×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Six Rootkit Detectors To Protect Your PC

samzenpus posted more than 7 years ago | from the rate-them dept.

Security 108

An anonymous reader writes "InformationWeek has a review of 6 rootkit detectors.This issue became big last year when Sony released some music CDs which came with a rootkit that silently burrowed into PCs. This review looks at how you can block rootkits and protect your machine using F-Secure Backlight, IceSword, RKDetector, RootkitBuster, RootkitRevealer, and Rookit Unhooker."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

108 comments

Print version. (5, Informative)

antdude (79039) | more than 7 years ago | (#17658130)

Click here [informationweek.com] to going to next pages. :)

Re:Print version. (-1, Offtopic)

Anonymous Coward | more than 7 years ago | (#17658200)

I just dropped a deuce out of my caboose

Re:Print version. (-1, Offtopic)

Anonymous Coward | more than 7 years ago | (#17658270)

Click here [ragingfist.net] for the mirror.

I can see... (5, Funny)

42Penguins (861511) | more than 7 years ago | (#17658176)

"helpful" activex popup ads:
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!

Re:I can see... (4, Funny)

Jesus_666 (702802) | more than 7 years ago | (#17658954)

"helpful" activex popup ads:
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!


Damn. I've been googling for hours now - do you have an idea where I can get the Linux or OS X version of Pwn0r T0olbar or maybe the source? I want to be protekted from teh threts too!

Nice troll (-1, Flamebait)

Anonymous Coward | more than 7 years ago | (#17660728)

Ever wondered why they're called 'rootkits' rather than 'administratorkits'?

Re:I can see... (4, Funny)

rvw (755107) | more than 7 years ago | (#17661060)

"helpful" activex popup ads:
Yuor compooter may be infectad with eh rootkit! Instal Pwn0r T0olbar now 2 protekt your system from teh threts!


Damn. I've been googling for hours now - do you have an idea where I can get the Linux or OS X version of Pwn0r T0olbar or maybe the source? I want to be protekted from teh threts too!

To get this level of protection you should install Windows. These toolbars, you probably won't even have to install them. They come all by themselves.

Re:I can see... (1)

deviceb (958415) | more than 7 years ago | (#17661614)

Pwn0r T0olbar v2 is coming out soon -just wait for it

I cleaned a box recently.. with a tape measure the internewb's IE bars measured 5" vertical. I should have got a screen shot for the most Pwn3d browser award..

"The concept of the rootkit isn't a new one, (5, Funny)

Indes (323481) | more than 7 years ago | (#17658206)

... And dates back to the days of Unix. "

    Whew. Good thing GNU is Not Unix.

Re:"The concept of the rootkit isn't a new one, (2, Funny)

djh101010 (656795) | more than 7 years ago | (#17658264)

... And dates back to the days of Unix. "

Whew. Good thing GNU is Not Unix.


I'm not seeing what your point is, can you explain? Or am I trying to overanalyze a throw-away comment? I do that sometimes...

Re:"The concept of the rootkit isn't a new one, (3, Funny)

Evilest Doer (969227) | more than 7 years ago | (#17658748)

I'm not seeing what your point is, can you explain? Or am I trying to overanalyze a throw-away comment? I do that sometimes...
I think you missed the memo when you worked on The TTP Project.

Re:"The concept of the rootkit isn't a new one, (3, Funny)

Fred_A (10934) | more than 7 years ago | (#17661034)

Speaking of which, could we stick to rootkit for Unix and administratorkit for Windows ? It would be much less confusing.

Re:"The concept of the rootkit isn't a new one, (2, Funny)

Chacham (981) | more than 7 years ago | (#17663622)

>>And dates back to the days of Unix. "
>Whew. Good thing GNU is Not Unix.

Which is why "The concept of the rootkit isn't a GNU one"

Summarized: The free one is the best! (5, Informative)

tgbrittai (599035) | more than 7 years ago | (#17658276)

Ironically enough, it was one of the independent tools -- Rootkit Unhooker -- that turned out to be the best.

It's interesting that programmers working outside of a corporate environment produce such amazing products. Hmmm... I wonder what's up with that?

Re:Summarized: The free one is the best! (0)

Mistlefoot (636417) | more than 7 years ago | (#17658372)

You just trolling? If you read the article you would know that they were all free.

Re:Summarized: The free one is the best! (1, Funny)

Anonymous Coward | more than 7 years ago | (#17658424)

You just trolling? If you read the article you would know that they were all free.

Yeah, but this one is free as in vodka.

Nervous about these... (5, Insightful)

ubuwalker31 (1009137) | more than 7 years ago | (#17658542)

Is it just me, or am I being overly cautious not wanting to download a rootkit detector from Chinese and Russian software developers? Are these programs opensource? Are they safe? Anyone?

Re:Nervous about these... (2, Insightful)

gooman (709147) | more than 7 years ago | (#17660558)

I swear, that's the first thought that ran through my head.
I'm sure they'll detect every rootkit except the one they install.

Why am I so paranoid?

Oh yeah, I run Windows.

