(12) Unlted States Patent (10) Patent No.: US 8,086,835 B2 Argus Et A]

US008086835B2 (12) Unlted States Patent (10) Patent No.: US 8,086,835 B2 Argus et a]. (45) Date of Patent: Dec. 27, 2011 (54) ROOTKIT DETECTION 2005/0081198 A1 * 4/2005 (3110 et a1. .................... .. 717/174 2005/0229250 A1 10/2005 Ring et a1. 75 Inventors: Christo her J. Ar us, Crown oint, IN Zoos/0162915 Al * 7/2008 Pris: et .al' """"""""""" " 713/2 ( ) (Us); clliase N- Doguglass portlivaynes 2008/0282350 A1 * 11/2008 Khllnanl et a1. .............. .. 726/24 IN (US); Dan J. Di Spaltro, Bend, OR FOREIGN PATENT DOCUMENTS (US); Michael D. Fuller, Seattle, WA Ep 656587 A1 7/1995 (Us) OTHER PUBLICATIONS (73) Assignee: International Business Machines Sean’s Blog, Making a bootable USB drive with BartPE or Corporation, Armonk, NY UBCD4Win, Mar‘ 31, 2006, pp‘ 1_3‘* _ _ _ _ _ PCuser, RootKitty BartPE plugin?, Dec. 4, 2006, p. 1.* ( * ) Not1ce: Subject to any d1scla1mer, the term of th1s patent is extended or adjusted under 35 * Cited by eXaminef U.S.C. 154(b) by 1111 days. Primary Examiner * Thomas Lee (21) Appl. No.: 11/757,729 Assistant Examiner * Michael J BroWn (74) Attorney, Agent, orFirm * Steven M. Greenberg, Esq.; (22) Filed: Jun- 41 2007 Carey, Rodriguez, Greenberg & O’Keefe (65) Prior Publication Data (57) ABSTRACT US 2008/0301426 A1 Dec. 4, 2008 Embodiments of the present invention address de?ciencies of the art in respect to rootkit detection and provide a method, (51) Int- Cl- system and computer program product for external rootkit G06F 9/24 (2006-01) detection and remediation. In one embodiment of the inven G06F 15/177 (2006-01) tion, an external rootkit detection tool can be provided. The (52) US. Cl. .............. .. 713/2; 713/1; 713/100; 717/174; tool can include external static memory With an input/output 726/22 (I/O) port interface to an external I/O port on a target com (58) Field of Classi?cation Search ................ .. 713/1, 2, puting platform. The tool further can include a boot image 713/100; 717/174; 726/22 disposed in the external static memory, and rootkit detection See application ?le for complete search history. and remediation logic disposed in the external static memory and referenced by the boot image. In one aspect of the (56) References Cited embodiment, the external static memory can include a uni versal serial bus (U SB) key and, correspondingly, the I/ O port U.S. PATENT DOCUMENTS can include an external USB port. 5,511,184 A 4/1996 Lin 6,240,530 B1* 5/2001 Togawa ......................... .. 714/38 10 Claims, 1 Drawing Sheet 130 Operating System Dynamic Memory 140 120 170 Boot Image 180 Rootkit Detection and Remediation US. Patent Dec. 27, 2011 US 8,086,835 B2 130 Dynamic @ Memory *7 140 f 120 170 Boot Image 180 Rootkit Detection and Remediation 210 Boot into Key 220A 220B 220C 220D 220E MD5 Hash . File Permissions String Search I I Compare Default Flles for Binaries (LKM & KLD) Hidden H93 240 250 230 Remove _ Initiate O/S YES NO Boot + FIG. 2 US 8,086,835 B2 1 2 ROOTKIT DETECTION operation of hook analysis only provides a circumvention challenge for the malicious hacker. BACKGROUND OF THE INVENTION BRIEF SUMMARY OF THE INVENTION 1. Field of the Invention The present invention relates to the ?eld of network secu Embodiments of the present invention address de?ciencies rity and more particularly to rootkit detection and remedia of the art in respect to rootkit detection and provide a novel tion. and non-obvious method, system and computer program 2. Description of the Related Art product for external rootkit detection and remediation. In one Computing security has increasingly become the focus of embodiment of the invention, an external rootkit detection information technologists Who participate in locally and glo tool can be provided. The tool can include external static bally accessible computer netWorks. In particular, With the memory With an input/ output (I/ O) port interface to an exter availability and affordability of netWork computing, even nal I/O port on a target computing platform. The tool further Within the small enterprise, many computers and small com can include a boot image disposed in the external static memory, and rootkit detection and remediation logic dis puter netWorks provide access to a substantial number of end posed in the external static memory and referenced by the users continuously. NotWithstanding, the ef?ciencies gained, boot image. In one aspect of the embodiment, the external netWork computing is not Without its price. Speci?cally, those static memory can include a universal serial bus (U SB) key computers and computer netWorks Which heretofore had and, correspondingly, the I/O port can include an external remained disconnected from the security risks of the Internet 20 USB port. noW have become the primary target of malicious Internet In another embodiment of the invention, an external rootkit hackers, crackers and script kiddies, collectively referred to detection method