Slashdot Mirror
Rootkits: Subverting the Windows Kernel
nazarijo (Jose Nazario) writes "A group of people out there, let's call them 'elite hacker d00ds,' are
able to skillfully craft Windows rootkits that evade almost any known detection
system. Some people want to know how this is done, be they aspiring
elite hackers, security professionals who have to try and find these
rootkits, or just interested parties. If you're one of them, Grog Hoglund
and James Butler's new book, Rootkits: Subverting the Windows
Kernel is for you. It's focused like a laser on how to defeat
detection at various levels in the Windows OS once you're in." Read on for the rest of Nazario's review.
Rootkits: Subverting the Windows Kernel
author
Grog Hoglund and James Butler
pages
352
publisher
Addison-Wesley Longman
rating
9
reviewer
Jose Nazario
ISBN
0321294319
summary
A highly technical tour of how to develop and detect Windows rootkits
Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.
The book is organized into three major sections, even if it's note explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.
The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).
By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.
In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.
I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.
In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up rootkit.com, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.
My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.
Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.
You can purchase Rootkits: Subverting the Windows Kernel from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.
The book is organized into three major sections, even if it's note explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.
The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).
By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.
In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.
I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.
In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up rootkit.com, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.
My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.
Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.
You can purchase Rootkits: Subverting the Windows Kernel from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Hopefully the hax0rs are not the only ones reading this. There are some valuable lessons for MS and security providers.
Jerry
http://www.cyvin.org/
I own this book and I thought it was great. I am not a rootkit creator, but I am woking with drivers, and the information this book gives is great for a driver developer. This book is very straight forward and understandable, even for someone with little driver experiance, unlike many resources for driver developers. Also it gives actual source code to illustrate concepts, unlike many books which spend too much time covering concepts and too little getting those concepts to do actual work for you.
Philosophy.
...how long it will be beofre someone tries to ban books like this?
I used to have a better sig but it broke.
Okay, so after glancing at the first two paragraphs, I had immediately caught three typos/spelling errors/capitalization problems. ARGH.
Duh... You can't make a book about, say, subverting the NetBSD kernel. You have to have something to write to make a book you know.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
All natural bandaids!
OMG SOEMOEN SI H4X0RING MAI B0X3N!1!
Here's a story of some peeps from Microsoft Product Support Services who got a call about a weird crash in Exchange; tracked it down with the debugger, and found a pretty well-hidden rootkit. In fact, it would've remained hidden if it didn't have a bug in it!
Don't believe everything the debugger is telling you!!! (aka Rootkit)
DMCA...no, that won't work. How about PATRIOT ACT! Yeah, those damn terrorists and their first amendment.
Give a man a fish and he'll eat for a day. Teach him to fish and he'll wipe out the species.
making windows rootkits is almost as easy as making linux rootkits, almost.
I was chatting up this chick in a bar last night and I said, "Yeah, I could root your box in about five seconds," and she slapped me! I thought that would impress the chixxors!
So that's why I get all these blue screens of death... I must have a root kit installed on my machine.. oh wait..
I keep thinking I need this book just to secure my own PCs and also help out friends...
You have to love the windows environment.
No, I don't trust in god. He'll have to pay up front, like everybody else.
I'll bet /. anything that this book is going to start churning out script kiddies.
how is babby formed?
This is something I have been interested in for some time. I can not wait to get this book and give it a once over.
I though merely installing Windows was subversion enough. Am I wrong?
-Security d00d
INSERT INTO comment VALUE('Doh!') WHERE user='you';
It is nice to see that you took the time to post a knee-jerk response, but could not be bothered to read the first paragraph of the article.
Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.
It's also a useful tool for advocates who try to convince people to switch from Windows to another OS (no, not just Linux), the argument being "look, you wonder if Windows is insecure? how about a whole friggin book, with an ISBN and all, about how to do nasty things in Windows despite A/V software and anti-spywares!"
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
I remember people had Linux boot disks for changing the Windows NT admin password. But does this kind of thing still work for Windows XP and the server editions? I wonder if Microsoft will take this info and use it in Windows Vista to counteract rooting.
Where I learned this. Well, about the rooting, not about the smoothing over chicks.
Click here or here.
