Slashdot Mirror
Six Rootkit Detectors To Protect Your PC
An anonymous reader writes "InformationWeek has a review of 6 rootkit detectors.This issue became big last year when Sony released some music CDs which came with a rootkit that silently burrowed into PCs. This review looks at how you can block rootkits and protect your machine using F-Secure Backlight, IceSword, RKDetector, RootkitBuster, RootkitRevealer, and Rookit Unhooker."
Click here to going to next pages. :)
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
"helpful" activex popup ads:
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!
Whew. Good thing GNU is Not Unix.
apt-get install chkrootkit rkhunter
------ Take away the right to say fuck and you take away the right to say fuck the government.
It's interesting that programmers working outside of a corporate environment produce such amazing products. Hmmm... I wonder what's up with that?
Shouldn't these tools be a part of already-existent anti-virus solutions? Why another application for rootkits if trojans, virii, and spyware detection are (usually) in the same package? It's not like rootkits are new threats.
/.
Before you laugh, that's basically what Microsoft's "Windows Defender" firewall would be like. "We'll remove the security vulnerabilities we gave you ... for a price!"
Apology to Ubuntu forum.
Hey, thanks for the mention in the article but that is a really old version you've used to test! The last version I've released publicly is AFX Windows Rootkit 2005, it's open source and can be found on http://www.rootkit.com/ the other more recent versions I've sold privately.
Now on the subject of rootkit detection. Most of these use the method based on Microsoft's Strider: GhostBuster. Which uses a low-level method to gather seemingly clean system information then gathers the same information using a high-level method. The idea is that rootkits will have only hooked the high-level methods so there should be a difference in results. Whatever is listed in the low-level results and not listed in the high-level results is displayed as "hidden information". Effectively they are using the rootkit's own hiding functions against itself to detect it. If the rootkit doesn't hide itself to avoid detection it's still made itself visible.
The problem is that you put yourself in an arms race with who can hook system information at the lowest level. Luckily since we (the sysadmin) have access to the hardware and presumably the attacker does not, a hardware method of gathering system information would be the best. You can bet money that we are going to be seeing hardware level rootkit detectors sooner or later.
The final problem is that a backdoor can be hidden without using these rootkit methods. By hooking incoming socket connections we can make a hidden backdoor that creates no new processes, threads, files, registry keys or any other permanent data. I and others have released POC code already. Also, making the same attack persist after reboot is only a matter of disabling SFC and altering userinit.exe, explorer.exe or whatever you like. Your rootkit detector will come up clean everytime.
You just trolling? If you read the article you would know that they were all free.
I didn't see one rootkit detector reviewed by InformationWeek that would work on my PCs, a Macbook and an iMac. Any suggestions?
Strange women lying in ponds distributing swords is no basis for a system of government.
You just trolling? If you read the article you would know that they were all free.
Yeah, but this one is free as in vodka.
D'oh! So much for skipping to the last page of the article.
Oh.. well I guess rkhunter http://www.rootkit.nl/ does not run on Windows. Nevermind. :-(
Is it just me, or am I being overly cautious not wanting to download a rootkit detector from Chinese and Russian software developers? Are these programs opensource? Are they safe? Anyone?
LOL is this a serious post? Most rootkits out there are designed to work on *nix based operating systems. True rootkits are far more common on for these flavors of OS over that of Windows. I am not sure if this is a reference to Ubuntu being secure. Maybe you could have recommended visting a site that houses a BSD flavor..won't bother pointing out one for that useless debate. Choosing Ubuntu is not going to protect you from rootkits in anyway.
Wow! Lets rate programs on diagnosing a potentially lying PC!
This is just a stupid idea if anything. The purpose of a rootkit is to make a very hidden hole into a system. Doing this requires reprogramming and setting up the system in that nobody can diagnose itself. The key is to diagnose any sort of rootkit, one must run from known good binaries.