Re:Nervous about these... (1, Funny)

Anonymous Coward | more than 7 years ago | (#17660946)

Considering the piece of shit OS you're using from American developers, why not?

Besides, Russians are hardcore. They can do what they damn well like!

Re:Nervous about these... (2, Funny)

pipatron (966506) | more than 7 years ago | (#17661028)

It's not just you. It's a well known fact that all Chinese and Russian developers are evil communists that only release free code to promote their evil communist way of sharing! Remember what the RIAA told you [users.du.se].

Re:Nervous about these... (1)

Lord Ender (156273) | more than 7 years ago | (#17664722)

To add to this: Some of the most sophisticated spamming trojans come from the Russian mob. These spamming trojans include rootkit detectors so that they clean other hackers' crap off of a zombie freeing up more resources for the spam bot.

It stands to reason that some of the best trojan-cleaning products come from Russia--they are the ones writing the trojans!

Re:Summarized: The free one is the best! (-1, Offtopic)

Anonymous Coward | more than 7 years ago | (#17660714)

It's interesting that programmers working outside of a corporate environment produce such amazing products. Hmmm... I wonder what's up with that?

Don't forget what you can't see. There's a lot of programmers working outside corporate environments that does NOT produce amazing products. It is obvious to me that corporations often trade excellence for reliability and schedules since people's salaries must be paid. What would you rather have personally, the worlds best program in 2032 (and no income until then) or a working program 2007 (and getting paid every year until 2032). I'm opting for the stable income to support a family. If you go for more reward later, you're the type who will start their own company and write the next google. That's cool too.

Security solutions (4, Insightful)

chris(pinecone) (1037932) | more than 7 years ago | (#17658304)

Shouldn't these tools be a part of already-existent anti-virus solutions? Why another application for rootkits if trojans, virii, and spyware detection are (usually) in the same package? It's not like rootkits are new threats.

Re:Security solutions (1)

jomama717 (779243) | more than 7 years ago | (#17658664)

Norton AV 2007 boasts rootkit protection [symantec.com].

Re:Security solutions (2, Informative)

Anonymous Coward | more than 7 years ago | (#17658788)

When it's not being exploited [sans.org]

Re:Security solutions (3, Funny)

Macthorpe (960048) | more than 7 years ago | (#17660238)

Norton AV 2007 boasts rootkits

Fixed for you :P

(Yes I know it's not true, but you'd have to pay me severely large amounts of money to expose my system to anything by Symantec)

Re:Security solutions (1)

Gazzonyx (982402) | more than 7 years ago | (#17663236)

It also boasts an extra 3 minutes to boot up time, except on the larger corp. edition which seems to run more quickly with a smaller footprint.


I stopped using Symantec products when Peter Norton stopped coding them; that is to say, when I was 11 years old running windows 98.

Re:Security solutions (1)

jomama717 (779243) | more than 7 years ago | (#17663440)

Yeah - I've about had it with the startup hit (mine is more like +7 minutes - ugh), if it's not corrected soon I may bail. Wasn't meant as an ad, just pointing out that they have rootkit detection, which is one of the reasons I went with it in the first place.

What if Sony made a rootkit detector? (0)

UbuntuDupe (970646) | more than 7 years ago | (#17658342)

Before you laugh, that's basically what Microsoft's "Windows Defender" firewall would be like. "We'll remove the security vulnerabilities we gave you ... for a price!"

Re:What if Sony made a rootkit detector? (2, Funny)

Anonymous Coward | more than 7 years ago | (#17658974)

1. Windows Defender does exist.
2. Windows Defender is freeware.
3. Windows Defender is malware removalal tool, not a firewall.
4. You're tool late, I already laughed.

I am the author of AFX Windows Rootkit 2003 (5, Informative)

Afecks (899057) | more than 7 years ago | (#17658362)

Hey, thanks for the mention in the article but that is a really old version you've used to test! The last version I've released publicly is AFX Windows Rootkit 2005, it's open source and can be found on http://www.rootkit.com/ [rootkit.com] the other more recent versions I've sold privately.

Now on the subject of rootkit detection. Most of these use the method based on Microsoft's Strider: GhostBuster. Which uses a low-level method to gather seemingly clean system information then gathers the same information using a high-level method. The idea is that rootkits will have only hooked the high-level methods so there should be a difference in results. Whatever is listed in the low-level results and not listed in the high-level results is displayed as "hidden information". Effectively they are using the rootkit's own hiding functions against itself to detect it. If the rootkit doesn't hide itself to avoid detection it's still made itself visible.

The problem is that you put yourself in an arms race with who can hook system information at the lowest level. Luckily since we (the sysadmin) have access to the hardware and presumably the attacker does not, a hardware method of gathering system information would be the best. You can bet money that we are going to be seeing hardware level rootkit detectors sooner or later.

The final problem is that a backdoor can be hidden without using these rootkit methods. By hooking incoming socket connections we can make a hidden backdoor that creates no new processes, threads, files, registry keys or any other permanent data. I and others have released POC code already. Also, making the same attack persist after reboot is only a matter of disabling SFC and altering userinit.exe, explorer.exe or whatever you like. Your rootkit detector will come up clean everytime.