I don't think I've ever seen Jose be so complimentary about a book before. Nice job, guys. I have the book as well, and I like what I've seen so far, but I haven't read enough yet to comment meaningfully.
I will point out though that the rootkit.com site has been around for a few years now, and obviously predates the book. In fact, I hope the book will explain in greater detail a lot of the technical topics from the site that are often only presented via code.
oh my god dude its crackers man CRACKERS are the bad ones, hackers are us angelic coders that do the world nothing but good. Oh my god why don't you understand me its just like at school when everyone made fun of me for being different they just didnt understand whaaaaaaaaaaaaaaaaa listen to me! hear me!
That's GREG HOGLUND. Not 'Grog Hegland'!
Sheesh, it's even written down on the front cover of the book that you supposedly have in front of you while reviewing it!
r0x0rz j00r b0x0rz, d00d
I won't need a Knoppix CD?
I should try this on my workstation...
...oh, wait. I run Linux. Nevermind.
What I like is that people are becoming more aware of the vunerabilities in these systems, which include Windows NT/XP/Vista (a single-user system subverted to multi-use) and Linux/Unix/Mac (which are multi-user to begin with.)
The Kai's Semi-Updated Website Thingy
do we really want that the Internet becamesa place of a higher order and full control? ;)
I think a little bit of chaos and anarchy is a really good thing.
And warzones are producing relly good payed jobs
But.... crackers get no attention. Hackers cause malicious attacks, they are the ones changing the world above politics and corporate BS.
If it wasn't for these spyware/adwares/hacks, there would have never been a need for firefox. That's just 1 tiny example.
How to subvert the Windows kernel? Just run it.
Wanna check the book out myself, given such the good response. I share several other's sentiments in believing it will be put to good use for the sake of security and everyone's wellfare, but let's be real: script kiddies eat this stuff up.
Kernels are so big and bloated that there is almost %100 chance of there being some exploitable whole in them. If the "good hackers" discover it, it will be patched, if the "bad hackers" discover it, they will make rookits.
A lot of the code that is not tested and buggy is in the drivers, and I don't understand why do current operating systems still have drivers that are run in the kernel instead of in the user space. The machines are fast enough to switch contexts between the display, mouse, sound, disk and communication with the ports. The kernel should be very small and only implement the security policies and handle communications between devices. If the hacker manages to exploit a hole in the display driver, the driver will not crash the system. These are called secure microkernels or separation kernels. I think the present 4Ghz machines can hangle a %10 slowdown at the expense of say, %80, improved security. In 18 months, the speed will double anyway ;)
Check out this paper from NIST that talks about this. Also, more general info about it here
Since its vaguely on topic, and I'd like feedback if I can get it, here is some shameless whoring for a Free rootkit detection program I wrote:
Heres the URL
This is a multithreaded script that establishes socket connections between the threads and tries to pass a keyphrase between them. The assumption is that even if windows is compromised, a successfull TCP connection will indicate that the port is really not in use, regardless of what netstat says. Unless a rootkit is slick enough to make multiple programs share a port regardless of SO_REUSEADDR, this should catch it. The drawback, unfortunately, is that it can take a significant amount of time to scan 65,000 odd ports in this manner. Anyway, its GPL, so have at it.
The core problem with detecting a rootkit is that the detection software would seem to need to run inside the infected codespace. Unless the detector is 100% self-contained (e.g., involves NO calls to OS API during the detection process) the detector is itself detectable and defeatable by a skilled rootkit. Since invoking any software on a running system means calling APIs of that system (to read the executable, spawn a new process, etc.) and those APIs are not trustworthy on a rooted system, detection seems like a tricky problem.
The solution is either to boot the detector from its own media (inconvenient if you want to scan your system for rootkits on any regular basis) or to create a ROM core to the OS that is totally incorruptible. To be safe, this core needs to be not patchable or modifiable by any software running outside the ROM.
The point is that no computer can trust code fragments stored of writable media. The only way to really secure a system is with hardware (i.e., functionality embedded in a chip) or ROM-based software.
Moving to ROM isn't without its challenges. The writers of the code will actually need to be very good at their jobs because they won't be able to fix the problem later with a simple patch. But maybe the core of an OS should be this way -- based on very well-written code that does not need patching.
