Slashdot Mirror
New Developments From Microsoft Research
prostoalex writes "Information Week magazine runs a brief report from Microsoft Research, showcasing some of the new technologies the company's research division is working on. Among them — a rootkit that eliminates other rootkits, a firewall that blocks the traffic exploiting published vulnerabilities, a system for catching lost e-mail, a honeypot targeted at discovering zero-day exploits, and some anti-phishing applications."
> a rootkit that eliminates other rootkits
Well, there goes kernel stability.
I'm really not sure I want a future Norton RootKit Protector installing itself, bugs and all, into my kernel.
It really is good to see that Microsoft is trying to do some good things. I mean they ARE the huge company that they are, so it really is good to see that they are trying to do things better. However, a rootkit to change a rootkit does not sound like a good idea... But a firewall like they are talking about does seem pretty interesting. I hope to see good stuff come out. As a Windows user, this is good news for me.
Yay, I have a sig.
a rootkit that eliminates other rootkits
Yes, but what about rootkits that eliminate rootkits that eliminate other rootkits? Muhahaha
How the fuck does email get "lost"? How could that happen? Even a server crash should not cause that.
Why not, instead, spend the time and money finding the real problem in your email system and fixing that? I handle about 1,500 in-bound messages a day. By their calculations, I should be losing 15 or so, every day. Yet that does not seem to be happening.
They've put out quite a few interesting experimental languages for the .NET platform.
.NETified classes) looks pretty cool.
In particular f# (ocaml with
Can anyone in the know comment on how doing research for a company like microsoft compares to doing CS research at a university? I'd imagine the pay would be somewhat better, but are there other tradeoffs like reduced freedom?
Microsoft is re-inventing "intrusion detection" and "packet analysis". Save yourself some stress and deploy Snort today.
http://www.snort.org/
> a rootkit that eliminates other rootkits
:P
So being evil installing rootkits is not enough?
One rootkit to rule them all!
If you fix the problem of "lost" emails, then why run a system to find alert people to email that is not lost any more?
If your system is unreliable, adding complexity usually does not make it more reliable. You need to fix the problem at the lowest level possible.
Since this is Microsoft, they're probably referring to Exchange/Outlook. Exchange is mostly database driven now. If you're losing messages in your database, having someone re-send them is NOT the approach you want to take.
You have what is known as "database corruption" and that does NOT spontaneously solve itself. You have a serious problem.
From what I know of the Microsoft research, is that it is patent fishing net so that in the future they can sell/control techologies. Basically covering future turf, so that they can control cash flows and maybe make some money on top of it selling the patents. Control in such way if fooling company developing their product would have some nice feature that will partly infringe on the patent. Then microsoft can hurt the company and tell it what to do. And tech is developed far enough to have an idea for patent, and then dropped. Sort of like slugs sliming up the IP territory.
I might be wrong, its been a while.
Actually, in a rare turn of events, GhostBuster isn't the reincarnation.
MSR has been working on GhostBuster for some time, with a white paper released July 2004. That MSR site says that RootkitRevealer was released Feb 22, 2005. This fact is confirmed by archive.org, where the version archived Feb 22 does not contain RR and the one from Feb 23 does. (Not to mention the front page listed it as Feb 22.)
There appears to be no legitimate purpose to such research.
1. A rootkit that eliminates other rootkits can probably also be eliminated, so this research does not really solve a problem.
2. Rather than perfecting a rootkit, they should be working towards making a rootkit an impossibility in their OS.
3. If you can write a rootkit, eliminating other rootkits does not appear to be that large of a challenge in the first place.
4. If you want to eliminate a rootkit, reinstalling the OS seems like a better idea.
5. There are countless illicit uses of such software.
Are they developing this rootkit in an effort to develop new security for their OS? I don't get it.
Invisible processes battling each other for CPU, RAM, disk space and Internet bandwidth resources. And all I want to do is send some resumes, check the news and email and browse some sites. Ubuntu just got a much larger partition. Screw this crap, seriously.
So wait, is Microsoft supposed to be the young fit men hunting ghosts or the large, bloated Stay-Puft Marshmallow Man that's unhealthy for the public?
If this is microsoft innovation, it's not very innovative. All these 'technologies' are basically extra layers of software to fix the bugs in the first layers ... be it security (phishing stuff, adaptive firewalls, etc etc) or losing emails ... which should not happen anyway and we already have basically the same technique they're developing in the mail protocol, namely confirming a received email.
---
"The chances of a demonic possession spreading are remote -- relax."