Now, we dont have the source to Windows, but we have binaries. Well, lets MD5 the binaries and then compare to a known good (just installed, no network interfaces) installation. The differences are possible holes.
No program can be trusted when the system it sits upon cannot be trusted. When system trust is gone, one must redeploy the system to regain trust.
Do NOT buy music from stores. Instead, get them from torrents. It's safer!
Circumcision is child abuse.
Fanboy
Those who don't know, BitDefender Antivirus has rootkit detection and removal since v10. It was released back in Aug-Sept 2006.
\
Most rootkits target *nix. OS X is a Unix variant. But since Macs don't ever get viruses, I'm sure it would be impossible to get past Apple's expert, fully-secure software.
/.
Comment removed based on user account deletion
Can any of them detect blue pill?
IceSword120_en.zip -- Somewhat faster download for IceSword (at least until it gets Slashdotted)
Bah, I didn't proofread before I submitted. :(
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
...the Mac version of these tools?
Oh, wait...
Duct tape is like the Force. It has a light side, a dark side, and it holds the universe together.
A/Coward - What, you somehow think that you are immune to Rootkits???
I would not bet my life on that. Even though I consider the default security in my choice of GNU/Linux distro to be tighter than OS-X, I still use Knoppix (a CD based GNU/LINUX OS) for internet banking. It is the only TRUE assurance of safety from being rooted.
The F-Secure product is Blacklight.
Wish I could remember the name to give the guy credit, but someone's pointed out that even booting from a CD doesn't necessarily give you a trustworthy system if there's malware flashed onto a graphics card that the BIOS detects and configures before the CD takes over.
That when the rootkit, undid me
The warning box, I did not see
OK I clicked on, I spent freely
then My Ruin passed on, gleefully.
--A user's lament
snarkth
The review was for tools for the Windows PC, not the MAC or Linux. Sorry this was not more evident. The parent is (without knowlege) implying that the Mac is not vunerable to being rooted. And some fanbois are modding this funny? This might be funny, IF IT WERE TRUE! Not only are MAC rootkits possible, they exist. Do a google search before you post and it will prevent mistakes like this. (Yes I know, I run a risk of hardcore fans modding me down)
It's really a philosophic problem. Microsoft sees the OS as a weapon against the competitors, and when you're building weapons, of course you make them as powerful as possible and of course safety gets a lower priority. (Microsoft's highest priority has always been on the money, however.) The problem is that the results are overpowered OSes that real experts can use in ways that completely overwhelm us normal mortals. Heaven help the little old lady who just wants to visit her church's website on Sundays.
As regards the article, I read most of it, and might finish it later, but I wasn't too impressed with it or with the rootkit-detection tools that I've experimented with in the past. I'm supposed to be something of a computer expert, and I've certainly been using them long enough, but I regard myself as pretty much a helpless infant in these areas. If the NSA is planning to root my computer because I regard Dubya as an asinine embarrassment to my nation, I don't seriously expect to be able to do anything about it. Sure, I can use an expert's tools in many cases, but that doesn't make me any match for a real expert with corresponding tools. Or returning to the weapon metaphor, I may have a great gun, and even be competent enough in using it, but I'm sure that a seriously experienced killer would have little trouble taking me out, even with an inferior weapon.
In conclusion, "It's a poor craftsman who blames his tools", but it's also a poor craftsman who can't tell the difference...
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
Once you've pulled out those pieces, then you can hopefully boot (what's left of) Windows, run some of the Windows-centric anti-virus ware in hopes of finding those pieces that clamav didn't find.
Free Software: Like love, it grows best when given away.
Are you sure? This: http://it.slashdot.org/comments.pl?sid=217446&cid= 17659380 indicates that the method of rebooting with a CD will not be sure in the near future.
1. Boot with a Knoppix CD to do banking
2. Virus hides in Video
3. You reboot, virus installs itself and PROFIT!
Mark
In Soviet Russia, Rootkit detects You!
-1 not first post
I for one welco- eh. To hell with it.