Two wrongs don't make a right, but three lefts do.
Instead, when you buy the book, the FBI/DOJ will be studying who you are. Use cash.
I prefer the "u" in honour as it seems to be missing these days.
oh nevermind
You can get a great tool for detecting rootkits as well as a nice little explanation of them here.
Where is the "I for one welcome our rootkit overlords"? Or the "ALL YOUR ROOT ARE BELONG TO US"?
"Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves
It scans all files and registry entries at a high and low level then compares the two to see which files and registry entries were hidden to the high level scan.
Input error. Replace user and press any key to continue.
How many readers won't know what a root kit is, and declare 'ha, see! windowze is insecure, glad I run [alternate]'? :}
If you are running MS windows, is it then really your computer? Look good at the licensing, it might reveal some things in the really small print......
Ok, you got moderated as a troll, this should really score good!
My wife's sketchblog Blob[p]: Gastrono-me
Um... then why are you reviewing this book? Shouldn't you be at least somewhat familiar with the topic it covers? Saying that you didn't find any errors or omissions is akin to someone like me reviewing a book on - say - how to do brain surgery and concluding that it's good because I couldn't find any downsides.
When you don't know anything about the topic in question, then it's not surprising that you don't find anything that's wrong with the book. But it also means that your review is, basically, worthless.
quidquid latine dictum sit altum videtur.
-Linux, for those who hate MS.
-*BSD, for those who love UNIX.
Lasers don't focus, they naturally produce a beam of light in which all the photons are travelling in approximately the same direction.
just fyi.
She said I couldn't root her box because my hard drive was too small and I didn't have enough RAM. Then she said that all her ports were closed unless I had a fat pipe. Chicks these days, they want top of the line hardware, let me tell you.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
I have been waiting for the day that Windows rootkits will start compromising the various detection utilities as well, such that the only way to remove the kits is to run read-only from a trusted environment. Then they will all discover how deep the rabbit hole goes. Or something like that.
This is not a troll, because I think that is a sign of forthcoming higher maturity.
see this article!
Is this a response to that "Ask Slashdot" article?
P.S. This is a joke.
Use sparingly, please. The effect just isn't the same when you beat it to death like that.
Is this book legal?
Try before you buy and check out the book's sample chapter, Leave No Trace now!
There is a middle path, where perhaps the ROM can be modified only with very particular acknowledgement from the user. Say, the mod has to be burned onto a CD and booted, and before overwriting itself the existing ROM asks, "Are you 100% sure you got this from a reliable source?" It could even check the Net to check the signature, if it had sufficient IP stack built in.
This works best with microkernel architecture, which lets out Linux and Windows but OS X could conceivably go there. (And Windows actually could do it as well, since it is built around a kind of overblown microkernel.)
But still, the protected kernel isn't really the problem. You can't really hard-code detection software into it because there are always new rootkits that would require mods to the protected kernel. I just showed that it could be done, but it would be deliberately awkward, and so there's plenty of time for a new flaw to be exploited.
It would make it easier to clean the infection off your system without reinstalling, but if you're wiping out everything above the microkernel, you're effectively reinstalling anyway. During a regular reinstall, the BIOS acts as the micro-microkernel. So it's all the same.
I would think books that specifically tell how to bypass security in proprietary commercial applications would be a violation of the Digital Rights Millenium Copyright act.
Unlike PC users, Mac users aren't evil, soulless bastards, so they would never do anything as low-down as write a rootkit.
Because she couldn't even tell when I had it installed in her box. I don't no respect. No respect at all, I tell ya.
One book you'd find handy is a grammar one...
All of the pieces are coming into place. The world will crumble before me. With this book, and the power of AJAX I will rule!
But seriously, so when is MS going to sue these guys and the DOD target these enemy combatants???
lol, well, I wouldn't be surprised. Did I tell you about this guy that I read about recently? He was arrested for swinging a knife in front of his father. So he went to jail for a year because he was convicted for "terrorist threats". THE DUDE WAS DRUNK...
I mean come on, haven't we all got drunk and swung a knife in front of our fathers and threatened to... oh wait... must focus on AJAX rootkits!
What is with the constant irritating use of "In the finest tradition of"?
In any case, good to see long articles. Slashdot should have more of them.
