Slashdot Mirror
New Rootkit Bypasses Windows Code-Signing Security
Trailrunner7 writes "In recent versions of Windows, specifically Vista and Windows 7, Microsoft has introduced a number of new security features designed to prevent malicious code from running. But attackers are continually finding new ways around those protections, and the latest example is a rootkit that can bypass the Windows driver-signing protection."
That's the best use I can visualize for virii and rootkits
Build your own energy sources from scratch. http://otherpower.com/
Without "trusted" hardware the user will always be able to override software "protections" designed to prevent arbitrary code execution. This is just another "leapfrog" in this arms race. Give me "trusted computing" where I control the keys and decide what software is "trusted" and I'd be fine w/ it. Otherwise, I'll take the current situation on personal computers because, at least, I can run arbitrary software. ("Don't turn my PC into an iPhone, bro!")
The Attitude Adjuster, I hate me, you can too.
Safe Mode is all I run nowadays.
I am just too scared to 'Start Windows Normally'
He who knows best knows how little he knows. - Thomas Jefferson
Old sk00l. When was the last MBR infector seen in the wild? 2002? Most of this class are from the DOS era, fercryingoutloud.
Welcome to the Panopticon. Used to be a prison, now it's your home.
Of course, but the primary role of that lock down was to protect their DRM'd subsystems, which can be accessed by drivers running in kernel space, not to protect end-users from malicious driver code. Those were vicious but by far a minority, and hasn't improved the situation on Windows Vista x64 / Windows 7 in the slightest.
But hey, now Microsoft gets to bill everyone $250 for each driver release!
or physical access. At that point anything goes. Why bother with screwing with code signing tricks when you can just run whatever code you like.
It lives in the mbr and sets a boot flag that lowers the load integrity threshold like users have been doing to run/test utilities that don't pay to get signed.
This is a new version of a ~2 year old rootkit, also known as TDSS, and the company responsible for this particular parasite is a russian outfit known as Dogma Millions. Eset did a good writeup on the older version here. This newer version is actually even more interesting than the article indicates. It's intelligent enough to send tools like MBRCheck off to look at a backup of the MBR so that they'll erroneously return a "clean" verdict while the system remains infected. The best bet for removal is TDSSKiller by Kaspersky (the company that wrote the blog entry).
To err is human, to really foul up requires a computer
Welcome to Eleven Thousandth Slash Dot Dot Org's and Cambridge International Language Forum! We shall henceforth debate the propriety of linguistic terms to be used by ourselves, and other participants of the public at large, within the realm of our debate on all matters relating to the technical world - including those of impact in non-technically-literate circles of society. We will here discuss the proper use of verbs and nouns, adverbs and adjectives, phrasal verbs and colloquial terms, and vote on their acceptability to be assembled into a properly approved vocabulary for use on this most honourable forum in all of geekdom, Slashdot! Our first items approved on the agenda today -
Acceptable vocabulary for use within Slashdot fora
boxen, facetious plural of box (by analogy to oxen as the plural form of ox), particularly in computer hacker slang with respect to the term 'box' for a computer
Non-acceptable vocabulary for use within Slashdot fora
Virii is in fact an INCORRECT pluralization of "virus", however, some retard keeps resubmitting it as the plural form. 1 4m k00l, 1 c4n wr173 l33tz0r 'virii' 1n v15u4l b451c 5cr1p7.. ph33r m3h.
Further submissions for today's Slashdot Approved Vocabulary vote?
Build your own energy sources from scratch. http://otherpower.com/
TPMs can be used for nasty things, but this is one of the good things about BitLocker and TPMs -- a modified MBR would result in the machine not booting because the TPM would not hand the key over to the encrypted system partition due to the changed code.
Of course, the TPM would have to be "sealed" before the malware hit the system, and a viral infection is not the first thing on the list to check if a box is sitting there in recovery mode asking for a key or a USB flash drive to continue booting.
To me, if one has Windows 7, an edition that supports BitLocker, and a TPM/support for it in hardware, it becomes a no brainer to enable BitLocker if only to have protection against "evil maid" attacks, as well as MBR infections.
