New Developments From Microsoft Research

prostoalex writes "Information Week magazine runs a brief report from Microsoft Research, showcasing some of the new technologies the company's research division is working on. Among them — a rootkit that eliminates other rootkits, a firewall that blocks the traffic exploiting published vulnerabilities, a system for catching lost e-mail, a honeypot targeted at discovering zero-day exploits, and some anti-phishing applications."

Comments

rootkit wars

[Toby The Economist]

> a rootkit that eliminates other rootkits

Well, there goes kernel stability.

I'm really not sure I want a future Norton RootKit Protector installing itself, bugs and all, into my kernel.

Re:rootkit wars

[HillBilly]

Aww, how could you not trust norton? It slows the fast changing internet world down to much better pace! ;)

Re:rootkit wars

[QuantumG]

no, no, no, it's much worse than you think. These rootkits are based on virtualization, they install themselves below the kernel. The kernel runs on these rootkits.

Re:rootkit wars

[Anonymous Coward]

Ok, no more BS. First of all, the project is called Strider Ghostbuster. Second it is not a rootkit itself. The way it works is it lists all the files on your computer running as a program on the suspect machine. Then you run it from a boot CD, just like Knoppix, and do the same thing. Then when see files listed on the scan from the CD that weren't on the other list, you know they are hiding themselves from the OS. This is a good idea because it doesn't require signature files of checksums of a known good state.

Not everything from Microsoft is fucking stupid, but the comments that inevitably follow every single MS story on Slashdot are.

Re:rootkit wars

[Bjarke Roune]

Why is this modded funny? One of the hardest kind of rootkits to detect is ones based on virtualization, and they indeed do run under the kernel, tricking the kernel to believe that the kernel is running on actual hardware when in fact it is running on virtual hardware generated by the rootkit. I do not know if there are any actual, malicious rootkits out there doing this, but they could do it, and it would be very hard to get rid of such a rootkit if it was done properly.

What the ... ? Lost email?

[khasim]

SureMail Microsoft researchers Sharad Agarwal and Venkat Padmanabhan determined that about 1% of all e-mails get lost in e-mail systems. SureMail is a proposed system in which the e-mail client detects when an e-mail has been sent to a recipient's account and alerts that recipient when an e-mail fails to make it to his or her in-box. SureMail would indicate the e-mail's sender but not disclose the missing message's contents.

How the fuck does email get "lost"? How could that happen? Even a server crash should not cause that.

Why not, instead, spend the time and money finding the real problem in your email system and fixing that? I handle about 1,500 in-bound messages a day. By their calculations, I should be losing 15 or so, every day. Yet that does not seem to be happening.

Re:What the ... ? Lost email?

[dattaway]

How the fuck does email get "lost"? How could that happen? Even a server crash should not cause that.

You don't understand. Microsoft's email servers are more personal than BSD or Linux. Each email is hand scanned and routed. Each packet is individually inspected and if something is wrong, its routed to the appropriate supervisor. There's lots of checks and procedures. This is why Microsoft's mail servers have a more friendly user interface. You get what you pay for.

Re:What the ... ? Lost email?

[martin-boundary]

Unlikely. SMTP is designed for reliability. When a server OKs a client DATA submission, it is supposed to accept to route the mail no matter what, even if it might take a week to contact another server. SMTP servers which have been around for a while are plenty reliable, certainly much more than 99%. The relevant RFCs have been around in one form or another for 20 years.

The most likely causes of lost mail are stupid admins, who either don't know how to set up their mail spools, or run unreliable commercial or homebrew mail filters, in the wrong place and/or with the wrong settings.

Hacks

[Simon80]

a rootkit that eliminates other rootkits

This just in: Microsoft team A resorts to rooting Windows in order to fix the problems introduced by some 21 man team B somewhere else in the company that they can't get in touch with.

No Legitimate Purpose

[Anonymous Coward]

a rootkit that eliminates other rootkits

There appears to be no legitimate purpose to such research.

1. A rootkit that eliminates other rootkits can probably also be eliminated, so this research does not really solve a problem.
2. Rather than perfecting a rootkit, they should be working towards making a rootkit an impossibility in their OS.
3. If you can write a rootkit, eliminating other rootkits does not appear to be that large of a challenge in the first place.
4. If you want to eliminate a rootkit, reinstalling the OS seems like a better idea.
5. There are countless illicit uses of such software.