If you encrypt the Windows Filesystem then there is no trivial way to get the data without the decryption key. This is breakable given time, etc. depending on how strong the encryption is.
It also makes it a royal pain to recover if certain things go wrong.
If you DIDN'T encrypt the filesystem then it is absolutely trivial to change the admin password, to put the disk in another machine, to boot linux and read the HD... etc. Because the data is completely insecure.
This is COMPLETELY THE SAME on Linux. You can boot any normal linux install from a boot disk and reset the root password. Actually in Linux you don't even usually need a disk, you just need to enter init=bash in LILO (depending on LILO/Linux settings; this can certainly be turned off)
Security means not giving people physical access, or at a minimum restricting the boot sequence to only be harddrive, locking the CPU, locking the BIOS and locking the boot loader. This is true in any OS.
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
I just got the winning bid on a Cray MP-X computer! I've wanted one of these since I was in high school back in 1988. It runs some old Unix variant called UniCOS, but considering the clock speed and RAM, I'm pretty sure it shouldn't be too hard to get Windows XP 64-bit running on it. That's one thing that always makes me laugh is how people are always buying the "latest and greatest" Pentium crap when it would be more cost effective to get a Univac, VAX or PDP-11 and just set up some x86 emulation on it to run Windows at blazing speeds.
I'm a Windows hacker and I know how to do all kinds of leet things with WIndows that would amaze the experts. In fact, I have a few tricks up my sleeve that even Bill Gates doesn't know about. But getting a Cray to run Windows is going to be one of my best feats ever. I prepped my home office for the possibility of getting a Cray about a year ago and cleared away a little space and got a grounded 110 vac outlet installed (my house doesn't have grounded outlets except for this one).
One of my oldest friends who knew me back in high school used to argue that if he could set up a cluster of five or ten Amigas, he'd outperfomr the Crays. Now I can finally get him to see the truth. My Cray running Windows XP is gonna smoke his thirty node Amiga cluster. It just goes to show you that Intel is a bunch of liars. Every time they've raised the clock speed on their procs, they've dropped the amount of bits that can be processed by the proc so things improve in an incremental way. Whereas, Seymore Cray got it right the first time when he chose massively parallel computing over serial prosessing. With Windows XP's SMP support it should be able to take full advantage of the Cray's parallel architecture. Just wait until I get Halo running on this beast!
-"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
And then ye must drink grog with us. GROG! GROG! GROG! ... and we're getting dangerously low on grog.
Well, it's not really an Apples-to-Apples comparison, of course. But to answer your question, No, it could not be installed "just as easily." However, once installed, it might be "just as difficult" to remove or detect. :)
Two main points:
Disclaimer: I am a Windows network admin (and MCSE:2003 certified), but I lead a double life where I use and administer a small network of Macs.
Misspellings til the cows come home
A group of people out there, let's call them 'elite hacker d00ds,' are able to skillfully craft Windows rootkits that evade almost any known detection system.
Shouldn't that be '1337 h4x0/2 d00dz'??? FOR THE LOVE OF GOD, STOP THE MADNESS!!
feh.
Have you ever tried to drink a Greg? Grog is much easier on the mouth and throat! -- Posted Anonymously by a coward.
That being said, windows is just notorious for crappy code in name of ease of use (which they achieve to some extent or other but with too much tradeoff and too much cpu hunger).
I have run both BSD and Linux in various flavors. I eventually settled on Debian and Gentoo. Gentoo for home and office use and Debian OR Gentoo for servers. If I need a rock solid monster server, then its probably gentoo or bsd.
Going onto security...
Rootkits have always been a threat to admininstrators everywhere, but in windows, even spyware can autoinstall various programs, and it takes a lot of work and authorization from microshit to actually change anything in the OS without violating the EULA.
Going on from there...
In any of the OSS *nixes *nuxes or *bsd's you're free to modify or change how the system works. Nobody will sue you or void your warranty. You're also free to learn how to code to standards that microsoft later revises and creates their own incompatible and buggy versions around.
This may sound like a troll but think closely, and you'll see I'm right. It isn't the fact that an OS can have rootkits... its that in windows, almost anything can install a rootkit without antivirus or spyware proggies to stop it (and most windows IDS are clunky at best and expensive for most small shops to own or operate.)