Kangaroos are more than welcome to obtain low-level access to my OS. I've got mad respect for their built-in pockets.
Genetics wasn't as friendly to me. I had to BUY my Scott-E-Vest.
...on this sort of thing, Security Now. They had a good explanation last year of all the things the Sony "rootkit" did, like hiding files with the prefix "$sys$". The podcasts are pretty short (20 mins), definitely worth a listen to ease your morning commute.
Also, getindi!
The Army reading list
A few weeks ago, I played around with some of those rootkit detectors. Cool things, if you want to learn about some OS internals. But: When the primary use of a rootkit detector is to uncover malware so that a virus killer can see it, why not just do an /external/ virus check from a boot CD?
So, that is what I am doing now!
I find it curious and a bit disconcerting when I see how much emphasis people place on the subject of malware detection in the realm of information security. What to do after malicious code finds it's way onto our systems, or into our networks is certainly something to consider, and any security plan would be incomplete without it, but this area takes up far too much of our time, given that other aspects of security bring a much more favorable cost/benefit ratio.
I can only surmise that there is certain "sexiness" to malware detection; much the same way that fancy home alarm systems are the first thing that many think of when contemplating home security.
In the home security market, advertisements depict evil prowlers dressed in sweat-suits busting through the back door of the house, while a frightened soccer mom with her five year old daughter cower upstairs. The alarm sounds, the prowler runs away, and a call comes in from the alarm provider, asking if they are ok. Quite dramatic. Quite unrealistic too.
In the information security market there are no soccer moms, and the prowlers don't run around in matching sweat-suits, but the theme is similar. "Buy our product - it will catch intruders when they enter and save you." Again - quite dramatic, and quite unrealistic.
In the real world, people forget to turn on their alarm systems, or they forget to change the batteries, or intruders know how to disable them without triggering them.
In the real world, people also forget to update their AV/IDS signatures, or turn their security product off for various reasons - usually convenience-related, or like the prowler in the home, malware simply disables the security solution on it's way in.
Just as in securing a home, we would be better off if we first focused on installing heavy doors and deadbolts on all outside entrances, in the virtual world, we would be better off focusing on the barriers that malware must overcome to gain entry to our systems and access to our information and resources.
This is far from an original thought, but I'll say it anyway as it deserved to be repeated. The security industry is a joke. It's is filled by people who either don't understand the basic pricipals of information security, or do but choose to to sell 'sexy' solutions anyway. I once ran into the author of a somewhat popular Windows security product on a messageboard and was shocked at his aparent lack of understanding of how his platform of choice, Windows, worked.
I supposed this is more of a Windows problem than anything else. Not a problem with Windows, the operating system, but a problem with WIndows, the culture.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
When I ran Rootkit Unhooker, downloaded 01/17/2007, 11:46 PM, it said it is itself infected: Rootkit Unhooker has detected parasite inside itself. "It is recommended to remove parasite, okay?"
I'd like a rootkit detector that detects Windows rootkits, but runs from a live Linux distribution on a CDROM or a USB key. So I reboot a machine that I suspect is infected and do the rootkit scan without running any software from the hard disk. Seems to me that this would be a cheap way to do the "hardware level rootkit detection" of which you speak: provided that the Linux distribution was clean, a rootkit would not be able to hide itself on the disk.
Do you know of such a thing? Do you plan to port your Windows rootkit detector to Linux to enable this?
>north
You're an immobile computer, remember?
Someone said we could MD5 Windows binaries... Of course we can, though MD5 is so broken in this 21st century that you'd better use SHA-1 ;)
Another dude said "but my rootkit detect attempt to MD5 and returns the correst sum". Kind of, it s even better than that for the best of the breed: they recognize themselves in *any* attempt to read the file and replace their code (that they recognized) with the code that the file is supposed to contain at that place. What I mean is: you don't specifically decide to defeat a cryptographic checksum or an anti-virus or or or... But you fake the infos coming from every single attempt to read the file.