It lives in the mbr and sets a boot flag that lowers the load integrity threshold like users have been doing to run/test utilities that don't pay to get signed.
As long as they keep the cost and complexity of getting a signature so high this will always become a problem. Chinese drivers will publish without signatures, users will *want* to run unsigned code, and there goes your security scheme.
Build your own energy sources from scratch. http://otherpower.com/
The nominative plural ending for Latin nouns following the second declension is -i, so if virus was a masculine noun, which it is not ("n." means it's neutral), it would then take an i, which would give "viri." But since "virus" is neutral, its plural is "vira," so next time you wanna brag about how well you know Latin — without sounding like a fool —, say that instead.
Or you can say "viruses" if you feel like speaking English. My €0.02.
P.S.: The only time you get that double i in the nominative plural is when you inflect a second declension masculine noun that ends in -ius, such as "filius."
"The body may heal, but the mind is not always so resilient." -- Deus Ex: Human Revolution
News at 11.
throw new NoSignatureException();
Vista and 7's driver signing requirement is mainly for DRM purposes. The main thing Microsoft wanted to stop with driver signing is device drivers that create fake sound cards and video cards that can capture decrypted DRM-protected songs and movies. It doesn't help much with rootkits. This is why if you disable driver signing yourself, Vista and 7 will refuse to play some types of DRM-protected media. For example, some Blu-Ray players.
Rootkits can just attack the boot process to disable the signature checks, as shown here. But there is another way - third party companies don't have the stringent secure coding standards of modern Microsoft, so all you need to do is find a bug in a legitimately signed driver, and you're in. I found a signed Win64 driver that adds IOCTLs to let Administrators set CPU MSRs - you can exploit that by having it set the system call handler address to your own memory, and you're in.
I like how Windows warns you about unsigned device drivers installed the normal way - this is good for users, and helps keep hardware companies in check a little bit. However, removing the right to load unsigned code without disabling part of the OS is unfair.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
That mechanism was actually put there for driver developers - so that you can do the normal compile/debug cycle without having to sign each and every developer build.
This sounds like it makes things less secure - but in one way it actually makes things *more* secure. If every developer had the ability to securely sign code, it would be easy for one rogue developer to secretly sign nasty code and release it in the wild. If the signing key is only in the hands of one build engineer, and only lives on one machine in the corporation, there will be less correctly-signed-but-malicious modules out there.
(Of course, the mechanism was badly implemented - you should never be able to run unsigned modules on a consumer build of Windows. The bypass should only be possible in a developer Windows install, which is only available to registered developers).
Alureon patches the Windows Boot Configuration Data to make the machine think that what's loading is Windows PE, rather than a normal version of Windows, which prevents code integrity checks from being performed.
If this rootkit is just flipping a few bits to spoof the Windows version, surely Microsoft can implement a more sophisticated way of checking what version of Windows is booting up.
TDSS ... is an example of a particularly pernicious type of rootkit that infects the master boot record of a PC.
I've seen some BIOS versions that can write-protect the MBR. Perhaps this should be more widely used. I can verify that these TDSS rootkits are a bitch to remove.
(Of course, the mechanism was badly implemented - you should never be able to run unsigned modules on a consumer build of Windows. The bypass should only be possible in a developer Windows install, which is only available to registered developers).
Maybe you haven't read the "debuggers will be illegal in the future!" RMS rant...
Hmmm, couldn't you just clear a Master Boot Record securely & safely enough using a Windows installation CD/DVD, which is read-only (proof to anything infecting it in other words) and a clean bootup environs first of all, & it's available to you via a series of bootup options on Windows installation disks. Recovery Console for example, being one of those options typically, allows for the fixmbr command, which is 1 way to go about this easily & safely enough, for example.
Windows have so many holes like swiss cheese...
Recipes for USA bankrupt - http://tinypaste.com/0d66f dd = dollar deluge (printed in the infinity)
we could just let the government decide. They're here to help, you know.