Microsoft Confirms Update-Linked BSODs Required Compromised Machines

Trailrunner7 writes "Microsoft on Thursday confirmed that the blue screen of death issues that affected a slew of users after the latest batch of Patch Tuesday updates is the result of an existing infection by the Alureon rootkit. There was widespread speculation after the patch release that simply installing the MS10-015 update was causing the BSOD condition on some Windows 32-bit machines. However, Microsoft said at the time this was not the case and started an investigation into the problem. In an advisory released Thursday, the company said that it now was confident that the restart problem is being caused by the Alureon rootkit." That seems a harsh way to find out that your Windows machine has been rooted.

Comments

But better than not finding out at all.

[dmgxmichael]

Now, I wonder who the first poster is going to be to demand Microsoft test their patches for compatibility with viruses and malware?

Re:But better than not finding out at all.

[bigredradio]

First post...that would be you sir.

Re:But better than not finding out at all.

[Anonymous Coward]

The rootkitted library was not a part of the update, just one of the libraries it was using. You should demand that your rootkit vendor stick to published APIs to avoid this in the future.

Re:But better than not finding out at all.

[TubeSteak]

Don't worry, it looks like the malware authors have already rushed out an update for their rootkit
http://www.prevx.com/blog/143/BSOD-after-MS-TDL-authors-apologize.html

Re:But better than not finding out at all.

[lgw]

Actually, they do. However, Windows Update will apply patches before doing malware removal - I've never quite understood why that was the preferred order.

Re:But better than not finding out at all.

[rve]

The rootkitted library was not a part of the update, just one of the libraries it was using. You should demand that your rootkit vendor stick to published APIs to avoid this in the future.

An OS update shouldn't break third party applications such as rootkits. Many people's livelihoods depend on these rootkits. Did you guys at MS even consider how difficult it is to retroactively patch infected torrents once they're out on the net?

Re:But better than not finding out at all.

[Johnno74]

Wow, nice way to find/create an anti-ms slant on the story. I can respect people who bash microsoft if they know what they are talking about, but you clearly don't so no biscut.

Prolems with your theory:

1) Microsoft updates don't patch files. They replace them. Probably to avoid the issues you assume are happening here (even though they aren't). I'll excuse you for not knowing this.

2) The file that the rootkit infects isn't the file affected by the patch. The file MS patched WAS 100% clean. The rootkit was either modifying or calling the patched file using a static offset. After the patch this offset was no longer correct and the rootkit caused a bluescreen when it used it.

3) Even if the patch was a delta and not a whole file, and the file to be patched was the infected file, and if the patch _did_ checksum the file first then the checksum would not have revealed anything was wrong. Do you even know what a rootkit is? A rootkit, by definition cloaks itself by modifying the OS so system calls will not reveal the rootkit. Read the file where the rootkit resides and the rootkit will intercept this and return the original file contents, sans rootkit.

Re:But better than not finding out at all.

[ashridah]

When the rootkit has complete, unrestricted access to the system, *it can do anything it wants*. there really isn't a way to stop it, unless you've forced it into a lower-security prison (aka, user-level).

If it wants to pick a random memory address that it's hard coded and jump to it, it can do it. the cpu's not going to stop it, and windows is not responsible for fixing that. You may as well ask for the linux kernel to stop a rootkit module from rewriting the software interrupt vector tables and hooking into system calls. If it has write-anywhere memory level access (and it does, it's in the kernel during initialization, launched by root), then it can write bytes to memory, anywhere it chooses. if you then upgrade to a kernel with a different system call table layout due to an improvement, and the malware doesn't self-correct? boom!

Now, solutions to this involve things like virtualization and sandboxing, but we're not quite there yet. I wouldn't actually mind seeing an operating system take advantage of VT and other things to produce an OS with a secure core, that self-verifies and only accepts signed updates.

Re:But better than not finding out at all.

[dhavleak]

I think that award goes to to Timothy -- our fearless fudding editor. I mean, consider how he ended TFA: "That seems a harsh way to find out that your Windows machine has been rooted.".

