmware CD.
This sig kills fascists.
Seriously though, at least two of those are listed in the article as being fine. Looking over the list, I don't see anything suspicious, and I have many of the same things listed for my system. Although if I'm reading that third line right, you have 9 GBs of bad clusters. You might want to scandisk.
Most people who run XP don't use a bootmanager, so the mere presence of one should be enough to ask the user why it's there, with the default action to disable it by installing the standard MBR / bootsector.
Oh, and microsoft kernel mode binaries are public key signed since windows 2000, so you don't need MD5/SHA - you can see if they are haxored or not by checking the signature.
Interestingly enough, you can do Start->Run sigverif.exe on a live system. The problem with sigverif is that it dumbly scans the windows directory for all files, not just the critical ones - I get warnings on a bunch of dlls, because they came with ancient 3rd party software.
Signature verification is the way to check the files on a bootdisk like BartPE or WinPE, though it would be need to be a bit smarter than sigverif.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Not to mention that if you have a rootkit installed, you better be prepared to wipe your system clean and reinstall the OS, because otherwise there's no way of knowing if you have the whole thing removed.
Microsoft purchases SysInternals this week; new Microsoft rootkit exposer available via Windows Update.
Polymorphic: Useless because the scanner would check for the original binaries. If the checksum doesn't match a know good list -> alert. Viruses don't bother with polymorphism anymore since scanner manufacturers defeat these schemes easily these days.
;)
Stealth: ALL rootkits are stealth (hide their presence). That's the whole point of a rootkit.
Dead space: Rubbish, data in dead space is never executed. It would have to be bootstrapped by normally visible code which is detected in the usual ways.
Bad sector: See dead space
Virtual system: See stealth
All in all I'd say your post is somewhat overrated
Your point is good (particularly the virus/scanner "arms race"), but not because of the halting problem. What you meant to say was the undecidability of the halting problem. Even so, to write off all automated analysis of software on that basis is a gross mis-generalization of the halting problem. The undecidability of the halting problem is a very narrow statement, and depends completely on the use of an algorithm to analyze a representation of itself. It is a theoretical statement of the power of an slgorithm, and has never been applied in a practical circumstance (to my knowledge, anyway; any such example would be eagerly anticipated). In fact, per the Wikipedia article, there is a generalized algorithm to solve the halting problem for any finite machine (though it is so inefficient as to be useless).
Floating face-down in a river of regret...and thoughts of you...
Other than nothing that RootkitRevealer is not a rootkit itself, it's also nice to see that Sysinternals knows the weakness of their products, how it can be exploited, and how it is very very unlikely that it will be.
The complete opposite of security by obscurity. I like that.
After 3 days without programming, life becomes meaningless
- The Tao of Programming
Root
In australia, root has several meanings, not at all nice. The sense is similar to f**k.
Accordingly something like root user has the connetation of one that roots your system.
SysIntern RootKitRevealer
I have a fairly typical multi-boot system, with two FAT16 partitions, a FAT32 partition, a reserved BeOS partition, a HPFS partition, and the usual swag of NTFS partitions.
The disk has been showing signs of corruption [bad sectors], and a replacement is in hand: already bought, but there are some backup questions.
RootRevealer had problems scanning registry. (i suspect one of the registristry hives is not well placed on the filesys). On the other hand, i ran the thing from BartPE, (it works), it revealed a whole swag of OS/2 binaries, but i don't know if OS/2 or Windows placed them there. They were meant to be there, by the way. Apart from the metadata files in each partition, there were error messages from non-accessable partitions (like F: (hpfs) and H: (unformatted = beos).)
OS/2 - because choice is a terrible thing to waste.
I suppose this program loads the entire system hives into the memory at the same time, but my task manager is showing this program using 89Mb RAM & 82Mb virtual memory right now while the scan is running.
Now, if I had to defeat this detection utility, maybe all I need is something that monitors processes that use RAM in this fashion.