can be provided. The method can include as “malicious hackers”. performing bootstrap of a target computing platform through Malicious hackers utiliZe a vast selection of tools to Wreak a boot image in an external static memory, and detecting a havoc in the computing World. Whereas some tools permit the 25 rootkit component in the target computing platform from malicious hacker to launch an attack directly into a computing rootkit detection logic disposed in the external static memory. environment, oftentimes malicious hackers prefer to utiliZe In this regard, In one aspect of the embodiment, detecting a an intermediary from Which to launch an attack. The choice of rootkit component in the target computing platform from intermediary largely relates to the desirability of malicious rootkit detection logic disposed in the external static memory hackers to evade detection. To that end, malicious hackers 30 can include detecting a rootkit component in an operating often seek to transform a host computing platform into a system component of the target computing platform from “Zombie” platform commanded remotely by the malicious rootkit detection logic disposed in the external static memory. hacker to launch an attack on trusting collegial netWorks. In another aspect of the embodiment, the method further can In furtherance of the goals of the malicious hacker, a “root include mounting the external static memory read-only, kit” is a collection of programmatic tools that enable admin 35 receiving an encrypted form of an update for the external istrator-level access to a computer or computer netWork. static memory, verifying the update and applying a decrypted Typically, a malicious hacker utiliZes the rootkit ?rst by form of the veri?ed update to the external static memory. installing the rootkit onto a host after obtaining user-level Additional aspects of the invention Will be set forth in part access, either by exploiting a knoWn vulnerability or cracking in the description Which folloWs, and in part Will be obvious a passWord. Once the rootkit has been installed, the rootkit 40 from the description, or may be learned by practice of the alloWs the malicious hacker to mask intrusion and to gain root invention. The aspects of the invention Will be realiZed and or privileged access to the host and, possibly, other devices on attained by means of the elements and combinations particu a common netWork. larly pointed out in the appended claims. It is to be understood A rootkit generally includes spyWare and other programs that both the foregoing general description and the folloWing that monitor tra?ic and keystrokes. The rootkit commonly 45 detailed description are exemplary and explanatory only and also includes program code enabled to create a “backdoor” are not restrictive of the invention, as claimed. into a target for use by the malicious hacker. The rootkit yet further often includes program code enabled to alter log ?les, BRIEF DESCRIPTION OF THE SEVERAL attack other devices on a common netWork and to alter exist VIEWS OF THE DRAWINGS ing system tools to escape detection. Though robust in logic, 50 rootkits have become increasingly more dif?cult to detect all The accompanying draWings, Which are incorporated in the While having become more common. In this regard, root and constitute part of this speci?cation, illustrate embodi kits can avoid detraction by inserting themselves in to the ments of the invention and together With the description, underlying belly of the operating system making it nearly serve to explain the principles of the invention. The embodi impossible to detect While the operating system executes. 55 ments illustrated herein are presently preferred, it being Contemporary rootkit detection softWare relies upon an understood, hoWever, that the invention is not limited to the analysis of different portions of the infected operating system precise arrangements and instrumentalities shoWn, Wherein: during execution to identify established hooks into kernel FIG. 1 is a schematic illustration of a computing system system services of the operating system. To the extent, that con?gured for external rootkit detection and remediation; system services have been intercepted and modi?ed can indi 60 and, cate the possibility that the safety of the system is at risk and FIG. 2 is a How chart illustrating a process for external that spyWare, viruses or malWare are active. Still, most skilled rootkit detection and remediation. artisans recogniZe that in many system tools such as moni toring and antivirus softWare, kernel hooks are the only avail DETAILED DESCRIPTION OF THE INVENTION able technique to achieve a desirable result and thus the pres 65 ence of kernel hooks alone is not suf?cient to identify the Embodiments of the present invention provide a method, presence malWare. Additionally, knoWing the published system and computer program product for external rootkit US 8,086,835 B2 3 4 detection and remediation.

Load more