Alright, maybe that's a harsh assessment, but after countless other posts like this I'm not inclined to give him the benefit of doubt. Let's recap:
1. The Alureon rootkit isn't new, and should be detected by any AV worth it's salt
2. That being the case, affected users were not running AV, or were infected before they installed their AV.
3. Affected users are running a 10-year old OS.
4. More recent OSes (64-bit Vista and Win7) have inbuilt measures that render Alureon ineffective (PatchGuard - which checks for signatures on kernel modules).
5. 32-bit Vista and Win7 would be immune as well if the AV cartel had not threatened to approach the DOJ with antitrust complaints if MS implemented PatchGuard in the 32-bit versions.
6. MS has made online scanning tools, a malware removal tool, and a free AV/security suite (MS security essentials) that any of the affected users could have used, prior to the update, and they would have been fine.

So now, short of forcibly enrolling users in "install and run AV 101", what else could you be calling for, Mr. Timothy (editor) when you say that you think this is a particularly harsh way to find out that you've been infected? What the fuck else do you think MS should do? Go back in time, and fucking add patch guard to XP before they release it? I'm really fucking interested in hearing your opinion on this.

Re:But better than not finding out at all.

[Pharmboy]

Now, I wonder who the first poster is going to be to demand Microsoft test their patches for compatibility with viruses and malware?

To be fair, Microsoft is year ahead of Linux in this area. Linux isn't compatible with almost every kinds of virus/malware. Wine is helping by providing the APIs needed for some malware, but Linux (iptables in particular) still interferes with the proper operation of some of these programs. Like it or not, if you want to run these malware programs reliably, you should stay away from Linux. At least Microsoft lets you run *most* of these viruses after an update.

Re:But better than not finding out at all.

[antek9]

May I point you to the PS3's operating system, then? It's taken years, a hardware hack, and an ingenious hacker to even bypass the hypervisor on the system, and even then he's not even close to running arbitrary (unsigned) code on the box. My 2 cents: your last paragraph scenario is already possible and being implemented, just not by every vendor.

Microsoft might want to cut Sony's engineers some slack there. And yes, I do know the downside to it: everything, every single application would have to be signed and greenlighted by Microsoft, Ubuntu, Redhat, you name it. Just like Apple and Google do it for their mobile platforms. A pain, sure, but: no pain, no gain.

Re:But better than not finding out at all.

[smash]

Maybe because if you're not patched, you'll often get re-infected before the update is completed?

Re:But better than not finding out at all.

[smash]

I have no problem with patches bluescreening rooted boxes. If your box is rooted, the only way to e sure to fix it is a reinstall - having patches try to work around rootkit installs is retarded. If you don't know you're rooted, then too bad. Learn to maintain your pc/network.

Re:But better than not finding out at all.

[poena.dare]

Dear Microsoft:

Please continue to turn off user's computers which are compromised. If at all possible, please display a message directing anyone in my zip code that I'm available to fix it for them at competitive prices. I really need the work.

Re:But better than not finding out at all.

[jonadab]

He didn't demand anything of the kind. He only suggested it, if anything in a way that implied it would be an unreasonable expectation. Which it would be, because, frankly, once you become aware that a system has a rootkit installed, the only sane thing to do is a complete format and reinstall.

Well, you can do some forensics first if you want, and maybe copy off some data (if you're careful about how you do it so as not to infect any system you copy it to). But you're going to boot from known-clean (and, preferably, read-only) media to do those things, NOT from the known-infected system. (A LiveCD is what I would recommend for such post-mortem activities.) If you want to actually boot from and use the infected system again, it needs a clean reinstall first, period. Do not pass go, do not collect two hundred dollars. Booting from the infected system is highly inadvisable and much worse than useless, because the system is compromised. Only someone who doesn't know any better due to a complete lack of understanding of security issues would even consider doing that.

So personally I don't see how this way of finding out is any more brutal than any other way of finding out. Continuing to use the system, even though it has a rootkit, wouldn't be a reasonable course of action anyway. Nobody who understands security would do that, and nobody else *should* either.

(Unless you're operating some kind of firewalled-garden virtualized honeypot network for the express purpose of studying how infections spread, but in that case you wouldn't be deploying the patch. I suppose if you were doing a controlled study on the effectiveness of the patch... but we're now DEEP into the realm of purely hypothetical problems with no real-world impact whatsoever.)

If we were going to criticize Microsoft here, it would be for other things, such as how long it took them to deliver the patch once the issue was reported. (I don't happen to know how long it was in this instance, BTW; I wasn't following this particular vulnerability very closely.)