Are they developing this rootkit in an effort to develop new security for their OS? I don't get it.

Re:No Legitimate Purpose

[EvanED]

The article is misleading if not outright wrong; GhostBuster isn't a rootkit itself, it's just a rootkit detection thing very similar to RootkitRevealer. (GhostBuster came first and is more complete.)

It's closer to anti-virus than it is to a rootkit itself, though the similarities there don't go very far either. (AVs almost universally work by signature matching; GB works by comparing registry entries and files against each other by multiple means of acquiring that information in order to find the symptoms of having a rootkit -- missing information. This assumes that the rootkit is imperfect in hiding. For instance, this will do a scan of the registry through the standard API calls. But then it will parse the registry hives that are on disk. The assumption is that the rootkit is going to hook the API calls. Hooking the I/O calls is rather more difficult, and it's impossible if you can do a clean boot. (One of the options is to do a diff of a hot scan vs. a known good scan done from a Windows PE boot.) There are still things that rootkit authors can do though, specifically NOT hide from GB itself. IN the case of RootkitRevealer, this has actually turned into a mini-arms race of itself. Rootkits started not hiding from rreveal.exe or whatever it's called (so that it wouldn't detect diffs), so RootkitRevealer started randomly renaming itself each time it runs. The state of the art on the black hat side is to carry a signature of RootkitRevealer-like programs and do pattern matching in very much the same way that AV does pattern matching to find viruses.)

2. Rather than perfecting a rootkit, they should be working towards making a rootkit an impossibility in their OS.

If you can run drivers in kernel mode, you can run a rootkit. (Unless you can statically prove everything you let run in kernel space is safe... this may or may not be possible. For what it's worth, my current research is related to model checking drivers.)

Don't call stop-gap measures research ...

[YeeHaW_Jelte]

If this is microsoft innovation, it's not very innovative. All these 'technologies' are basically extra layers of software to fix the bugs in the first layers ... be it security (phishing stuff, adaptive firewalls, etc etc) or losing emails ... which should not happen anyway and we already have basically the same technique they're developing in the mail protocol, namely confirming a received email.

A rootkit to destroy other rootkits...

[Opportunist]

Lemme get this straight. A company is working on a rootkit for their own OS. Now, it could be me, but if I didn't sleep through OS programming, as the maker of the OS I already have total control over everything in it (provided my user allows me to have it, which is pretty much a given with MS OSs). Why do I need a rootkit?

Not to mention that Vista was trumped to be the most secure, un-hackable system ever. How do you install a rootkit on it? I thought it is impossible (spare your corrections, I know it is possible no matter what. I just want to get an answer from the guys that keep telling me it is impossible to rootkit Vista).

So we're now at the "who gets deeper into the system" war. Because one thing is a given, 3 days after the MS rootkit to destroy other rootkits, the rootkit to destroy the MS rootkit is rolling out. Then it's a month 'til patchday and... you know the drill, we already live it.

There is no technical solution to social problems. As long as people are dumb enough to click everything offered to them while they're running on admin or root privileges, those things will exist and they will work. Now, with Vista finally trying to run on low privileges, the social engineering part will become bigger to get the user to grant more privileges when necessary for the bug to survive, but since pretty much EVERY program will need those for installation, people will hand out those privileges like freebies, because it's customary that a new program needs them.

Oh, and talking 'bout honeypots

[Opportunist]

The "classic" honeypot is pretty much dead. Nobody uses a 0day against a random machine anymore. At the very least, one tries to avoid certain IPs and IP Ranges that are known to host pots. Whether MS wants to believe it or not, those lists exist. One of my pots has been discovered a while ago and on that machine, I've never had any detections since, except a few scriptkids that don't count.

Even "detecting" pots that simulate a user's behaviour and look actively for forged sites and such are getting out of usefulness, since a lot of distributors already start hardening their attacks against aggressive farming. Or they require you to go through very detailed steps that a bot cannot reproduce. I've recently had my first captcha-protected exploit (was a porn site, and what user wouldn't solve a captcha to get his pic when he surfed there just for that in the first place?).

Forget honeypots. Unless you put a human behind that VM it's running on. Automated pots are becoming less and less useful with attackers becoming more and more aware of them. Especially you can dump any kind of "honeypot kit", they are known and their quirks are tested painstakingly before an attack takes place.