Re:I am the author of AFX Windows Rootkit 2003 (0, Redundant)

SUROK (815273) | more than 7 years ago | (#17658398)

wow, very informative +1! i must look into this, although if anyone knows any solaris rootkits or detectors pm me plz

Re:I am the author of AFX Windows Rootkit 2003 (1)

liquidpele (663430) | more than 7 years ago | (#17658854)

Do you have any more information on hooking socket connections as mentioned in your post? That sounds pretty neat and I'd like to research it, so since you've heard of it I figured you might have a good link to two.

Re:I am the author of AFX Windows Rootkit 2003 (3, Informative)

Afecks (899057) | more than 7 years ago | (#17659198)

My old site is down because I've moved away from this kind of stuff in the past. The only surviving mirror I can find is here. [opensc.ws] Basically you're just hooking accept() Winsock API in all processes and then any listening service is a potential backdoor. This is a simple user-mode method. Someone could write a more specific version for a particular service such as IIS that hooks deeper into the code that receives network data.

Re:I am the author of AFX Windows Rootkit 2003 (2, Insightful)

EvanED (569694) | more than 7 years ago | (#17659068)

Also, making the same attack persist after reboot is only a matter of disabling SFC and altering userinit.exe, explorer.exe or whatever you like. Your rootkit detector will come up clean everytime.

But if you don't hide files, you leave yourself as open to signature-based detection as viruses are, so your typical virus scan should pick it up. Even if you can obfuscate yourself well enough to hide from signature-based scans, if you alter system files like userinit or explorer, you are vulnerable to tripwire-like systems.

So if you want to protect against that but remain persistent, you're back to hiding files or file data, which means you have to address the low-level/high-level type scan that these tools do.

Re:I am the author of AFX Windows Rootkit 2003 (1)

Blahbooboo3 (874492) | more than 7 years ago | (#17659266)

Will a complete system format and OS re-install from CDs erase any possible re-entry?

Re:I am the author of AFX Windows Rootkit 2003 (4, Informative)

Afecks (899057) | more than 7 years ago | (#17659380)

The simple answer is, yes.

The complicated answer is, for a little while. The reason is that there are rootkits being developed that are designed to store itself in your video card. The idea is that after the hard drive is reformatted the video card will load this rootkit back into the kernel. Right now it's highly unlikely.

Re:I am the author of AFX Windows Rootkit 2003 (0)

Anonymous Coward | more than 7 years ago | (#17659734)

We've always wondered; help us out here:

Is your real goal to force common computer usage into hobbled, TCM-mandatory, freedom-deprived, police-state mechanics? Newsflash: what you're dicking around with today spells doom for open systems tomorrow. Because not-smart people make the laws you live by. That's not your fault, that's not their fault, that's simply the terminus of this arms race. Godspeed, enjoy the future.

--Everyone Else

Re:I am the author of AFX Windows Rootkit 2003 (0)

Anonymous Coward | more than 7 years ago | (#17660578)

If he was the actual rootkit author he would not disclose his identity here. Or maybe he is looking forward to a cuban vacation paid by uncle sam.

What I'd like... (1)

Cheesey (70139) | more than 7 years ago | (#17661856)

I'd like a rootkit detector that detects Windows rootkits, but runs from a live Linux distribution on a CDROM or a USB key. So I reboot a machine that I suspect is infected and do the rootkit scan without running any software from the hard disk. Seems to me that this would be a cheap way to do the "hardware level rootkit detection" of which you speak: provided that the Linux distribution was clean, a rootkit would not be able to hide itself on the disk.

Do you know of such a thing? Do you plan to port your Windows rootkit detector to Linux to enable this?

Re:What I'd like... (1)

mgblst (80109) | more than 7 years ago | (#17662010)

THe way most rootkit revealers work, they need windows to be running. What you are after is some sort of Virus checker, that looks through the files on a harddrive, for a particular signature. Rootkit revealers are better in some ways, because they don't need a signature database, which can be incomplete.

Re:What I'd like... (1)

Cheesey (70139) | more than 7 years ago | (#17662648)

Ah, they actually detect rootkits by detecting their attempts to hide? That is clever. Yes, I suppose that an offline scan could only really work using signatures, which is not a very good way to detect things.

Thanks for clearing that up.

Something is missing (1)

toupsie (88295) | more than 7 years ago | (#17658414)

I didn't see one rootkit detector reviewed by InformationWeek that would work on my PCs, a Macbook and an iMac. Any suggestions?

Re:Something is missing (1)

InsaneGeek (175763) | more than 7 years ago | (#17659218)

Probably because the article was talking about Windows rootkit detectors, might be a good reason that you didn't see ones for OSX (I could see through your thinly-veiled attempt at a windows vs mac dig, but I'll play along). For OSX you might try http://www.chkrootkit.org/ [chkrootkit.org] as there are OSX rootkits in the wild, they've had a version out for quite some time now.

how to secure your computer (-1, Troll)

Anonymous Coward | more than 7 years ago | (#17658538)

Step 1: go to www.ubuntu.com


Step 2: click on download


Step 3: ??