Assuming it's true that the patch only causes problems on already-rootkitted systems (and I haven't seen anyone claim the contrary), then that's not really a meaningful flaw in the patch, IMO. Those systems were already toast anyway. How well does the patch work on systems that hadn't been infected? That's what matters.

Re:But better than not finding out at all.

[Garridan]

Oh snap! Your computer crashed because it had malware! Harsh man, that was real harsh. Couldn't the rootkit like, call you up and say "hey man, I'm in ur system, mining ur dataz", rather than just crash? That would be a lot more convenient, and significantly less harsh. I mean, what are they going to do next -- make the computer insult you, too?

Not that harsh

[bigredradio]

Yeah a BSOD is harsh, but finding your bank account mysteriously drained of funds is more harsh. At least they found out.

Better than not knowing that you've been rooted

[jandrese]

The bluescreen may be painful, but it is far less painful than having your information stolen by criminals. Assuming of course the people who own the machines are savvy enough to properly install their firewalls and virus protection next time.

Re:Better than not knowing that you've been rooted

[Locutus]

it was probably about 6 years ago when a number of goverment offices American Express, and others including CNN had their computers BSODing. CNN even stayed on the air for a few hours just talking about how the computers were all rebooting. The cause of that was that the computers were part of a botnet and an update to the botnet caused BSODs.
In plain language, many government computers and businesses computers have been infected without them knowing it. And as I mentioned, large companies with financial ties like American Express. You can not secure Windows without unplugging it from the network. There was a CIO of one company which got hacked and he ended up quiting saying something much the same. Businesses who insist on Windows are insisting on something which is very very difficult to secure.

Now I wonder if this is what took out all those Norfolk VA computers. The ones which it was said that they don't think it was something they got off the internet but in the same breath said they don't know what caused it or how it got there.

LoB

Re:Better than not knowing that you've been rooted

[geekprime]

Couldn't a deep packet inspection reveal the botnet behaviors regardless of how good the rootkit was?

Sounds like a home router feature to me...

Re:Better than not knowing that you've been rooted

[bertok]

it was probably about 6 years ago when a number of goverment offices American Express, and others including CNN had their computers BSODing. CNN even stayed on the air for a few hours just talking about how the computers were all rebooting. The cause of that was that the computers were part of a botnet and an update to the botnet caused BSODs.
In plain language, many government computers and businesses computers have been infected without them knowing it. And as I mentioned, large companies with financial ties like American Express. You can not secure Windows without unplugging it from the network. There was a CIO of one company which got hacked and he ended up quiting saying something much the same. Businesses who insist on Windows are insisting on something which is very very difficult to secure.

Oh, I assure you, they know about it. They're just too incompetent to do anything about it.

I was once at a large bank, and I was warned not to plug my laptop into the bank's network. At first I was thinking "this must be for security reasons, they clearly don't (and shouldn't) trust some random consultant's laptop on their network", but then I was told that it was for my own protection. Apparently the bank network was so lousy with viruses that a laptop without the latest patches would last only minutes before it was rooted. I keep my work laptop patched, so I did plug in. I ran Wireshark for a few minutes, which detected about a dozen hack attempts on my machine. On top of this, many of their servers were running ancient versions of windows, many at RTM patch levels. I suspect they were all infected, but I didn't have a chance to look into it.

It's not just one or two financial institutions, from what I gather, many of the larger ones have infections.

This is what excessive bureaucracy does to IT: the amount of paper work required to approve a patch is so onerous that IT managers simply don't patch servers. The paper work is meant to prevent the minor problem of 'unapproved' patches causing disruptions, but the end result is even worse, which is unpatched machines with rampant infections.

Broaden their test base

[Itninja]

Microsoft needs to start testing against all known (and future) viruses and other malware. It just makes sense.

Re:Broaden their test base

[zappepcs]

Just have patches issued by McAfee and Symantec... that will fix the problem, for certain.

Most effective mechanism for making a safer 'net

[Nzimmer911]

I think that this approach should become the industry standard for retaliation against malware. What better way to force complacent users to cleanup their machines than to disable them? Less botnets = more bandwidth for the rest of us.

Huh? I thought Netcraft confirmed it was dead?

