What about rootkits?

[Lino]

If Microsoft releases an anti-spyware software it will
become so popular that spyware-writers will modify their
software to hide from it.

Will ever Antispyware detect rootkits?

What if a spyware hides itself from antispyware at
user/kernel level?

 

[alan]

| If Microsoft releases an anti-spyware software it will
| become so popular that spyware-writers will modify their
| software to hide from it.
|
| Will ever Antispyware detect rootkits?
|
| What if a spyware hides itself from antispyware at
| user/kernel level?

It looks as though Microsoft is planning to produce something to combat
rootkits, but whether this will be integrated into the AntiSpyware is
unknown.

http://www.geocities.com/pierceive/adblock/

Alan

 

[Lino]

It looks as though Microsoft is planning to produce
something to combat rootkits, but whether this will be
integrated into the AntiSpyware is unknown.

http://www.geocities.com/pierceive/adblock/

Alan

I know it (look at http://research.microsoft.com/rootkit/)
But a standalone rootkit detector (like strider ghostbuster
or rootkit revealer) is pretty unuseful.

If each PC has an AntiSpyware embedded all spywares will
SURELY be modified to use stealth tecniques making the
anti-spyware unuseful.

I'm just asking Microsoft if someone out there has even
thought this.

Today a rootkit-hiding spyware is RARE tomorrow it will
become the standard so.. Why don't they think in advance?

Lino.

 

[alan]

| >It looks as though Microsoft is planning to produce
| something to combat rootkits, but whether this will be
| integrated into the AntiSpyware is unknown.
| >
| >http://www.geocities.com/pierceive/adblock/
| >
| >Alan
|
| I know it (look at http://research.microsoft.com/rootkit/)
| But a standalone rootkit detector (like strider ghostbuster
| or rootkit revealer) is pretty unuseful.
|
| If each PC has an AntiSpyware embedded all spywares will
| SURELY be modified to use stealth tecniques making the
| anti-spyware unuseful.
|
| I'm just asking Microsoft if someone out there has even
| thought this.
|
| Today a rootkit-hiding spyware is RARE tomorrow it will
| become the standard so.. Why don't they think in advance?
|
| Lino.

I agree it would be useful to incorporate rootkit detection into
Antispyware. Apologies for attaching the wrong link - I must have taken my
eye off the ball for a second! Looks like you knew enough anyway.

Alan

 

[plun]

I know it (look at http://research.microsoft.com/rootkit/)
But a standalone rootkit detector (like strider ghostbuster
or rootkit revealer) is pretty unuseful.

If each PC has an AntiSpyware embedded all spywares will
SURELY be modified to use stealth tecniques making the
anti-spyware unuseful.

I'm just asking Microsoft if someone out there has even
thought this.

Today a rootkit-hiding spyware is RARE tomorrow it will
become the standard so.. Why don't they think in advance?

Well, I think they do beacuse this threat already exists.

F- Secure has already a scanner,
http://www.f-secure.com/blacklight/

Sysinternals also:
http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml

and this is for sure a threat.........

 

[Lino]

Well, I think they do beacuse this threat already exists.

F- Secure has already a scanner,
http://www.f-secure.com/blacklight/

Sysinternals also:
http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.s html

and this is for sure a threat.........

So..
If everyone do agree with me..
Should we pray god that Microsoft will never release MS-
Antispyware to the public? (mors tua, vita mea)
Or should we pray that if they do they will include
EFFECTIVE anti-rootkit tecniques (i.e. some sub-KERNEL
functions whose results can't be manipulated in ANY way)?

 

[Bill Sanderson]

Microsoft Antispyware already detects one bug which has rootkit
characteristics:

http://support.microsoft.com/default.aspx?scid=kb;en-us;894278

 

[Lino]

-----Original Message-----

Microsoft Antispyware already detects one bug which has rootkit
characteristics:

http://support.microsoft.com/default.aspx?scid=kb;en-

us;894278

LOL..
I was talking about a REAL rootkit.
There're a lot of people who are SELLING rootkits always
kept updated (for example take a look at
http://hxdef.czweb.org/)

Do you think that finding A BUG is enough to be protected?

Before MS-AntiSpyware everyone know internet was dangerous.
Such programs gives a FALSE sense of security.
Or they will do a software that acts like no other anti-
spyware or they should better abort with the project.