Step 4: burn iso with cd burnder of choice


Don't need to wory about rootkit anymore.

Re:how to secure your computer (2, Informative)

madsheep (984404) | more than 7 years ago | (#17658576)

LOL is this a serious post? Most rootkits out there are designed to work on *nix based operating systems. True rootkits are far more common on for these flavors of OS over that of Windows. I am not sure if this is a reference to Ubuntu being secure. Maybe you could have recommended visting a site that houses a BSD flavor..won't bother pointing out one for that useless debate. Choosing Ubuntu is not going to protect you from rootkits in anyway.

Re:how to secure your computer (0)

Anonymous Coward | more than 7 years ago | (#17658670)

Fanboy

Wow.... (3, Insightful)

Creepy Crawler (680178) | more than 7 years ago | (#17658582)

Wow! Lets rate programs on diagnosing a potentially lying PC!

This is just a stupid idea if anything. The purpose of a rootkit is to make a very hidden hole into a system. Doing this requires reprogramming and setting up the system in that nobody can diagnose itself. The key is to diagnose any sort of rootkit, one must run from known good binaries.

Now, we dont have the source to Windows, but we have binaries. Well, lets MD5 the binaries and then compare to a known good (just installed, no network interfaces) installation. The differences are possible holes.

No program can be trusted when the system it sits upon cannot be trusted. When system trust is gone, one must redeploy the system to regain trust.

Re:Wow.... (2, Informative)

jomama717 (779243) | more than 7 years ago | (#17658874)

If a native app [microsoft.com] can analyze the disk volume directly it can identify malicious drivers and reveal them to a friendly Win32 application that can remove them after a reboot. This works for user mode and kernel mode rootkits, but if there's a BIOS rootkit you're pretty much screwed. See my previous post [slashdot.org], Norton AntiVirus 2007 operates in this way.

Re:Wow.... (3, Informative)

EvanED (569694) | more than 7 years ago | (#17658982)

If a native app can analyze the disk volume directly it can identify malicious drivers and reveal them to a friendly Win32 application that can remove them after a reboot...

There's no fundamental reason why they couldn't intercept the I/O requests from your native app and return false but consistent data there.

It's just very difficult to do, which is why rootkits try to skirt detection based on the Strider: Ghostbuster method (do a low-level scan of the on-disk filesystem data structures, compare to the results from the FindNextFile API; do a low-level parse of the registry hives, compare to the registry APIs; etc.) by UNHIDING the hidden/changed data from the rootkit detector rather than hiding from the low-level scans.

If you're running on an infected system, you can't be guaranteed to find anything.

Re:Wow.... (3, Insightful)

Creepy Crawler (680178) | more than 7 years ago | (#17659048)

---If a native app can analyze the disk volume directly it can identify malicious drivers and reveal them to a friendly Win32 application that can remove them after a reboot.

Oh bother... If I had a Kernel Level rootkit, I can SHIM all your commands through it and filter what I want you to see. You can guarantee that I will hide my program ID, memory used, swap used, location on fixed disks, and any network data transmitted/received. As far as you know, the system will be "ok". But it'll be OK, because you can analyze the volume directly!!

---This works for user mode and kernel mode rootkits, but if there's a BIOS rootkit you're pretty much screwed.

Sure. If you have to run a "checking program" on a corrupted system, what makes you think you'll get good results? I keep drilling this point, but all you do is give dumb comments. And bios rootkit? Good luck with that one. You all might wannna give LinuxBios some help if you can flash WORKING hacked firmwares to the multitudes of X86 boxes. Oh... you mean diddle with the ACPI tables. Welllll.. Bah.

---See my previous post, Norton AntiVirus 2007 operates in this way.

I ignore ads.

Re:Wow.... (2, Insightful)

EvanED (569694) | more than 7 years ago | (#17659132)

Oh bother... If I had a Kernel Level rootkit, I can SHIM all your commands through it and filter what I want you to see. You can guarantee that I will hide my program ID, memory used, swap used, location on fixed disks, and any network data transmitted/received

If that's ALL you hide, then you'll be found by all of these tools.

You ALSO have to mess with low-level I/O requests; if an application can say "I want block #17" you need to be able to mutate the returned data if it's a directory block or something like that. On Windows if you have detectable information in the registry, you also need to intercept all requests to the registry hives (either by file name or block number) and mutate the information in them to hide your data.

If you can analyze the volume directly (and be sure of the integrity), you CAN'T hide data on it.

If you have to run a "checking program" on a corrupted system, what makes you think you'll get good results? I keep drilling this point, but all you do is give dumb comments.

I don't think there's a rootkit now that has the sophistication to hide from all the above avenues of detection.

There's no reason why they MUST work, but for now they do a decent job.