[Anonymous Coward]

Huh? I thought Netcraft confirmed that BSD was dead. Oh waaaiiiitttt... BSOD
Ok nevermind

Don't worry

[wiredog]

The malware has been updated so that it won't cause a crash.

Re:Don't worry

[Megahard]

If people would keep their machines updated with the latest rootkit and virus patches then this wouldn't happen.

Well at least the Norfolk town IT can rest easy

[Parallax48]

Sounds like we found the explanation for the Norfolk issue:
http://news.slashdot.org/story/10/02/17/196230/Time-Bomb-May-Have-Destroyed-800-Norfolk-City-PCs-Data

Be Gentle

[e2d2]

That seems a harsh way to find out that your Windows machine has been rooted.

What do you want? Some cuddling before breaking the bad news?

"Sweety.. you got rooted" .. as it goes in the _wrong_ hole.

Re:Be Gentle

[Anonymous Coward]

Wait, there is a _wrong_ hole???

Re:Be Gentle

[Maestro485]

I'm a rootkit, and Windows 7 was my idea!

bsod

[confused one]

That seems a harsh way to find out that your Windows machine has been rooted.

There are plenty of people who think that tracking down all the machines in these botnets and disabling them is a reasonable way of dealing with the problem.

Re:bsod

[kent_eh]

I've read an article about this, it mentions the possibility of such a machine handling the life support systems in a hospital. Major lawsuit there.

Yeah.
A lawsuit for whoever had an internet connected machine running a life-support system and set to auto-update.

Software updates on mission-critical systems should only happen manually, and after strict auditing.
I won't even bother addressing how much of a bad idea it would be to have a life-support machine able to access (or be directly accessed from) the internet.

Re:No Worries

[snowraver1]

Prompt, efficient and convienient! Where can I buy this Root Kit?

Malicious Software Removal Tool

[HTH NE1]

So is Microsoft rushing out an update to their Malicious Software Removal Tool to clean up this rootkit?

Re:Malicious Software Removal Tool

[lgw]

I would hope so. But the malware removal tool runs last in the Windows Update process. I've never understood why.

Re:Not tech people!

[lgw]

Yes, your solution involving non-technical people reading the text of pop-up messages will surely work. Especially a message that looks exactly like some malware, and which they've likely been warned to ignore. The taskbar icon that was added specifically to warn people to "install a firewall/update your browser/ run your AV" didn't work, but adding yet another pop-up will surely work this time.

Re:Not tech people!

[archangel9]

Maybe an error message saying "We detect that your machine is infected with a rootkit, all of your personal information is in danger of being stolen. Please install a firewall/update your browser/ run your AV". That way, instead of confusion and anger from a BSOD, the user will be educated and possibly secure their system.

I see those words on the screen all the time. The problem is, they're delivered by cleverly-designed socially engineered Malware. The next generation of Malware will do the same thing and imitate the "new" default messages that Windows gives. How many people per day/week/month fall for the same "Your system is compromised, please click here and purchase this product" every day, regardless of the bad grammar and spelling contained in the message? As long as I've been in IT, there still isn't a good way to educate users that shirk off all personal responsibility and refuse to engage their thought processes when it comes to PCs. The world just keeps making better idiots.

Re:Good

[mlts]

Even better, it gets the machine off the net, so other people are not victims of DDoS attacks, spam, automated scans, and other crap that might come from a botnet client.

I admit I sound like a jerk here, but I'd rather have a machine with a BSOD than a rootkitted box. Reinstalling or reimaging a machine may be a bit time consuming, but it is nowhere the time it would take to recover access to compromised bank accounts, Web accounts, gaming, and dealing with identity theft issues.

The un-harsh way

[hey!]

[A Microsoft representative comes to a System Admin's place of work for a little meeting.]

MR: Thanks for making time to meet with me.

SA: No problem. So what's this all about?

MR: I don't know how to say this, but it seems that you... well you aren't entirely in control of your systems.

SA: You mean you're selling a new management tool?

MR: No, no nothing like that. It's just that there are certain things... Well let's say there are things about your system that you don't know that you really ought to be aware of.

SA: Oh, I see. You mean like undocumented registry settings, or DLLS or stuff like that.

MR: Well, sure. Technically you *could* describe it that way. It's only....