Suppose the mid user (maybe it knows what's a spyware
because a friend of his said sometimes that there's a
software used to spy some PC connected to internet).
He thinks: "I have Microsoft Anti Spyware..Microsoft says
I can stay sure. I do a scan twice a day.. let's buy
everything on the internet, no one can keylog my credit
card number.."

I REPEAT: This is higly dangerous.
Mass-distributing a program like this will ONLY make the
rootkits better. So it must be perfect or never
distributed.

 

[Bill Sanderson]

The expert who drew my attention to that particular article commented that
the reason the rootkit was found was that it GPF'd on customers machines.
If it had been perfect, it might not have been found.

Microsoft security staff are well aware of the cat and mouse game involved
in rootkit detection--Sysinternals has already modified the working of their
tool to counter a rootkit which had been designed to detect it. That
feedback loop will continue. Lets hope that the brains on the good side of
the issue can do better than those writing the malware.

The purpose of citing the article is to make it clear that Microsoft
Antispyware does target spyware which uses rootkit technology to hide.

There are a number of other rootkit finding tools becoming available--here's
a list of those I'm aware of:

Sysinternals RootKitRevealer:

http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml
(free, but care needed in interpreting results. Not useful on some servers
that I've tested where standard features result in very large numbers of
alternate data streams.)

F-Secure's Blacklight:
http://www.f-secure.com/blacklight/
Beta free through April 30th.
I haven't seen what a positive result looks like with this one--it works on
the servers where RootKitRevealer found hundreds of thousands of results.

And, finally, Klister:

(I've not used this one yet.)

Subject: [TOOL] Klister - Windows Kernel Level Rootkit Detector
Date: 4 Apr 2005 17:58:48 +0200
From: SecuriTeam <[email protected]>
To: (e-mail address removed)

The following security advisory is sent to the securiteam mailing list, and
can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Klister - Windows Kernel Level Rootkit Detector
------------------------------------------------------------------------
SUMMARY
DETAILS
Klister is a simple set of utilities for Windows 2000, designed to read
the internal kernel data structures, in order to get reliable information
about the system state (including list of all processes, including those
"hidden" by some rootkits).

Klister consists of a kernel module and some exemplary userland programs
that communicate with the kernel module in order to display some internal
kernel data structures. The most interesting ones are thread lists which
are used by kernel dispatcher (scheduler) code. When reading such internal
list we can be (almost) sure that we're getting list of all threads in
the system (including those which belong to hidden process) and it also
means that we can create complete list of ALL PROCESSESS in the system.

Download Information:
The tool can be downloaded from:
<http://www.rootkit.com/vault/joanna/klister-0.4.zip>
http://www.rootkit.com/vault/joanna/klister-0.4.zip


ADDITIONAL INFORMATION

To keep updated with the tool visit the project's homepage at:
<http://www.rootkit.com/project.php?id=14>
http://www.rootkit.com/project.php?id=14



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body
to: (e-mail address removed)
In order to subscribe to the mailing list, simply forward this email to:
(e-mail address removed)


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
---------------------------------

 

[Jacques]

There will always be a chalenge for both developers. Let future see for
future threats. MS is now giving us a tool which is convenient for present.
I just wait the release to ask all my friends to jump the step and install
it.
Think there are still users with no FW and updating there AV once a month.

 

[Steve Wechsler [MVP]]

Today a rootkit-hiding spyware is RARE tomorrow it will

become the standard so.. Why don't they think in advance?

Who says they aren't ? If you've ever played poker you already know that
you do not tip your hand. This program is designed to stop spyware. It
will stop malware with rootkit *behavior*.
Anything else that it removes is a bonus. Have done some testing with it
on Bube (Win32.Beavis) variants
http://www.broadbandreports.com/forum/remark,12688162~mode=flat
and can testify that it is successful in keeping Explorer.exe stable
enough so that the malware can be cleaned successfully without having to
resort to a reformat/reinstall.

** THAT ** is a bonus for an antispyware program.

Steve Wechsler (akaMowGreen)
MS-MVP 2004-2005
Windows Server - Software Distribution
Windows - Security

 

[Steve Dodson [MSFT]]

Yes, we are thinking about it a lot

--
-steve

Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

 

[Lino]

So..
Will Microsoft AntiSpyWare 1.0 final contain any rootkit
detection routines?

 

[Steve Dodson [MSFT]]

Guess we will have to wait until RTM to find out

--
-steve

Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

So..
Will Microsoft AntiSpyWare 1.0 final contain any rootkit
detection routines?

