WHAT IS ROOTKIT?

A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed and often masks its existence or the existence of other software. The term rootkit is a compound of “root” and the word “kit”

What Is a Rootkit?

A rootkit is a clandestine computer program designed to provide continued privileged access to a computer while actively hiding its presence. The term rootkit is a connection of the two words “root” and “kit.” Originally, a rootkit was a collection of tools that enabled administrator-level access to a computer or network. Root refers to the Admin account on Unix and Linux systems, and kit refers to the software components that implement the tool. Today rootkits are generally associated with malware – such as Trojans, worms viruses – that conceal their existence and actions from users and other system processes.

What Can a Rootkit Do?

A rootkit allows someone to maintain command and control over a computer without the computer user/owner knowing about it. Once a rootkit has been installed, the controller of the rootkit has the ability to remotely execute files and change system configurations on the host machine. A rootkit on an infected computer can also access log files and spy on the legitimate computer owner’s usage.

ROOTKIT EXAMPLES

• Lane Davis and Steven Dake – wrote the earliest known rootkit in the early 1990s.
• NTRootkit – one of the first malicious rootkits targeted at Windows OS.
• HackerDefender – this early Trojan altered/augmented the OS at a very low level of functions calls.
• Machiavelli – the first rootkit targeting Mac OS X appeared in 2009. This rootkit creates hidden system calls and kernel threads.
• Greek wiretapping – in 2004/05, intruders installed a rootkit that targeted Ericsson’s AXE PBX.
• Zeus, first identified in July 2007, is a Trojan horse that steals banking information by man-in-the-browser keystroke logging and form grabbing.
• Stuxnet – the first known rootkit for industrial control systems
• Flame – a computer malware discovered in 2012 that attacks computers running Windows OS. It can record audio, screenshots, keyboard activity and network traffic.

Symptoms of rootkit infection

One of the primary objectives of a rootkit is to avoid detection in order to remain installed and accessible on the victim system, so rootkit developers aim to keep their malware undetectable, which means there may not be many detectable symptoms that flag a rootkit infection.

One common symptom of a rootkit infection is that antimalware protection stops working. An antimalware application that just stops running indicates that there is an active rootkit infection.

Another symptom of a rootkit infection can be observed when Windows settings change independently, without any apparent action by the user. Other unusual behavior, such as background images changing or disappearing in the lock screen or pinned items changing on the taskbar, could also indicate a rootkit infection.

Finally, unusually slow performance or high CPU usage and browser redirects may also indicate the presence of a rootkit infection.

How the Attacker Installs Rootkits?

The threat actor tries to obtain root/administrator access by exploiting known vulnerabilities, or by stealing administrator privilege credentials. Cyber criminals employ social engineering techniques to obtain credentials. Root access allows installation of rootkits or any other malware. Installation of the rootkit enables the threat actor to access the computer from remote to install other malware, steal data, observe activities and even control the computer. Rootkits are sophisticated malware, and most antivirus solutions and antimalware solutions do not detect rootkits. Rootkits are also able to hide their intrusion, and hence once they are in, they are practically undetectable.

Since rootkits have complete control over the system, they can modify software and the cyber security solutions such as the antivirus that could detect rootkits. As even the detection solutions are modified, it is difficult to detect and remove rootkits.

How to Detect Rootkits?

A behavioral-based approach proves to be effective in detecting rootkits. Cyber security solutions such as the Comodo Advanced Endpoin protechtion (AEP) utilize their Host Intrusion Prevention Systems to effectively detect and remove rootkits in computer systems.

Why are rootkits dangerous?

Cybercriminals use rootkits to hide and protect malware on a computer. The rootkit itself isn’t necessarily harmful; what’s dangerous is the various forms of malware inside them. Malware in a rootkit can steal data and take over a system for malicious purposes, all while remaining undetected.

How to prevent a rootkit attack

Rootkit attacks are dangerous and harmful, but they only infect your computer if you somehow launched the malicious software that carries the rootkit. The tips below outline the basic steps you should follow to prevent rootkit infection.

Scan your systems

Scanners are software programs aimed to analyze a system to get rid of active rootkits.

Rootkit scanners are usually effective in detecting and removing application rootkits. However, they are ineffective against kernel, bootloader, or firmware attacks. Kernel level scanners can only detect malicious code when the rootkit is inactive. This means that you have to stop all system processes and boot the computer in safe mode in order to effectively scan the system.

Security experts claim that a single scanner cannot guarantee the complete security of a system, due to these limitations. Therefore, many advise using multiple scanners and rootkit removers To fully protect yourself against rootkits attacks at the boot or firmware level, you need to backup your data, then reinstall the entire system.

Avoid phishing attempts

Phishing is a type of social engineering attack in which hackers use email to deceive users into clicking on a malicious link or downloading an infected attachment.

The fraudulent email can be anything, from scammers asking to reclaim gold to fake messages from Facebook requesting that you update your login credentials. The infected attachments can be Excel or Word documents, a regular executable program, or an infected image.

Update your software

Many software programs contain vulnerabilities and bugs that allow cybercriminals to exploit them—especially older, legacy software. Usually, companies release regular updates to fix these bugs and vulnerabilities. But not all vulnerabilities are made public. And once software has reached a certain age, companies stop supporting them with updates.

Ongoing software updates are essential for staying safe and preventing hackers from infecting you with malware. Keep all programs and your operating system up-to-date, and you can avoid rootkit attacks that take advantage of vulnerabilities.

Use next-gen antivirus

Malware authors always try to stay one step ahead of the cybersecurity industry. To counter their progress, you should use antivirus prorammes that leverage modern security techniques, like machine learning-based anomaly detection and behavioral heuristics. This type of antivirus can determine the origin of the rootkit based on its behavior, detect the malware, and block it from infecting your system.