SA: Only what? How would *you* describe it.

MR: *sigh*. OK. Some Chinese hacker working for the Russian mob has been using you as his bitch.

Good Job, Microsoft!

[Culture20]

And I mean that sincerely. Please BSOD more botnets.

Last October, Dude

[westlake]

So is Microsoft rushing out an update to their Malicious Software Removal Tool to clean up this rootkit?

Virus:Win32/Alureon.A Definition: 1.69.77.0 Released: Oct 23, 2009

Zero-day

[Anonymous Coward]

This was a zero-day exploit that the virus writers didn't know anything about.

They got the patch out as quickly as they could.

Re:Zero-day

[shutdown -p now]

See? Many eyeballs do make bugs shallow!

Re:Not tech people!

[BradleyUffner]

However (in a perfect world), if MS validated the files before patching/updating them, the user could be warned of their infection before their machine gets trashed.

Root kits are designed to hide their presence from the operating system. They can hook file system calls and return what looks like the proper version of the file to anything trying to read it. Once something is hooked into the machine at a low enough level the only way to detect it would be to boot from non infected start up disk and scan the infected volume.

Re:Dumbass users..

[jimicus]

48 hours ago I was notified of a laptop with a rootkit.

And I can tell you now, that laptop wasn't running slowly.

It wasn't redirecting web requests.

It wasn't doing any of the things you might associate with rootkits. Yet replacing the AV with an alternate product and the alternate product detected several real issues.

Frankly, if I hadn't been notified by our bank (whose security company had managed to get a site shutdown and get a list of all potentially compromised accounts) I would never have had a clue. I concede that the user had admin privs on their laptop but I'm given to understand that even that isn't a huge barrier to a lot of modern rootkits. Thank Christ the bank in question doesn't allow you to do anything without the use of a separate security device they ship you.

Talk about a rock and a hard place. I can't trust the laptop at all, and it was infected while running a regularly-updated copy of Symantec AV Enterprise which suggests I can't necessarily rely on AV software to do what it says on the tin. Windows is obviously a lost cause unless I want to spend the rest of my live playing whack-a-mole yet I don't think the Powers that Be will stomach a move to Linux (even though most of them haven't used Windows-specific software in years).

Answers on the back of a postcard....

Re:Dumbass users..

[X0563511]

and haven't gotten a virus, rootkit, or other miscellaneous malware in years. ... that made itself known.

Re:But the fix will break Alureon!

[Pyrus.mg]

As mentioned above if you are an Alureon user an update has already been surreptitiously deployed to your pc and you can safely let Microsoft secure your system without losing any Alureon functionality.

Re:You don't have to.

[cusco]

"a bootable Linux CD"

Work in the real world much? The network that I'm currently plugged into has 69,000 workstations on it, and 27,000 servers, plus another couple thousand ancillary computers like DVRs and cash registers (yes, they all run Windows). The hospital that I'm going to be working at tomorrow has over 1200 nodes on its network of which at least a hundred are considered non-rebootable life-safety systems (yes, almost all of those are Windows). That brilliant idea might work at your home office, but out here where the rest of us work it would get you laughed out of your job interview.

Re:Dumbass users..

[smash]

Symantec is shit. Users should not have admin on business machines. They should also not be going out via unfiltered internet connection to whatever dodgy website they like and mail should be screened for questionable content. If you think that this sort of thing wouldn't be happening on Linux (or anything else) if it had so many clueless users in business settings using the product - you're deluded.

The network doesn't lie...

[gravyface]

Setup a non-transparent proxy, push out proxy settings to all your users (with GP or whatever, or do it manually), drop egress Web/IRC traffic. Now sit back and watch your firewall logs for alerts (or better yet setup syslog-ng or Kiwi Syslog Server to send you alerts) -- anything banging against the firewall is something you need to look at. Why? Because malware is rarely proxy-aware -- it assumes (rightfully so) that people either use transparent proxies or have no outbound filtering setup so when it tries to phone home, it'll make a lot of noise.

Re:You don't have to.

[Locutus]

good points but I really would not worry about someone laughing at you when they have put Windows on life-safety system or any mission critical system.

LoB

Dual Boot Linux

[Anonymous Coward]

Linux is so easy now, just dual boot and do banking from Linux. Then your worries would be much reduced.