Slashdot Mirror
Six Rootkit Detectors To Protect Your PC
An anonymous reader writes "InformationWeek has a review of 6 rootkit detectors.This issue became big last year when Sony released some music CDs which came with a rootkit that silently burrowed into PCs. This review looks at how you can block rootkits and protect your machine using F-Secure Backlight, IceSword, RKDetector, RootkitBuster, RootkitRevealer, and Rookit Unhooker."
Click here to going to next pages. :)
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
"helpful" activex popup ads:
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!
Whew. Good thing GNU is Not Unix.
apt-get install chkrootkit rkhunter
------ Take away the right to say fuck and you take away the right to say fuck the government.
It's interesting that programmers working outside of a corporate environment produce such amazing products. Hmmm... I wonder what's up with that?
Shouldn't these tools be a part of already-existent anti-virus solutions? Why another application for rootkits if trojans, virii, and spyware detection are (usually) in the same package? It's not like rootkits are new threats.
/.
Hey, thanks for the mention in the article but that is a really old version you've used to test! The last version I've released publicly is AFX Windows Rootkit 2005, it's open source and can be found on http://www.rootkit.com/ the other more recent versions I've sold privately.
Now on the subject of rootkit detection. Most of these use the method based on Microsoft's Strider: GhostBuster. Which uses a low-level method to gather seemingly clean system information then gathers the same information using a high-level method. The idea is that rootkits will have only hooked the high-level methods so there should be a difference in results. Whatever is listed in the low-level results and not listed in the high-level results is displayed as "hidden information". Effectively they are using the rootkit's own hiding functions against itself to detect it. If the rootkit doesn't hide itself to avoid detection it's still made itself visible.
The problem is that you put yourself in an arms race with who can hook system information at the lowest level. Luckily since we (the sysadmin) have access to the hardware and presumably the attacker does not, a hardware method of gathering system information would be the best. You can bet money that we are going to be seeing hardware level rootkit detectors sooner or later.
The final problem is that a backdoor can be hidden without using these rootkit methods. By hooking incoming socket connections we can make a hidden backdoor that creates no new processes, threads, files, registry keys or any other permanent data. I and others have released POC code already. Also, making the same attack persist after reboot is only a matter of disabling SFC and altering userinit.exe, explorer.exe or whatever you like. Your rootkit detector will come up clean everytime.
Is it just me, or am I being overly cautious not wanting to download a rootkit detector from Chinese and Russian software developers? Are these programs opensource? Are they safe? Anyone?
LOL is this a serious post? Most rootkits out there are designed to work on *nix based operating systems. True rootkits are far more common on for these flavors of OS over that of Windows. I am not sure if this is a reference to Ubuntu being secure. Maybe you could have recommended visting a site that houses a BSD flavor..won't bother pointing out one for that useless debate. Choosing Ubuntu is not going to protect you from rootkits in anyway.
Wow! Lets rate programs on diagnosing a potentially lying PC!
This is just a stupid idea if anything. The purpose of a rootkit is to make a very hidden hole into a system. Doing this requires reprogramming and setting up the system in that nobody can diagnose itself. The key is to diagnose any sort of rootkit, one must run from known good binaries.
Now, we dont have the source to Windows, but we have binaries. Well, lets MD5 the binaries and then compare to a known good (just installed, no network interfaces) installation. The differences are possible holes.
No program can be trusted when the system it sits upon cannot be trusted. When system trust is gone, one must redeploy the system to regain trust.
Do NOT buy music from stores. Instead, get them from torrents. It's safer!
Circumcision is child abuse.
Most rootkits target *nix. OS X is a Unix variant. But since Macs don't ever get viruses, I'm sure it would be impossible to get past Apple's expert, fully-secure software.
/.
Can any of them detect blue pill?
1. Windows Defender does exist.
2. Windows Defender is freeware.
3. Windows Defender is malware removalal tool, not a firewall.
4. You're tool late, I already laughed.
A/Coward - What, you somehow think that you are immune to Rootkits???
I would not bet my life on that. Even though I consider the default security in my choice of GNU/Linux distro to be tighter than OS-X, I still use Knoppix (a CD based GNU/LINUX OS) for internet banking. It is the only TRUE assurance of safety from being rooted.
The review was for tools for the Windows PC, not the MAC or Linux. Sorry this was not more evident. The parent is (without knowlege) implying that the Mac is not vunerable to being rooted. And some fanbois are modding this funny? This might be funny, IF IT WERE TRUE! Not only are MAC rootkits possible, they exist. Do a google search before you post and it will prevent mistakes like this. (Yes I know, I run a risk of hardcore fans modding me down)
It's really a philosophic problem. Microsoft sees the OS as a weapon against the competitors, and when you're building weapons, of course you make them as powerful as possible and of course safety gets a lower priority. (Microsoft's highest priority has always been on the money, however.) The problem is that the results are overpowered OSes that real experts can use in ways that completely overwhelm us normal mortals. Heaven help the little old lady who just wants to visit her church's website on Sundays.
