Slashdot Mirror
No Defense Against Windows Rootkits?
An anonymous reader writes "Spyware bad guys (and also phishing people) started using rootkits technology to stay hidden in a system. The problem is that at the moment the technology to defend a Windows system from these things is very poor. In fact antivirus companies have just started adding basic anti-rootkits technology. So the problem is serious, and well outlined by this question: Is the closed source code of Windows preventing us from actively defending our systems?"
Who has the chops to run through 800,000,000 lines of code to do the fixing of this OS?
I mean even if you find the problem can you honestly say you'd be sure you wouldn't leave Notepad.exe broken by making your changes?
Clearly Windows needs to be completely re thought with NO concern for legacy apps. See also OS X.
This
Shameless plug: I've written a script that should be able to help find any rootkits that are listening on tcp/udp on windows.
Heres the link
What it does is attempt to handshake with itself on every available tcp or udp port. If the handshake fails, that is an indicator that somebody else is already camping out on that port.
Source is GPL, feedback is always welcome.
This topic has been beaten to death a thousand and one times before but the reality still holds true: as long as a company holds the source of their software to their chest, you simply have to rely on them to provide the security for said software. By doing so you create the equivalent of a single point of failure that has to be addressed solely by the holding company, and as a result, you are subject to the "hurry up and wait" syndrome that accompanies it. That's when it comes back to "suck it up or don't use it," which carries all the arguments of "we don't have a choice" or "switching isn't an alternative for us."
This sig is six words long.
In 2.6 you use the kernel capabilites to load the appropriate modules at boot time, then strip the kernel of the ability to load any others. Adds a little more work for getting that module loaded. Throw in more stuff (verifying the module list from read-only media before loading any modules) and you can get pretty well defended against this kind of thing.
If I have been able to see further than others, it is because I bought a pair of binoculars.
But the reverse is true, you could have people going through finding exploits and using them without reporting them. Closed source is safer.
System (more accurately LocalSystem) can't access network resources.
/interactive cmd.exe
So there is *something* that they can't do.
Try
at (now plus a minute)
voila! Interactive system shell!
So we are left with two options:
a) Windows 2000 is impervious to rootkits, either off the shelf or through modifications unavailable to the general public
b) The US Navy is running an unsecurable OS for the most advanced surface ships in the world - with nuclear reactors to boot.
If the g'vt kept the data on you that google does you'd better believe you'd be calling it "doing evil"
Is there any product for Windows like Bastille Linux that would help a user lock down any vulnerabilities in their system like file shares, unnecessary accounts, open ports, unnecessary services, IE settings, etc?
If not, there should be.
But the fundamental problem is that if someone wants to install this garbage, the only way you can really stop them is by taking control of their computer away from them. I'm not sure that even Microsoft is willing to go that far yet, and I'm not sure I would want them to, anyway.
Whoever corrects a mocker invites insult;
whoever rebukes a wicked man incurs abuse.
--Proverbs 9:7
I recently cleaned a machine infected with a rootkit that was NOT detected with Rootkit Revealer. The virus loaded itself via the HKLM/Soft/MS/Windows/Run key, as usual, but it didn't show on regedit nor elsewhere, and the Rootkit Revealer did not detect the "missing" key. The only way to see and remove it was to boot with a WinPE CD.
Fortunately these rootkits can usually be detected by their side-effects, like the slowness and the internet activity... but you have to be suspitious that something's going on.
I work with spyware infected systems every day, and I have never found a "rootkit" on one
The issuse is that they're extremely difficult to detect. What heuristics do you use that that the major AV companies are not aware of?
The most effective method that I have found to get rid of spyware on an infected system, by the way, is to boot from a live Windows bootable CD to delete all the crappy spyware directories...
I'm sure that works reasonably well, but once a system is comprimised, you never really know for sure. I find that the only surefire method, which incidentally often takes less time, is to wipe the drive and start fresh. The type of user that is going to get spyware probably doesn't have a complicated setup or do more than write documents and use iTunes, and backing up is as simple as looking for *.doc, *.xls, *.ppt, *.mp*, *.mov, *.wmv, and *.avi.
Purchased...?
Warez jokes aside, most common non-corporate windows are OEM copies. OEM = no support from microsoft. You get your pile of bytes that might or might not work, and you get some patches at the whim of MS. You get no support unless you pay thru the nose per incident.
Sure, you can call your OEM supplier - however, they have no access to the source, and generally just tell you to reinstall the thing and immediately tell your system is unsupported if you actually install something other than the supplied bundled software on your system.
Does this question really need to be asked any longer?
Has this story teleported us all back to the year 2000? Hit the reset button? Is Slashdot's new motto "No hugging, no learning"?
I thought this was common knowledge. I didn't really expect a "pro-business" administration to do anything about it, did you? It's actually one of the few things that makes the rest of us feel safer.
Britain has the same problem, by the way:
Also see The Register which quotes an upbeat Armed Forces Minister:
Perhaps the Minister can now explain why his desktop PC doesn't even run properly.
Les Hatton gives his opinion at IT Week:
you had me at #!
Its fairly easy to put a module in Linux using /proc/kmem even if modules are disabled.