Of course the real "game over for rootkits" comes when you unplug the drive, plug it to a known good system (for example, say, an OpenBSD system that has *never* been hooked to the Internet) and then compare every file with their previous version. Altered userinit.exe? Game over rootkit. Altered winlogon? Game over rootkit. It works the same for Unix systems (for which, btw, there exist many more rootkits, though not as successfull in spreading). Which is why projects like honeynet are so succesfull at catching malware "in the wild". And with projects such as Honeynet being so successful, rootkit writers sometimes decide to write rootkit that don't install to the disk and that don't install if they detect they're running on an emulated/virtualized system. Which means the rootkit will only live for as long as the computer is turned on. And then it will need to re-infect the machine using the same exploit if the machine reboots. Which is also a pain in the arse for rootkit writers: the vulnerability may very well have been patched meanwhile (think auto-update) or exploited by someone else, etc.
Note that you can always detect suspicious trafic using a passive sniffer too (think shomiti tap or one-way ethernet cable... or "software" passive sniffer).
There's no such thing as an "undetectable rootkit". No matter if it tries to hide in the BIOS (Sun machine have been having protection again BIOS write since ever btw), which is incredibly hard (the BIOS code being so small), no matter if it tries to hide in some GFX card's chipset (wtf? someone wrote there s work on that... I can only see it happen on broken-by-design GFX card and it is certainly not common practice), no matter if it tries to install as an hypervisor on VT-enabled systems...
There's always gonna be a way to detect a rootkit, wether you're on Windows or Unix systems, wether you and rootkit authors like it or not. I'm not arguing, I'm not discussing: I'm stating facts.
Make your normal user a Limited one, not an Administrator. Try the initial install of any software as that user. Certainly playing a CD isn't going to be able to install anything rootkit-like as a Limited user. Oh, and disable Autoplay on all removeable media devices.
Yes, some programs still require Administrator access to install, although in some cases you just need to give the Limited account access to write in the global Startup menu folder or something similar, so this isn't a 100% cure-all.
are you sure you can really trust linux distros
that come as all binaries on a CD?
can you trust the GCC binary you received 7 years ago?
the solution is to stop banking and go live in a cave.
Running a rootkit detection kit on a system containing a (good) rootkit is fruitless. There are now rootkits that can detect rootkit detectors and (since most rootkit revealers rely on the discrepancy between system API calls and "direct" access to the HD) simply "demask" while they're running, so the rootkit cannot be found.
The only way to find a well written rootkit is to boot from a certainly uninfected bootdisk (or CD/DVD) and scan with it. Everything else is at best working against less sophisticated kits.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Comment removed based on user account deletion
Now anyone who wants to write a rootkit has a much better set of test suites to test its non-detectability! I'm glad we're investing in the education and skill of malware writers...we may need those rich crack programmers for something someday.
You are in a maze of twisty little passages; all alike.
Yes, I am aware of that post.
I imagine it is theoretically possible... but to my understanding highly improbable.
The Bios would have to be reverse engineered, modified and reburned to add the code to execute the rootkit(even if it resided elsewhere). Since it seems that every motherboard has a different Bios image... this would be a lot of work.
Hows the fit on that tin cap? Tight?
AVG also has an anti-rootkit available, works just as good as any of the others in the article (all of which I've used).
It doesn't even have to be that complex. There is no reason that Knoppix can't be rooted if you put it on a network. The only advantage to CD based distrobutions here is that you can get the computer back into a known clean state just by rebooting it.
Yes, it gave the linked error message when I ran the program.
Certainly it means that the program cannot be trusted. Note that there is a new version since yesterday evening.
How would you go about detecting a rootkit from a LAN? I've heard the term "passive sniffer" thrown around but no programs have been named specifically. Also, I have read some posts mentioning the use of steganographic techniques to hide rootkits. What tools can be used to unmask these threats? I imagine it would involve comparing MD5's from a live and offline system.