Slashdot Mirror
Most Sophisticated Rootkit Getting an Overhaul
jfruhlinger writes "TDL4, a rootkit that helps build a powerful botnet, is pegged by security vendor ESET as one of the most sophisticated pieces of malware in the world. But its creators aren't resting on their laurels; they're rewriting some of the code from the ground up to make it difficult for antimalware to detect it, creating a hidden boot partition that guarantees malware code will be loaded even before the operating system is. It's part of a plan to turn TDL4 into a turnkey product that can be sold to other criminal operations."
... please return their call ASAP. They did not leave a message.
Good thing I'm gonna get a win8 machine with secure boot. Fuck these assholes.
Naturally, we'll just make a boot sector with virus protection code that loads before anything else.
Yo Dog, I heard you like bootsectors. So I put a bootsector in your bootsector, so you can boot, while you reboot!
As annoying and irritating and downright destructive as malware can be, the techniques used to implement it can be absolutely fascinating. Hackers are the programmers who dive into the system and understand it's weaknesses, finding holes and exploits.
It's the crackers who field that technology destructively that are the problem.
Technology in and of itself is not evil or wrong. It's the abuse of technology that we all need to be concerned about.
I do not fail; I succeed at finding out what does not work.
"TDL4, a rootkit that helps build a powerful botnet, is pegged by security vendor ESET as one of the most sophisticated pieces of malware in the world.
That we know about.
Stuxnet looked pretty mundane, on the surface. Anyone else wonder how many more such super-sophisticated malware are out there that we have no clue exists?
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Then why don't the GOOD people write a GOOD Botnet to seek out the BAD botnet and KILL it?
Yours In Astrakhan,
Kilgore Trout
Computers must have a way to boot to a guarenteed-audited environment for virus scanning.
Yes, I know that Windows 8 on computers that have "protected" BIOSes meet this requirement but I'm thinking something more general.
If you turn on a hardware switch labeled "I think I have a virus" and power on your computer, the boot sequence should be:
Protected BIOS preloader:
- audits (checks signature of) the BIOS, if signed AND has the "secure" bit set, lets it load, if not signed, loads read-only factory BIOS.
BIOS (or factory BIOS)
- audits (checks signature of) bootloader/OS loader from first available boot device. If signed and the "secure" bit is set, lets it load. If not goes on to next device in boot sequence.
and so on.
In many cases the user will be presented with "no secure boot device found, insert secure boot device and restart computer" error from the BIOS.
Inserting a signed vendor operating system install CD or live CD or rescue CD should do the trick.
Once the system is booted, security software can be downloaded, audited, and run.
Once the system is clean the user turns off the "I think I have a virus" switch and boots normally.
--
Yes, I know this won't cure a virus or rootkit that isn't DETECTED by current security software bit it will keep anything from getting a permanent (as in "throw your computer or drive away") foothold in a system AND it will make it relatively easy for the layman to get rid of such infections.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Give it up mate
Some technologies are created for evil purposes by evil people. They have no beneficial use.
Sorry, but technology is just a tool and some tools are good for only one thing: Bad.
So we're getting back to the good old days where you needed to wipe the first couple of megs of the disk with a MS debug trick and re-partition to get rid of some of the viruses.
That's a good start. But there needs to be more. Such as having multiple hashes of the KNOWN files for the OS and apps.
That way, not only can you check for KNOWN viruses ... but you can verify that the files you have do not have UNKNOWN viruses.
The only problem (aside from the daily update thing) would be user-created files. So an easy way to move those files from the machine to something like a flash drive would be handy.
Then do something similar for the registry.
And you'd have a better way of evaluating anti-virus companies. Which of them identify the most files from the most legitimate vendors and how accurately.
I know that no one here is will to say a good thing about the proposed Windows 8 secure boot "feature", but isn't this rootkit scenario the one it's trying to prevent? Would the secure boot prevent a user from booting into Windows if rootkit like this was on the computer?
to bad that most business uses will make that lock down unworkable for quite some time.
* Most business are just moving over to windows 7 now and I don't see going to windows 8 any time soon.
* In house apps will take some time to move over to any kind of new ios style app store only system.