Last of all, think about it. Everyone talks about "securing your windoze box". WHY?!?! If an average user has to go through ALL that work (in their perspective) after they paid 300 bucks for that POS, then why not download linux or buy a batch of cds from cheapbytes. Same amount of work, better results, safer system (relatively) and linux will not fall apart if you disable system services. And you don't have to waste 20 minutes on the phone if you want to reinstall the system or pay MORE just to install it on another system. It helps if you make a donation to your preferred project
" What luck for rulers that men do not think" - Adolf Hitler
Get to work implimenting it then Skippy!
Yes, but it's only if they explicitly request a specific record. Libraries don't like serving this type of information.
Addison.Wesley.Professional.Rootkits.Subverting.th e.Windows.Kernel.Jul.2005.eBook-DDU.chm
Online backup with Mozy, sounds like Ozzie, but more!
A decent personal firewall like Kerio, will just expose all those foolish things that Windows tried to do without your knowledge. A properly configure personal firewall is good enough. After all nobody intends to use it for anything but entertainment. I haven't found a player as good as PowerDVD on linux once that happends I will make the switch for ever.
I hate it when non-technical posts get rated as informative. First off, as others here have misstated, rootkits are essentially malicious drivers or kernel-level backdoors. They are *not* exploits, not bugs, and not driver cracks. Rootkits are essentially malware that runs at a higher level than most malware, with the intention of using API-hooking to misreport filesystem, process, and network status. The expertise required to make them is generally several orders higher than DDOS zombies or botnets. Though ironically, that same kind of malware is almost always installed and then subsequently hidden by the rootkit after one is installed.
I only felt it necessary to mention this because of those individuals who seem to think rootkits themselves are exploits to get escalated privileges. While some rootkits get installed via "shatter attacks" and other priviledge escalation exploits, they themselves aren't doing any exploiting.
I retract my previous statement.
IIRC, the Windows encrypted filesystem keeps the key together with the data, still needing that the key passphrase is somewhat strong.
There are Linux encrypted filesystems that permit you to keep your key in another media (like an USB drive or a floppy or a cd-rom).
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
...there would have never been a need for firefox.
/. is like walking into a fundie church and standing up and saying maybe there is no god.
Awg! Heresy! <tears at clothes and eyes> You got modded down for that. Talking about no need for Firefox, even hypothetically, here on
On Windows (by default), everyone is an admin
Um, not true.
She probably slapped you cause you'd be done in 5 seconds...
The solution is either to boot the detector from its own media (inconvenient if you want to scan your system for rootkits on any regular basis).
That's not necessarily the case. Initially when I thought about it, I was thinking "Hm, a USB dongle would be a great device for that, just boot to the dongle periodically, and have it scan the drives." Of course, that would only really prevent rootkits in home computers [possibly], because you're absolutely right, no one in their right mind is going to hire some dude to go around to all the workstations after hours and clean out machines with a physical device. But what about a network device? Something that could sit on a local area network (and obviously never, ever touch the outside world), and remotely scan workstations. It wouldn't necessarily need to be read-only (though it could be), you'd just have to have lots of protections in place (i.e. using quarantined memory spaces or even devices, so that scanning a cleverly infected machine couldn't trick the scanner into infecting other machines on the localnet).
--- What
What windows actually needs is a good leavekit, showing people how to leave MS behind forever.
Just change the detection system to display an error saying "An illegal operation has occurred" and users will blissfully ignore the detection system as if nothing unusual had happened.
What's the fun in that? Even assuming that the Windows kernel developers know what they are doing in terms of security (debatable), the Windows kernel just hasn't been designed to withstand these kinds of attack.
I always considered Windows XP a rootkit itself.
Valkyrie is about to die! Wizard needs food -- badly!
have you ever had a girlfriend long enough to get to the nasty part of the month?
I found an interesting pop-up generating piece of malware several weeks ago that appeared to use rootkit-type techniques to hide itself. It was invisible from the process lists (including the nicer command line ones) and the filesystem. I was able to track it down and delete it (unfortunately, the machine was several hundred miles away and I was working on it remotely, otherwise I would have booted off a CD and made a copy of the little bugger), but it was a royal pain in the ass to do.