Re:Wow.... (1)

Creepy Crawler (680178) | more than 7 years ago | (#17659494)

...Oh bother... If I had a Kernel Level rootkit, I can SHIM all your commands through it and filter what I want you to see. You can guarantee that I will hide my program ID, memory used, swap used, location on fixed disks, and any network data transmitted/received

---If that's ALL you hide, then you'll be found by all of these tools.

Wrong. If I control the CPU as kernel level, I can do anything I want. Next of all, if I use custom tools, good luck trying to find them. Well, the only way to find them would to be proactive on system security and map all files via MD5 on install and upgrade, so that you would have maps of all edited files. Any changes = caught. Of course, the computer would have to be brought down and a BootCD be started up. The OS is too untrustworthy after you hook it on a network (in Windows case especially).

---You ALSO have to mess with low-level I/O requests;

What does Kernel Level mean to you? Or rather, does Microsoft allow you to do extensive reprogramming? I know of extensive Linux kernel, GLibc, and usermode program backdooring. You hit one, and theres still all the others. Essentially, if you have no reference system to verify good data/files, you're screwed.

---if an application can say "I want block #17" you need to be able to mutate the returned data if it's a directory block or something like that. On Windows if you have detectable information in the registry, you also need to intercept all requests to the registry hives (either by file name or block number) and mutate the information in them to hide your data.

Assuming you'd actually store data in the registry if you're using a backdoor. That just strikes me as friggin stupid. I'd store my data across the whole system in stupid stuff like user settings, whitespace on text and html files, files near commonly executed programs, and other various random places. And the backdoor would be hidden in plain sight, but in no recognizable form. It should take no more than 50 KB to start a backdoor, and the rest loaded from a distributed amount of places that the backdoor would have access to... local machines and the internet.

Re:Wow.... (3, Insightful)

EvanED (569694) | more than 7 years ago | (#17659680)

Wrong. If I control the CPU as kernel level, I can do anything I want.

That's true.

The OS is too untrustworthy after you hook it on a network (in Windows case especially).

Windows is no more vulnerable once you've got a kernel hook than Unix/Linux/whatever is. If anything, Linux is more vulnerable because figuring out the appropriate places to hook in Windows is a lot harder without source.

("Security through obscurity" is a bad idea -- but obscurity can be a layer and be helpful as long as you design and implement the rest of the system as if the obscurity wasn't there.)

(The increased vulnerability of Windows comes from the fact that it's easier to inject your code. The above only applies once you have a suitable kernel of your code running in ring 0.)

What does Kernel Level mean to you?

It means you're running in ring 0, privileged mode, CPL 0, whatever you want to call it. It means you can *theoretically* do anything.

I'm just saying that I don't think there are any non-VM rootkits that hide themselves so thoroughly that they can't be detected, because doing so is a difficult problem because there's way more that you have to trap if you want to be completely hidden than it initially seems. Like ALL I/O requests.

Or rather, does Microsoft allow you to do extensive reprogramming? I know of extensive Linux kernel, GLibc, and usermode program backdooring. You hit one, and theres still all the others. Essentially, if you have no reference system to verify good data/files, you're screwed.

Again, in theory, yes. In practice, now, there's still a lot you can do.

Assuming you'd actually store data in the registry if you're using a backdoor. That just strikes me as friggin stupid.

It really isn't; it's a perfectly legit method of ensuring that your rootkit is loaded if you can deal with the low-level/high-level scan thing or don't care if it's detectable with that method.

I'd store my data across the whole system in stupid stuff like user settings, whitespace on text and html files, files near commonly executed programs, and other various random places. And the backdoor would be hidden in plain sight, but in no recognizable form. It should take no more than 50 KB to start a backdoor, and the rest loaded from a distributed amount of places that the backdoor would have access to... local machines and the internet.

That's fine.

Remember, my point is that if you have detectable information on the disk (e.g. something you could find with a signature-based scan), you MUST be able to vet all I/O requests to the disk. That means requests through the file APIs, requests for specific blocks sent to devices, and I/O requests that might be issued from other drivers. (For instance, you have to be prepared for detection software to load its own device driver and issue I/O requests itself.) Of course, if you can intercept all I/O instructions then the first two come free. Your rootkit must then be able to mutate the data that's returned so that it hides its presence but is still sane. This very well may mean that you have to understand NTFS and FAT, though it's possible that you could get all needed information from existing kernel data structures.

I don't think such a rootkit is known to exist right now, and I don't think we'll see one. It's now easier to drop the OS into a virtual machine and have a VM-based rootkit. (Though I'm somewhat skeptical about a sudden loss of speed tipping people off, it should be possible in theory to make this undetectable to software running in the guest OS.)

Re:Wow.... (1)

rastos1 (601318) | more than 7 years ago | (#17660122)

This is just a stupid idea if anything. The purpose of a rootkit is to make a very hidden hole into a system. Doing this requires reprogramming and setting up the system in that nobody can diagnose itself.
The idea is that the rootkit is not perfect. If the diagnostic tool says: "found", you know there is a problem. If it says "not found" you don't know anything. Just like you did not knew before running the tool.