* anti trust laws
* Lot's of old software that business need.
* The use of vender systems with there own software / os's
* Lot's business don't use the OEM install and do there own but the secure boot system can let dell lock you into dell hardware / dell video / dell HDD / other hardware that can cost up to $100 more then buying for any other on line store/ as well locking you into the crap ware loaded dell windows 8 OEM install.
* The use of Linux
To scan for a hidden partition and examine the contents
A complete rewrite ? Don't these guys read Joel On Software ? They're going to ruin their ... oh, um carry on.
If all else fails, immortality can always be assured by spectacular error.
If there is no free entry in the partition table then the malware reports to the C&C server and terminates.
So if you make sure you have 4 primary partitions created, you are essentially immune?
I don't know if I'd call Mark Zuckerberg *evil* per se...
My beliefs do not require that you agree with them.
Hence the line about "daily updates" in my post.
You boot the CD and it checks the anti-virus vendor's site for the latest information on what files are where with which hashes. That includes the OS and the applications.
With that, the only place the crackers can hide the viruses are in the user's files. And those files SHOULD be easily movable to a flash drive or such.
exactly how does malware plan on installing a hidden boot partition?
In principle, it's not hard once you get control of the system.
Step 1. Get control of system. If this is a problem for your virus then it is lame. Don't bother with the rest, it's over your head.
Step 2. While the system is running seemingly normally, locate un-partitioned space. If there is enough skip to step 6.
Step 3. Locate space at the end of a primary partition. If needed move any user data and meta-data out of that space to elsewhere. Make sure the space remains unused until you finish step 4.
Step 4. Schedule a change in the filesystem size on next reboot, wait for reboot, change filesystem size. OR if the OS allows it, just change the filesystem size.
Step 5. Schedule a change in the partition size on next reboot, wait for reboot, change partition size. OR if the OS allows it, just change the partition size.
Step 6. Create a new partition and mark it hidden. Put whatever you want on it. Mark it active.
I know I left out some housekeeping chores, like making sure there is a free entry in the partition table and a host of other little things.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
So we're getting back to the good old days where you needed to wipe the first couple of megs of the disk with a MS debug trick
I think today's version is
dd if=/dev/zero of=/dev/sda bs=1M count=2
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
That is why we are moving to GPT. I guess that that would work until you get new computer.
Isn't this supposed to be a secret or something?
Or 3 primary and 1 extended, which is how I ended up having to partition my netbook:
1) Win Boot Part /home
2) Win7 OS Part+Wubi
3) Extended
a) Linux
b) Linux swap
c) Win8 OS Part
4) Factory Recovery
Win32/Olmasco.R .. Affected platforms: Microsoft Windows .... enough said .....
a. Make your own open BIOS, protect changing the BIOS settings without proper authorization (I mean booting with USB stick), then boot the system from the BIOS.
b. Overwrite the boot sector from the one stored in BIOS.
c. Boot from a USB stick which overwrites the disk boot sector every time. (Bonus: sha1 check the binaries on the disk too, without booting the system)
I'd go for c, since it has physical security in there too.
These ideas under GNU GPLv3.
I just picked up the new iNTeL-Asus "just fuckin boot it!" v9.7 Mainboard.
I should be good to go for 10 years.
now get to your pencils and track those C&C servers,
share your lists and round us up,
off to the fema camps, in the sun and the mud,
where ever she stops nobody knows.
Ah profit of dooms,
go long - dhs,tsa,online_ID_license, kaspersky,facebook,nsa,oracle,databases
going long - swat team equipment, gas masks, broken marble, glass, and cement, chemicals, and lead
going short - 201K, 401K, USDX, bonds,
Oh how shall ye clone ye hard drive when all hard drive factory are destroyed?
short - western digital,maxtor
short - raw materials
Keep going slashdot, it's almost here now.
Wait, we're moving to GPT so that boot sector malware doesn't get cockblocked?
Boot from a write-protected floppy which is always in the drive. The boot sector of the floppy loads a tiny piece of code that checks the checksum on the parition table and MBR and alerts you that it changed. Problem solved. Until they stop producing floppy drives, that is.
Every end has half a stick.