... grrr). So I used ProcMon to kill any threads associated with the pid - the process was invisible, but you could still find the threads by which libraries they were using and kill them there (use the search command). Once the threads were killed, I could overwrite the loader file (you couldn't read it, copy it, list it, etc., but it would give you an error if you tried to overwrite it while the threads were running).
For the interested (some of the details might be slightly off because I've consumed a lot of booze between then and now, but the overall gist is correct), I found the malware by using SysInternals RegMon to find the process ID that kept replacing the registry entries that loaded it. That Process ID couldn't be killed by any of the tools I could find (because they check to see if the pid is valid before trying to terminate it, and it had stealthed itself to the point where the ID appeared to be invalid
Help save the critically endangered Blue Iguana
You can write any old shit you please. No God damned censorship here, fuck no. You could call someone a Jesus-sodomizing, ball-licking, cunt-faced piece of monkey jizz and no one would care. That's fucking great, don't you think?
Not true? Yes it is. Windows XP sets up one admin account for the user, and it doesn't encourage using an unprivileged account. In fact, most Windows users think that it is best to use the admin account all the time (because of the reasons I just mentioned and also the fact that so many USER APPLICATIONS need administrative privileges (like games) when they really shouldn't need these privileges.
Microsoft-free since March 28, 2004
This might be a site worth looking into.
www.hxdef.org
Don't go there with IE
"think of it as evolution in action"
So device drivers are high level programs now, eh?
;-)
Perhaps I will need that HC11 assembly I learned in school after all.
Careful... I've been to Soviet Russia. ;-)
turnabout's fair play for MSFT patenting the iPod ...
-- Tigger warning: This post may contain tiggers! --
but I lead a double life where I use and administer a small network of Macs
so you're living on the down-low?
ha ha ha ha ha ha ha
(Deprecated) A malicious meddler who tries to discover sensitive information by poking around. Hence "password hacker", "network hacker". The correct term is cracker.
Get a clue people! Script-kiddies are no experts people! And it doesn't take a rocket scientist to exploit Windows either.
you can just recompile your widnows kernel to ensure is not rootkited.
oh, can't you?
they won't know what to do with boobies.
Darwin is a good example of a modern microkernel OS and it has terrible disk I/O because of all the extra overhead of having a microkernel. Why would we want to cripple all OS's like that? Or did Apple do something that made Darwin particularly slow? Most exploits are user land anyway. What would be the point?
-matthew
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
Hey, I thought Windows was the rootkit.
(Just upholding Slashdot tradition).
A guy was driving his car and got a call from his wife warning him about a radio news report of a dumbass that was driving in the opposite direction against traffic on the same road he was on. So the guy replied - 1 dumbass? I saw 50 already... Moral of the story - if everyone sais that Apple is overpriced - Guess what? It is. And as much as you would like to think so, buying overpriced goods is never smart.
Where are the programs I compile to get root? Rootkit is a ready-to-go deployable root-getting suite.
What you have is a ~9 month old document showing some items of concern. Rootkit is not the same as "this system has some SUID root binaries on it..."
The statement is true and it isnt true.
It is true that by default users are admins. It is also true that XP Home cant set NTFS perms. And it is very true that almost all PC companies set the default user to an admin ( for compatiblity reasons ).
However XP can have limited users and if you look at M$'s site long enough you can find that "Users are recomended to run as a limited user".
And the end of the day *nobody* i know uses a limited account.
Lima India November Uniform X-ray
Instead of having the rootkit listening on a port, have the rootkit periodically try to communicate out. Then it doesn't need to bind any port, and will be missed by your scan.
A practical example of this are the IRC bot networks that are so popular in DDoS attacks. All of the bots connect to an IRC channel, and will do whatever they're told to do over IRC. (This is great for DDoS because the botmaster doesn't need to keep track of which machines are compromised, or even go and try to individually connect to them.)
& spots:
1. Rootkits: Subverting the Windows Kernel
2. How to convince your CIO to go for that new 8-way Dell to run your file server for 30 people.
(you guess which book he/she will go for)
Which OS were you talking about? I could swear the ones you might name have hacking books written about them too.
It's not nice to swear, 'specially when you're wrong. Two words:
BeOS, baby!!!!!!!!!!!!!!!!!!!