-----Original Message-----
Yes, we are thinking about it a lot

--
-steve

Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

 

[Steve Winograd [MVP]]

[snip]
Antispyware does target spyware which uses rootkit technology to hide.

There are a number of other rootkit finding tools becoming available--here's
a list of those I'm aware of:

Sysinternals RootKitRevealer:

http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml
(free, but care needed in interpreting results. Not useful on some servers
that I've tested where standard features result in very large numbers of
alternate data streams.)

F-Secure's Blacklight:
http://www.f-secure.com/blacklight/
Beta free through April 30th.
I haven't seen what a positive result looks like with this one--it works on
the servers where RootKitRevealer found hundreds of thousands of results.

Bill,

I cleaned up a client's computer recently where both of those rootkit
programs found suspicious files.

Using the Sysinternals tool, I couldn't find a way to remove the
files. Did I miss something, or does that tool only identify files?

The F-Secure tool had a "Rename" button that changed the name of each
rootkit file by appending ".ren" to it. After that, I booted to Safe
mode command prompt and deleted the renamed files.

 

[Steve Winograd [MVP]]

The purpose of citing the article is to make it clear that Microsoft
Antispyware does target spyware which uses rootkit technology to hide.

There are a number of other rootkit finding tools becoming available--here's
a list of those I'm aware of:

Sysinternals RootKitRevealer:

http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml
(free, but care needed in interpreting results. Not useful on some servers
that I've tested where standard features result in very large numbers of
alternate data streams.)

F-Secure's Blacklight:
http://www.f-secure.com/blacklight/
Beta free through April 30th.
I haven't seen what a positive result looks like with this one--it works on
the servers where RootKitRevealer found hundreds of thousands of results.
[remainder snipped]

Bill,

I'm sorry, but I hit "Send" too soon on my first message.

I cleaned up a client's computer recently where both of those rootkit
programs found the same suspicious files.

Using the Sysinternals tool, I couldn't find a way to remove the
files. Did I miss something, or does that tool only identify files?

The F-Secure tool had a "Rename" button that changed the name of each
rootkit file by appending ".ren" to it. After that, I booted to Safe
mode command prompt and deleted the renamed files. I don't know why
the tool didn't offer a "Delete" button.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[Bill Sanderson]

The sysinternals tool is quite simple--all that it does is identify files
that may be suspicious. Unfortunately, some standard mechanisms on Windows
2000 servers--Services for Macintosh, for example, create many thousands of
such files--I believe there were 300,000 results on one server I looked at.

I've heard second-hand that an antivirus product on workstations creates a
similar issue for this tool. I've found it useful on workstations, but not
on most servers, so far.

Unfortunately, my clientele is so limited and fastidious that I've yet to
see a "real" result with these tools.

My understanding with the sysinternals tool is that it simply identifies the
files--doesn't do more than that. I guess that begs the question--if you've
got an identified "bad" file which isn't visible to the Windows API, how do
you defang it! I haven't gotten that far.
--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

[snip]
Antispyware does target spyware which uses rootkit technology to hide.

There are a number of other rootkit finding tools becoming
available--here's
a list of those I'm aware of:

Sysinternals RootKitRevealer:

http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml
(free, but care needed in interpreting results. Not useful on some
servers
that I've tested where standard features result in very large numbers of
alternate data streams.)

F-Secure's Blacklight:
http://www.f-secure.com/blacklight/
Beta free through April 30th.
I haven't seen what a positive result looks like with this one--it works
on
the servers where RootKitRevealer found hundreds of thousands of results.

Bill,

I cleaned up a client's computer recently where both of those rootkit
programs found suspicious files.

Using the Sysinternals tool, I couldn't find a way to remove the
files. Did I miss something, or does that tool only identify files?

The F-Secure tool had a "Rename" button that changed the name of each
rootkit file by appending ".ren" to it. After that, I booted to Safe
mode command prompt and deleted the renamed files.

 

[Bill Sanderson]

Using the Sysinternals tool, I couldn't find a way to remove the
files. Did I miss something, or does that tool only identify files?

As far as I can see, it just identifies the files.

The F-Secure tool had a "Rename" button that changed the name of each
rootkit file by appending ".ren" to it. After that, I booted to Safe
mode command prompt and deleted the renamed files. I don't know why
the tool didn't offer a "Delete" button.

This is definitely a much slicker tool. Don't know how it will be packaged
after the free beta, though.