Lemme get this straight. A company is working on a rootkit for their own OS. Now, it could be me, but if I didn't sleep through OS programming, as the maker of the OS I already have total control over everything in it (provided my user allows me to have it, which is pretty much a given with MS OSs). Why do I need a rootkit?
Not to mention that Vista was trumped to be the most secure, un-hackable system ever. How do you install a rootkit on it? I thought it is impossible (spare your corrections, I know it is possible no matter what. I just want to get an answer from the guys that keep telling me it is impossible to rootkit Vista).
So we're now at the "who gets deeper into the system" war. Because one thing is a given, 3 days after the MS rootkit to destroy other rootkits, the rootkit to destroy the MS rootkit is rolling out. Then it's a month 'til patchday and... you know the drill, we already live it.
There is no technical solution to social problems. As long as people are dumb enough to click everything offered to them while they're running on admin or root privileges, those things will exist and they will work. Now, with Vista finally trying to run on low privileges, the social engineering part will become bigger to get the user to grant more privileges when necessary for the bug to survive, but since pretty much EVERY program will need those for installation, people will hand out those privileges like freebies, because it's customary that a new program needs them.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
That's nothing, I hear Google invested one Gillion dollars.
OK, so you've got a clean image saved somewhere. Now what?
How do you detect whether you've been infected, when all you have is an image of an NTFS filesystem?
And once you are infected, how do you clean up without losing all your user files?
Then they'll just come back with a bigger rootkit and eventually a rootkit so big it'll destroy us all.
Microsoft Research is developing technology for finding rootkits by using their own deceptive behavior against them. Known as GhostBuster, it relies on analyzing and comparing system information at both a high level--from a Win32 API, for example--and a low level--such as the raw disk information. Any difference in the two views--for example, the low-level view indicating a file not present in the high-level view--makes a compelling case that a rootkit is trying to hide.
Simply not true!
I mean, since it is the Exact description of how RootkitRevealer works, I suppose (I'm sure) that it is the same product. For those who do not know,Microsoft acquired sysinternals (maker of RootkitRevealer) a few months ago.
Apple iProduct. Non importa cosa sia, lo comprerete!
The "classic" honeypot is pretty much dead. Nobody uses a 0day against a random machine anymore. At the very least, one tries to avoid certain IPs and IP Ranges that are known to host pots. Whether MS wants to believe it or not, those lists exist. One of my pots has been discovered a while ago and on that machine, I've never had any detections since, except a few scriptkids that don't count.
Even "detecting" pots that simulate a user's behaviour and look actively for forged sites and such are getting out of usefulness, since a lot of distributors already start hardening their attacks against aggressive farming. Or they require you to go through very detailed steps that a bot cannot reproduce. I've recently had my first captcha-protected exploit (was a porn site, and what user wouldn't solve a captcha to get his pic when he surfed there just for that in the first place?).
Forget honeypots. Unless you put a human behind that VM it's running on. Automated pots are becoming less and less useful with attackers becoming more and more aware of them. Especially you can dump any kind of "honeypot kit", they are known and their quirks are tested painstakingly before an attack takes place.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You make an image of filesystem that consists of out-of-the-box software that is known to be clean. If that's not clean, repeat from the start and keep both eyes open.
If you still want to check it, you can always mount the image as a local filesystem and use whatever tools you want to check it: mount -t ntfs /data/user-hd-image.img /mnt/loop -o loop,ro and bigassvirusandrootkittest --verbose /mnt/loop =)
You can always keep user files on another partition.
But usually, if you have the ability to use images like this, you're rich enough to use an actual Network. You don't keep any important user files locally, you have a file server instead. Local hard drive is only for applications and temporary stuff. (And if a virus grabs your OS while in middle of a big project, you keep the Temporary Stuff in a known location so that the tech support guy can easily move it to another drive before reimaging the whole thing. Or, hey, another partition again!)
Singularity is a Microsoft Research project started in 2003 to build a highly-dependable operating system in which the kernel, device driver, and applications are all written in managed code. The lowest-level x86 interrupt dispatch code is written in assembly language and C. Once this code has done its job, it calls the kernel, whose runtime and garbage collector are written in C# and run in unsafe mode. The hardware abstraction layer is written in C++ and runs in safe mode. There is also some C code to handle debugging. The computer's BIOS is only called during the 16-bit real-mode bootstrap stage; once in 32-bit mode, Singularity never calls the BIOS again, but rather calls device drivers written in C#. During installation, CIL opcodes of the C# kernel are compiled into x86 opcodes using the Bartok research project. Bartok is an optimizing compiler written in C# for translating CIL into x86.
The Microsoft Singularity pageOne rootkit to rule them all, one rootkit to find them. One rootkit to bring them all and in the kernel bind them.