Monitor network traffic

Network traffic monitoring techniques analyze network packets in order to identify potentially malicious network traffic. Network analytics can also mitigate threats more quickly while isolating the network segments that are under attack to prevent the attack from spreading.

Rootkit prevention beats clean-up

A rootkit is one of the most difficult types of malware to find and remove. Attackers frequently use them to remotely control your computer, eavesdrop on your network communication, or execute botnet attacks

This is a nasty type of malware that can seriously affect your computer’s performance and lead to personal data theft. Since it’s difficult to detect a rootkit attack, prevention is often the best defense. Use the tips offered in this article as a starting point for your defense strategy. To ensure continual protection, continue learning. Attacks always change, and it’s important to keep up.

HOW TO DELETE ROOTKIT FROM A COMPUTER

A typical rootkit consists of the following utilities:

• Backdoor Programs – login backdoors, telnetd etc
• Packet Sniffers – Sniff network traffic such as FTP, TELNET,POP3
• Log-Wiping Utilities – Bash the logs to cover tracks
• DDoS Programs – Turn the box into a DDoS client (Remember trinoo?)
• IRC\Bots – Bots used to take over IRC channels (Lame and annoying)
• Miscellaneous programs – May contain exploit, log editor
• Persistent Rootkits

A persistent rootkit activates each time the system boots. Normally these types of Rootkits are stored in the system registry.

• Memory-Based or non-Persistent Rootkits

Memory-based rootkits will not automatically run after a reboot; they are stored in memory and lost when the computer reboots.

• User-mode Rootkits

User-mode rootkits operate at the application layer and filter calls going from the system API (Application programming interface) to the kernel. These rootkits normally change the system binary files to malicious code that redirects control of the computer to the creator of the rootkit.

• Kernel-mode Rootkits

Kernel-mode rootkits hook to the system’s kernel API’s and modify data structure within the kernel itself. These are the most effective and dangerous types of rootkits. Kernal-mode rootkits are very difficult to detect and can hide on a system without any indication of being active.

• Bootkits

Bootkits are variations of kernel-mode rootkits that infect the Master Boot Record (MBR). The malicious code can be executed before the computer actually boots.

• FirmWare

A firmware rootkit infects a device or piece of hardware where code resides, such as a network card or the system BIOS.
Mebromi firmware rootkit http://blog.webroot.com/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/

• Hypervisor

These are newer types of rootkits that are infecting the hypervisor layer of a virtual machine setup. The hypervisor is basically the layer between physical hardware (host systems) and the virtual system (guest), although a type II hypervisor can be installed on top of an OS in order to present a virtual layer to the virtual system. These rootkits can intercept hardware “calls” going to the original operating systems.

How to remove the Rootkit

This is where it gets fun! There are different approaches and really no single full-proof method, neither is it guaranteed that the rootkit will be fully removed. As a matter of fact, there are some computer security experts who simply recommend formatting the drive and completely re-installing the operating system.

The Manual Method

This may or may not be more time consuming than trying to search using an automatic tool. If you are familiar with legitimate Windows services and programs and can pick out suspicious files, then this could be the way to go. Many times, rootkit scanners will not detect rootkit infections, especially if they are new, so this may be the way to go if you don’t want to go straight to the nuke-and-pave solution.

Tools:

• Autoruns
• Process explorer
• msconfig

Here is a process for locating a rootkit via msconfig:

1. Open msconfig and enable bootlog.

2. Restart the Computer

3. Open C:WINDOWS or C:WINNT and open ntbtlog and search for malicious files.

You can start by searching this short list from Computersight.com for the files starting with the following names. It may contain some random characters after it.

• rot
• gas
• gaopdx
• seneka
• win32k.sys
• uacd
• tdss
• kungsf
• gxvxc
• ovsfth
• msqp
• ndisp
• msivx
• skynet

Get the path of the file name: \SystemRoot\system32\drivers\BadRootkit.sys

4) Open up a command prompt and disable file permission using either the CACLS or ICACLS command.
For e.g., type cmd in the Run box (XP) or search box (Vista/7) with Admin privileges (in Vista and Windows 7 Hit Ctrl-Shift-Enter to enter the command prompt as an Admin) and type
cacls C:WINDOWS\system32\drivers\BadRootkit.SYS /d everyone or
Icacls C:WINDOWS\system32\drivers\BadRootkit.SYS /deny S-1-1-0:FMRXRW
(cacls /d everyone denies permission to the files for all users, Icacls /deny Sid:permission can deny Simple or Specific rights)

5) Restart the computer

6) Search for the file in the following location and remove it
C:\WINDOWS or C:WINNT
C:\WINDOWS\system32
C:\WINDOWS\system32\drivers
Registry
Clear the temp, %temp% and prefetch folders

Source: Computersight.com

The Automatic/ Semi-Automatic method

I would first fire up TDSSKiller from Kaspersky. It runs a fairly quick scan and TDSS variants are popular, so it may catch something on the first attempt.

If the TDSSKiller comes up empty then try out GMER, which is a powerful and exhaustive rootkit scanner.

From there I like to use AVG’s Rootkit Scanner. This tool has actually found quite a bit of rootkits for me. It’s also good to run it after you have removed the rootkit to be thorough, although you could do that with any of these tools. Another program worth mentioning at this point is the new Microsoft Standalone System Sweeper Beta. There has been some buzz that this tool has been fairly successful at finding hidden rootkits.

If these rootkit scanners are not finding anything, or they do find something but can’t delete it, then you may have to move to the manual method. You can also keep trying other tools but there does come a point when you have to evaluate if the time and effort is worth it or you should either try a manual method, or perform a full re-installation of the operating system.

Drop your comment