Re:Wow.... (1)

repvik (96666) | more than 7 years ago | (#17661042)

So? My rootkit detects attempts to md5sum my binaries, and makes sure the program returns the expected md5sum ;-)

Easier solution... (5, Funny)

Stormwatch (703920) | more than 7 years ago | (#17658584)

Do NOT buy music from stores. Instead, get them from torrents. It's safer!

Re:Easier solution... (0)

Anonymous Coward | more than 7 years ago | (#17660574)

The mods were indecisive. This is funny AND essentially true.

Rootkit (-1, Troll)

Anonymous Coward | more than 7 years ago | (#17658750)

This is one of the reasons why I paid the so-called "Apple Tax." I was a lifelong Microsoft user from the DOS days. It's great not having to waste time thinking about this shit.

Re:Rootkit (4, Insightful)

chris(pinecone) (1037932) | more than 7 years ago | (#17658782)

Most rootkits target *nix. OS X is a Unix variant. But since Macs don't ever get viruses, I'm sure it would be impossible to get past Apple's expert, fully-secure software.

Re:Rootkit (2, Interesting)

John Jamieson (890438) | more than 7 years ago | (#17659518)

A/Coward - What, you somehow think that you are immune to Rootkits???

I would not bet my life on that. Even though I consider the default security in my choice of GNU/Linux distro to be tighter than OS-X, I still use Knoppix (a CD based GNU/LINUX OS) for internet banking. It is the only TRUE assurance of safety from being rooted.

Re:Rootkit (1)

tetrode (32267) | more than 7 years ago | (#17660214)

Are you sure? This: http://it.slashdot.org/comments.pl?sid=217446&cid= 17659380 [slashdot.org] indicates that the method of rebooting with a CD will not be sure in the near future.

1. Boot with a Knoppix CD to do banking
2. Virus hides in Video
3. You reboot, virus installs itself and PROFIT!

Mark

Re:Rootkit (0)

Anonymous Coward | more than 7 years ago | (#17662412)

are you sure you can really trust linux distros
that come as all binaries on a CD?

can you trust the GCC binary you received 7 years ago?

the solution is to stop banking and go live in a cave.

Re:Rootkit (1)

John Jamieson (890438) | more than 7 years ago | (#17664220)

Yes, I am aware of that post.

I imagine it is theoretically possible... but to my understanding highly improbable.
The Bios would have to be reverse engineered, modified and reburned to add the code to execute the rootkit(even if it resided elsewhere). Since it seems that every motherboard has a different Bios image... this would be a lot of work.

Re:Rootkit (0)

Anonymous Coward | more than 7 years ago | (#17666666)

Hows the fit on that tin cap? Tight?

Got it (1)

kahrytan (913147) | more than 7 years ago | (#17658754)


  Those who don't know, BitDefender Antivirus has rootkit detection and removal since v10. It was released back in Aug-Sept 2006.

Blue Pill (3, Interesting)

Asztal_ (914605) | more than 7 years ago | (#17658868)

Can any of them detect blue pill [blogspot.com]?

Re:Blue Pill (2, Informative)

Cheesey (70139) | more than 7 years ago | (#17661938)

Apparently one of them attempts to. From TFA:

The single most intriguing feature is the "Virtual Machine Detector," which uses the time elapsed between two low-level CPU instructions to determine if the operating system is running directly on the PC or in a virtual machine.


There are actually a few other ways to detect if you are running inside a VM, e.g. use of a non-priviledged instruction that reveals information about memory mappings (here [codeproject.com]). However, there is still an arms race: the rootkit programmer might attempt to detect these tricks and defeat them.

Re:Blue Pill (1)

EvanED (569694) | more than 7 years ago | (#17666938)

There are actually a few other ways to detect if you are running inside a VM, e.g. use of a non-priviledged instruction that reveals information about memory mappings (here).

That only would detect VMWare-style virtualization; to the best of my knowledge, the hardware virtualization that's now in chips (VT and whatever AMD calls theirs) should eliminate this possibility and force you to go with timing tests.

Where can I download... (1, Funny)

mh101 (620659) | more than 7 years ago | (#17659196)

...the Mac version of these tools?

Oh, wait...

change mod from (2, Insightful)

John Jamieson (890438) | more than 7 years ago | (#17659628)

The review was for tools for the Windows PC, not the MAC or Linux. Sorry this was not more evident. The parent is (without knowlege) implying that the Mac is not vunerable to being rooted. And some fanbois are modding this funny? This might be funny, IF IT WERE TRUE! Not only are MAC rootkits possible, they exist. Do a google search before you post and it will prevent mistakes like this. (Yes I know, I run a risk of hardcore fans modding me down)

Correction, and possible next step in arms race (1)

Beryllium Sphere(tm) (193358) | more than 7 years ago | (#17659618)

The F-Secure product is Blacklight.

Wish I could remember the name to give the guy credit, but someone's pointed out that even booting from a CD doesn't necessarily give you a trustworthy system if there's malware flashed onto a graphics card that the BIOS detects and configures before the CD takes over.

