Rootkits: a Hidden Issue in Security
Total Page：16
File Type：pdf, Size：1020Kb
Rootkits: A hidden issue in security Bryan Crawford Olimhon Malikov Matthew Miller MBA605 Demorest, GA 20 February, 2006 Abstract: Rootkit: A rookit is a collection of programs used by a hacker to evade detection while trying to gain unauthorized access to a computer. This is done either by replacing system files or libraries, or by installing a kernel module. The hacker installs the rootkit after obtaining user-level access.1 In this era of business threats to company security come in all forms, many of which are electronic threats that affect information systems and databases, often times these systems are critical to operations or contain important information that needs to be protected. Rootkits are quickly becoming a buzz word in computer security as they provide protection to malicious mal-ware and trojan ware programs that may affect a user’s computer system. It is important to remember that in and of itself a rootkit is not always malicious or harmful, many computer security programs use this technology to operate. However the passages that rootkits provide for hackers to access a system are what make them dangerous. This writing reflects out research into what rootkits are capable of, how they affect a system, and one major example of how a major company attempted to use this technology to protect itself, only to run into negative publicity and a great financial burden. Crawford, Malikov, Miller 2 "2006 will be the year of the rootkit. It's no longer just about getting on machines, it's how to stay on machines”2 Vincent Weafer, Senior Director, Symantec Security Response As the computer According to a recent report on rootkits by technology around the Kaspersky Lab3, a developer of secure content world continues to management solutions aiming to protect against viruses, develop at a very steady spyware, Trojans, hacker attacks and spam, rootkits are speed the problems also described as a set of programs enabling a hacker to keep a similar pace. maintain access to a computer after cracking it, while Specifically within the preventing the hacker from being detected. Kaspersky personal computer and Lab's4 report looks at how rootkits are detected, why server technology areas they are dangerous and why their use is increasing. security still remains as Rootkit as a term originally referred to a special one of the primary and set of Unix tools that would hide the trace of any hard to tackle concerns. unauthorized user thus allowing the intruders to maintain The battle between the so called root on the system without the system software makers and administrator even seeing them. The term however is virus authors has been not restricted to Unix based operating systems any active and computer longer, as similar tools now exist for other operating attackers are posing systems such as Microsoft Windows. newer weapons as The Kaspersky Lab report also indicates rootkits’ means of intrusion. popularity is partly due to the fact that internet offers the One of these source codes of many rootkits5. It's relatively easy for means of intrusion, virus writers to make small modifications to such code. Another factor which influences the increased use of known as rootkit, has rootkits is the fact that most Windows users use the recently become quite administrator's account, rather than creating a separate popular among hackers. Crawford, Malikov, Miller 3 user account. This Linux and Solaris. The files in a hidden directory or makes the rootkit location will not be scanned during the scheduled or installation on the target manual virus scans6, providing a perfect hiding ground machine much easier. for Trojans, viruses and other malware. These factors Authors of are contributing to the rapid growth of rootkit reports and (Fig. 1) spyware primarily use a steep increase in their presence. Kapersky Labs rootkits to thwart anti reported on their website, www.viruslist,com that rootkit (Fig. 2) spyware scanners. usage grew 413% from 2004 to 2005, representing Rootkits also are used to by far the fastest expanding type of malware. protect programs known The rootkit controversy started to come to light as Trojan horses, which in the media and business with the findings of Mark allow remote spammers Russinovich, a software developer and designer for to take over your PC and Winternals Software of Austin, TX. Russinovich is use it to launch considered an expert on rootkits and is credited for avalanches of e-mail. developing RootkitRevealer, software to combat this And, of course, the virus technology.7 Russinovich discovered the presence of a writers can use rootkits rootkit like program on a copy of Sony BMG’s Get Right to disable malware With The Man, a CD release of southern rock group Van scanners and block Zant. Sony had placed the code on the CDs in an effort access to Web sites that to reduce piracy but in the process created a sand-storm contain security tools of public outcry. Russinovich’s findings were followed Some of the by those of Dan Kaminsky, and independent computer 8 well-known anti-virus security analyst and advisor . Kamisnky estimates that software suppliers are over 500,000 machines are infected world wide by the 9 seriously concerned with Sony borne rootkit. Today, the global music giant faces controversy over the use mass criticism and class action lawsuits on this of rootkits in their dangerous security loophole. They are in a process of products. The rootkit replacing the affected CDs across the globe, estimated to 10 tools are known to exist be over 2 million in number . The findings that some in different versions of anti-virus companies were using similar rootkits in their Microsoft Windows, security solutions gave a different dimension to the issue. Crawford, Malikov, Miller 4 The discovery of the not in the user space11. There are several weaknesses presence of rootkits in with this approach. For one, if the kernel has been Sony BMG CDs and the infected by a rootkit then there is a high chance the following public and results of the scan of the kernel will also be incorrect. government outcry have One way around this issue is by shutting down the led to a class action computer and booting from an alternative source that you lawsuit against the know is clean 12. The other weakness is the fact that record label. This rootkits are able to escape detection by hiding from the pending case and its scan. Most rootkits are able to hide from all processes impacts will be except those designed to detect the specific rootkit. The discussed in further other option to detect the presence of rootkits is the event detail later. monitoring method. This method uses intrusion- Now that we prevention systems that monitor system behavior from have looked at the basics the inside the kernel. IPS programs are able to block of rootkits and their kernel modules such as rootkits from loading. Properties emerging threat, The and other characteristics of the modules are inspected to next thought is looking see if the module appears malicious. This process must into how to combat this be completed because other safe kernel modules are issue. There are two often used such as antivirus programs and only the main ways to detect the possibly harmful ones would need to be detected. The presence of a rootkit: event monitoring also has drawbacks by as mentioned scanning and event before by often classifying safe programs that use kernel 13 monitoring. The modules as harmful . scanning technique The actual removal of the rootkit presents other involves comparing a problems. Where a virus attempts to spread, a rootkit view of the system using tries to remain in a single system. The payload of the user-space tools and a rootkit attempts to make sure the system remains view from inside the compromised by the rootkit14. Removal of the rootkit kernel. If anything is from a system requires removing the rootkit itself, and hidden, it should be the payload. Due to rootkits primarily being kernel visible in the kernel, but modules that affect the operating system this task is Crawford, Malikov, Miller 5 daunting. To remove intentions”, historians are unsure of exactly who said the rootkit and payload this, although it often credited to Samuel Johnson, in any without causing damage case it seems relevant to Sony BMG Music’s current or instability to the situation. Sony BMG, like other record companies is operating system is very looking for ways to copy protect its music to help difficult. Russ Cooper, prevent piracy and illegal copying. In this quest they founder of the along with First 4 Internet Ltd developed a type of DRM NTBugtraq mailing list, (digital rights management) software that they dubbed notes that “only a person “sterile burning”17 this embedded program was included with very little on 52 CD releases from the music mogul. The good knowledge would try to intentions of the program were to allow users to play the remove a rootkit”15. It CD in their computers as well as convert the music a appears that once a format supported by MP3 players. However it also system has been affected imposed a limit of how many times the CD could be by a rootkit the only digitally copied, or ripped, to 3.18 The negative effect of 100% safe stance to this protection software soon surfaced when internet combat the infection is security experts noticed the presence of rootkits on total reformatting of the otherwise clean computers that had been used to play hard drive and Sony BMG music CDs. reinstallation of the The issue for Sony BMG lies not in the use of 16 operating system .