Slashdot Mirror
Windows Rootkit Wars Escalate
An anonymous reader writes "The rootkit wars have started to escalate with a rootkit named Rustock which is able to remain hidden from all the popular anti-rootkit tools. It uses some new techniques including not only putting itself in a ADS (NTFS alternate data stream) which isn't seen by normal file system enumeration tools, but even blocks ADS aware tools from seeing the stream. Works in Vista, too! Analysis in both Symantec and F-Secure blogs."
I hate them because of that incident the word rootkit became popular.
I know what you mean! Just the other day I was listening to two teenage girls yakking in the mall...
"Oh no you did-uhnt! Girl, you can't be lettin' some loser root your kit like that!"
Don't disappoint your bird dog. Go to the range.
If only Windows was closed source, then writing such tools would be difficult. Oh, wait...
This Russian-created rootkit is smart enough to recognize known anti-rootkit tools and hide from them.
:P
Does this mean that in Soviet Russia, rootkits detect y... Bah, nevermind. Too easy.
Slashdot: come for the pedantry, stay for the condescension.
Here let me codify that:
// what's that you say?
while (!os_written_in_typesafe_language) {
counter_rootkit(create_rootkit(true));
}
. . .
catch (NoSuchRootkitPossibleException ex) {
}
Theese things are like the neighbor that just walks in the house, takes a piss, grabs a beer out of the fridge, asks you if you're watching teh game after sitting on the couch next to you.
If they'd put some fucking beer in there now & then it wouldn't be so damn aggrevating.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
NTFS alternate data stream? It's a good thing I still use Windows 95 that doesn't have any of those fancy shmancy features that can be exploited like that.
What do you mean, "buy music"?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
[Yoda]
Begun, the Rootkit Wars have...
[/Yoda]
My boss was telling me how he'd spent all morning with the IT manager removing a trojan off of his Windows machine.
..."
I looked up from my iBook and FC5 workstation, looked him in the eye with a face full of innocence, and asked, "What's a 'Trojan?'"
"Well, see, it's like... a 'trojan' is like the Trojan horse; it's a program that comes into your system and
wink
"...why I oughtta slug you!"
It's a good thing the guy's a consummate professional, because I probably deserve to be writing this from the hospital.