Re:Correction, and possible next step in arms race (1, Informative)

Anonymous Coward | more than 7 years ago | (#17660644)

Of course modern OSes do not use the BIOS any more... plus Windows has HAL (hardware Abstraction Layer) and Ctrl+Alt+Del login to protect against this.

Re:Correction, and possible next step in arms race (1)

Dog-Cow (21281) | more than 7 years ago | (#17664410)

That's not true. Even Linux still uses the BIOS. And that's besides the point. The BIOS runs when the computer boots, so any embedded code has a chance to setup the system to suit itself.

Oh, we say to thee (1)

snarkth (1002832) | more than 7 years ago | (#17659624)

That when the rootkit, undid me

  The warning box, I did not see

  OK I clicked on, I spent freely

  then My Ruin passed on, gleefully.

  --A user's lament

  snarkth

Root of the problem with Windows (3, Interesting)

shanen (462549) | more than 7 years ago | (#17659894)

It's really a philosophic problem. Microsoft sees the OS as a weapon against the competitors, and when you're building weapons, of course you make them as powerful as possible and of course safety gets a lower priority. (Microsoft's highest priority has always been on the money, however.) The problem is that the results are overpowered OSes that real experts can use in ways that completely overwhelm us normal mortals. Heaven help the little old lady who just wants to visit her church's website on Sundays.

As regards the article, I read most of it, and might finish it later, but I wasn't too impressed with it or with the rootkit-detection tools that I've experimented with in the past. I'm supposed to be something of a computer expert, and I've certainly been using them long enough, but I regard myself as pretty much a helpless infant in these areas. If the NSA is planning to root my computer because I regard Dubya as an asinine embarrassment to my nation, I don't seriously expect to be able to do anything about it. Sure, I can use an expert's tools in many cases, but that doesn't make me any match for a real expert with corresponding tools. Or returning to the weapon metaphor, I may have a great gun, and even be competent enough in using it, but I'm sure that a seriously experienced killer would have little trouble taking me out, even with an inferior weapon.

In conclusion, "It's a poor craftsman who blames his tools", but it's also a poor craftsman who can't tell the difference...

Re:Root of the problem with Windows (1)

justthinkit (954982) | more than 7 years ago | (#17664250)

Microsoft sees the OS as a weapon against the competitors, and when you're building weapons, of course you make them as powerful as possible and of course safety gets a lower priority.

And like any good weapons vender, you self-limit your product (so wayward purchasers lose the ability to maintain it without your help), backdoor it (so you can cripple it if purchasers have the audacity to try to improve it themselves so they can cut your support/upgrade strings) and only release it when you yourself have something better (i.e. I doubt that the software Microsoft runs on its own servers is exactly the same as what they sell to us sheeple).

What about Linux? (1)

Stephen Samuel (106962) | more than 7 years ago | (#17660044)

- and I don't just mean converting the poor user to Linux either -- I mean things like Knoppix [knopper.net] with clamav [slashdot.org] which allow you to search for signs of rootkits without having the rootkit, itself, get in your way.

Once you've pulled out those pieces, then you can hopefully boot (what's left of) Windows, run some of the Windows-centric anti-virus ware in hopes of finding those pieces that clamav didn't find.

Spelling blunder from down under. (1)

SkaOMatic (771887) | more than 7 years ago | (#17660894)

"...and Rookit Unhooker."

I for one welco- eh. To hell with it.

Kangaroos are more than welcome to obtain low-level access to my OS. I've got mad respect for their built-in pockets.

Genetics wasn't as friendly to me. I had to BUY my Scott-E-Vest.

There's an excellent podcast... (1)

tcopeland (32225) | more than 7 years ago | (#17661148)

...on this sort of thing, Security Now [grc.com]. They had a good explanation last year of all the things the Sony "rootkit" did, like hiding files with the prefix "$sys$". The podcasts are pretty short (20 mins), definitely worth a listen to ease your morning commute.

Also, getindi [getindi.com]!

an alternative approach (1)

butterberg (1046750) | more than 7 years ago | (#17661438)

A few weeks ago, I played around with some of those rootkit detectors. Cool things, if you want to learn about some OS internals. But: When the primary use of a rootkit detector is to uncover malware so that a virus killer can see it, why not just do an /external/ virus check from a boot CD? So, that is what I am doing now!

Hunting down the bad guys like Dirty Harry. (3, Insightful)

toadlife (301863) | more than 7 years ago | (#17661444)

I find it curious and a bit disconcerting when I see how much emphasis people place on the subject of malware detection in the realm of information security. What to do after malicious code finds it's way onto our systems, or into our networks is certainly something to consider, and any security plan would be incomplete without it, but this area takes up far too much of our time, given that other aspects of security bring a much more favorable cost/benefit ratio.

I can only surmise that there is certain "sexiness" to malware detection; much the same way that fancy home alarm systems are the first thing that many think of when contemplating home security.

In the home security market, advertisements depict evil prowlers dressed in sweat-suits busting through the back door of the house, while a frightened soccer mom with her five year old daughter cower upstairs. The alarm sounds, the prowler runs away, and a call comes in from the alarm provider, asking if they are ok. Quite dramatic. Quite unrealistic too.