Thanks.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
I think when the Palladium platform is released, it will eventually be hacked or otherwise subverted by rootkit hackers. The rootkits will use the DRM restrictions of Palladium to prevent any tool from removing the rootkit. People who's computers get infected by these Palladium rootkits will be forced to throw entire computers out.
What do you think Microsoft is going to do about it? If someone has system access there isn't anything to be done about them moving in with a rootkit.
What I'd like MS to do about it is make detection easier. I.e., record the checksum of every file installed by Windows and third party software, provide a way of backing up that checksum info, and a way to check the contents of the hard disk against the backed up check sums from a rescue CD.
Ie, just like Linux does.
MS current approach is to run a tool on the cracked system and hope it reports bad checksum,s then boot of a CD and check again to see if they're different. This provides no security whatsoever, as the inital app that runs on the system could be made to report whatever checksum it wants.
MS approach works fine. Even if the initial check reports lies, checksumming the disk from the CD will report the real checksum. If they're different, the system is trojaned. If they're the same, but they're not the right checksums, the system is trojaned. Only of the checksums are the same and match the original files is the system OK.
Sorry, their approach is fine, I stand corrected.
However, it only works for MS apps and isn't a part of the OS, an area where Linux packages still have a significant advantage.
Compile all of the drivers yor system needs into the kernal and turn off module loading, ala OpenBSD.
POKE 36879,8
just so you know, i found it funny.....
I mod everyone down who says "I'll get modded down for this." I hate to disappoint.
You must be right - Your post proves it! your two main points become 3!! No windoze user could be that smart.
Firstly, your third point is less then useless as a point. Even if true, which is highly doubtful, it doesn't speak to the usability of the OS. I am certain that Solaris users are generally smarter then OSX users, does that mean it is better?
Secondly, while you might love that OSX has no legacy issues that advantage does come at a price - choice of hardware and software. You might be able to find all of your needs meet but then again some people have windows installed for years without ever getting an infection of any sort. To each his own.
As for single user mode, unless the OS is booting from a ROM, you still have the same problem: trying to fix an infected system within an infected system. Yes it maybe more powerful then safe mode and yes there maybe not be a current exploit that is still active even in single user mode but that is just a matter of time.
The fact is that mac's, just like firefox, don't offer an effective platform for infection. If/when macs have more then 30% of the market, thats when OSX will truly begin to deal with virus, worms and the like. It might be harder, even alot harder then windows boxes, it will happen and likely spread fast and hard (at first) when the first ones hit because arrogance will ensure that OSX admins aren't ready for it.
I mod everyone down who says "I'll get modded down for this." I hate to disappoint.
"and MCSE:2003 certified" ... whooooo .. we are so impressed. Managed to fluke a kiddy-style multiple choice quiz did you (as well as forking out your surplus dollars into Billy-boy's pocket)?
...After all, we press Ctrl-Alt-Del before logging in, which protects our password! What more could we possibly need?
Windows® kernel subverts you!!
"Our interests are to see if we can't scale it up to something more exciting," he said.
Ok, I do not get it clearly. I was clearly not being nice to the moderators in my previous post (I was sort of asking for troll), but apparently your message is still considerd flamebait & troll + some insightful, and mine as insightful when it really was total c**p.
My wife's sketchblog Blob[p]: Gastrono-me
offer the asverage consumer two computers for the same price, one slow but secure and the other noticably faster and booting windows or opening outlook and they will (unfortunately) choose the later.
I for one, run a dual screen machine quite happily on an AMD 1.2Ghz machine but then linux lets me do that and securely.
ERR 411[Max number of witty sigs reached]
Mostly correct, but Single User Mode won't help you get rid of a smart rootkit. A smart rootkit will include a filesystem shim so you can't find any of the files that make up the rootkit. also, executing things like /bin/bash might run a different program than just reading /bin/bash (for checking checksums).
Basically, once you're root in unix you're god. The kernel can be replaced and from there the game is over. Only way to deal with it is to boot from known-good media.
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
HURD people are trying to move to L4 microkernel, because MACH is unrepairably bad designed. :-D
And one of the design flows is implementing security inside kernel
physical access using condom - is it secure enough ?