As regards the article, I read most of it, and might finish it later, but I wasn't too impressed with it or with the rootkit-detection tools that I've experimented with in the past. I'm supposed to be something of a computer expert, and I've certainly been using them long enough, but I regard myself as pretty much a helpless infant in these areas. If the NSA is planning to root my computer because I regard Dubya as an asinine embarrassment to my nation, I don't seriously expect to be able to do anything about it. Sure, I can use an expert's tools in many cases, but that doesn't make me any match for a real expert with corresponding tools. Or returning to the weapon metaphor, I may have a great gun, and even be competent enough in using it, but I'm sure that a seriously experienced killer would have little trouble taking me out, even with an inferior weapon.
In conclusion, "It's a poor craftsman who blames his tools", but it's also a poor craftsman who can't tell the difference...
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
I find it curious and a bit disconcerting when I see how much emphasis people place on the subject of malware detection in the realm of information security. What to do after malicious code finds it's way onto our systems, or into our networks is certainly something to consider, and any security plan would be incomplete without it, but this area takes up far too much of our time, given that other aspects of security bring a much more favorable cost/benefit ratio.
I can only surmise that there is certain "sexiness" to malware detection; much the same way that fancy home alarm systems are the first thing that many think of when contemplating home security.
In the home security market, advertisements depict evil prowlers dressed in sweat-suits busting through the back door of the house, while a frightened soccer mom with her five year old daughter cower upstairs. The alarm sounds, the prowler runs away, and a call comes in from the alarm provider, asking if they are ok. Quite dramatic. Quite unrealistic too.
In the information security market there are no soccer moms, and the prowlers don't run around in matching sweat-suits, but the theme is similar. "Buy our product - it will catch intruders when they enter and save you." Again - quite dramatic, and quite unrealistic.
In the real world, people forget to turn on their alarm systems, or they forget to change the batteries, or intruders know how to disable them without triggering them.
In the real world, people also forget to update their AV/IDS signatures, or turn their security product off for various reasons - usually convenience-related, or like the prowler in the home, malware simply disables the security solution on it's way in.
Just as in securing a home, we would be better off if we first focused on installing heavy doors and deadbolts on all outside entrances, in the virtual world, we would be better off focusing on the barriers that malware must overcome to gain entry to our systems and access to our information and resources.
This is far from an original thought, but I'll say it anyway as it deserved to be repeated. The security industry is a joke. It's is filled by people who either don't understand the basic pricipals of information security, or do but choose to to sell 'sexy' solutions anyway. I once ran into the author of a somewhat popular Windows security product on a messageboard and was shocked at his aparent lack of understanding of how his platform of choice, Windows, worked.
I supposed this is more of a Windows problem than anything else. Not a problem with Windows, the operating system, but a problem with WIndows, the culture.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Someone said we could MD5 Windows binaries... Of course we can, though MD5 is so broken in this 21st century that you'd better use SHA-1 ;)
Another dude said "but my rootkit detect attempt to MD5 and returns the correst sum". Kind of, it s even better than that for the best of the breed: they recognize themselves in *any* attempt to read the file and replace their code (that they recognized) with the code that the file is supposed to contain at that place. What I mean is: you don't specifically decide to defeat a cryptographic checksum or an anti-virus or or or... But you fake the infos coming from every single attempt to read the file.
Of course the real "game over for rootkits" comes when you unplug the drive, plug it to a known good system (for example, say, an OpenBSD system that has *never* been hooked to the Internet) and then compare every file with their previous version. Altered userinit.exe? Game over rootkit. Altered winlogon? Game over rootkit. It works the same for Unix systems (for which, btw, there exist many more rootkits, though not as successfull in spreading). Which is why projects like honeynet are so succesfull at catching malware "in the wild". And with projects such as Honeynet being so successful, rootkit writers sometimes decide to write rootkit that don't install to the disk and that don't install if they detect they're running on an emulated/virtualized system. Which means the rootkit will only live for as long as the computer is turned on. And then it will need to re-infect the machine using the same exploit if the machine reboots. Which is also a pain in the arse for rootkit writers: the vulnerability may very well have been patched meanwhile (think auto-update) or exploited by someone else, etc.
Note that you can always detect suspicious trafic using a passive sniffer too (think shomiti tap or one-way ethernet cable... or "software" passive sniffer).
There's no such thing as an "undetectable rootkit". No matter if it tries to hide in the BIOS (Sun machine have been having protection again BIOS write since ever btw), which is incredibly hard (the BIOS code being so small), no matter if it tries to hide in some GFX card's chipset (wtf? someone wrote there s work on that... I can only see it happen on broken-by-design GFX card and it is certainly not common practice), no matter if it tries to install as an hypervisor on VT-enabled systems...
There's always gonna be a way to detect a rootkit, wether you're on Windows or Unix systems, wether you and rootkit authors like it or not. I'm not arguing, I'm not discussing: I'm stating facts.
Actually I've written an article describing how to do what you speak of. The only piece of the puzzle you left out is that you need to scan the system from inside Windows first. Then boot into Linux and scan the hard drive from there so you can compare the results.
The article can be found here here.