In the information security market there are no soccer moms, and the prowlers don't run around in matching sweat-suits, but the theme is similar. "Buy our product - it will catch intruders when they enter and save you." Again - quite dramatic, and quite unrealistic.

In the real world, people forget to turn on their alarm systems, or they forget to change the batteries, or intruders know how to disable them without triggering them.

In the real world, people also forget to update their AV/IDS signatures, or turn their security product off for various reasons - usually convenience-related, or like the prowler in the home, malware simply disables the security solution on it's way in.

Just as in securing a home, we would be better off if we first focused on installing heavy doors and deadbolts on all outside entrances, in the virtual world, we would be better off focusing on the barriers that malware must overcome to gain entry to our systems and access to our information and resources.

This is far from an original thought, but I'll say it anyway as it deserved to be repeated. The security industry is a joke. It's is filled by people who either don't understand the basic pricipals of information security, or do but choose to to sell 'sexy' solutions anyway. I once ran into the author of a somewhat popular Windows security product on a messageboard and was shocked at his aparent lack of understanding of how his platform of choice, Windows, worked.

I supposed this is more of a Windows problem than anything else. Not a problem with Windows, the operating system, but a problem with WIndows, the culture.

on rootkit detection, MD5 etc. (2, Informative)

Anonymous Coward | more than 7 years ago | (#17662164)

Someone said we could MD5 Windows binaries... Of course we can, though MD5 is so broken in this 21st century that you'd better use SHA-1 ;)

Another dude said "but my rootkit detect attempt to MD5 and returns the correst sum". Kind of, it s even better than that for the best of the breed: they recognize themselves in *any* attempt to read the file and replace their code (that they recognized) with the code that the file is supposed to contain at that place. What I mean is: you don't specifically decide to defeat a cryptographic checksum or an anti-virus or or or... But you fake the infos coming from every single attempt to read the file.

Of course the real "game over for rootkits" comes when you unplug the drive, plug it to a known good system (for example, say, an OpenBSD system that has *never* been hooked to the Internet) and then compare every file with their previous version. Altered userinit.exe? Game over rootkit. Altered winlogon? Game over rootkit. It works the same for Unix systems (for which, btw, there exist many more rootkits, though not as successfull in spreading). Which is why projects like honeynet are so succesfull at catching malware "in the wild". And with projects such as Honeynet being so successful, rootkit writers sometimes decide to write rootkit that don't install to the disk and that don't install if they detect they're running on an emulated/virtualized system. Which means the rootkit will only live for as long as the computer is turned on. And then it will need to re-infect the machine using the same exploit if the machine reboots. Which is also a pain in the arse for rootkit writers: the vulnerability may very well have been patched meanwhile (think auto-update) or exploited by someone else, etc.

Note that you can always detect suspicious trafic using a passive sniffer too (think shomiti tap or one-way ethernet cable... or "software" passive sniffer).

There's no such thing as an "undetectable rootkit". No matter if it tries to hide in the BIOS (Sun machine have been having protection again BIOS write since ever btw), which is incredibly hard (the BIOS code being so small), no matter if it tries to hide in some GFX card's chipset (wtf? someone wrote there s work on that... I can only see it happen on broken-by-design GFX card and it is certainly not common practice), no matter if it tries to install as an hypervisor on VT-enabled systems...

There's always gonna be a way to detect a rootkit, wether you're on Windows or Unix systems, wether you and rootkit authors like it or not. I'm not arguing, I'm not discussing: I'm stating facts.

Avoid Rootkits (Almost) Altogether (1)

Athanasius (306480) | more than 7 years ago | (#17662324)

Make your normal user a Limited one, not an Administrator. Try the initial install of any software as that user. Certainly playing a CD isn't going to be able to install anything rootkit-like as a Limited user. Oh, and disable Autoplay on all removeable media devices.

Yes, some programs still require Administrator access to install, although in some cases you just need to give the Limited account access to write in the global Startup menu folder or something similar, so this isn't a 100% cure-all.

You can't find rootkits inside an infected system (1)

Opportunist (166417) | more than 7 years ago | (#17663094)

Running a rootkit detection kit on a system containing a (good) rootkit is fruitless. There are now rootkits that can detect rootkit detectors and (since most rootkit revealers rely on the discrepancy between system API calls and "direct" access to the HD) simply "demask" while they're running, so the rootkit cannot be found.

The only way to find a well written rootkit is to boot from a certainly uninfected bootdisk (or CD/DVD) and scan with it. Everything else is at best working against less sophisticated kits.

Great! Better testing for Rootkits! (1)

dashersey (751215) | more than 7 years ago | (#17664114)

Now anyone who wants to write a rootkit has a much better set of test suites to test its non-detectability! I'm glad we're investing in the education and skill of malware writers...we may need those rich crack programmers for something someday.

AVG Anti-rootkit (0)

Anonymous Coward | more than 7 years ago | (#17667060)

AVG also has an anti-rootkit available, works just as good as any of the others in the article (all of which I've used).
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...