Printable View
I've been reading about Windows lately, in particular about kernel mode and user mode. From what I understand, code running in kernel mode has access to just about any part of the operating system. Since device drivers run in kernel mode, what would stop someone from making a driver for, say, a usb flash drive and having it access the sam/syskey files to extract password hashes, and then paste them onto that very flash drive. Is there any built-in security to stop such things?
Well for one ... You'll have to be good in writing device drivers, so I don't see script kiddies writing anything like that soon. Also hackers will mostly use easier to exploit vulnerabilities.Quote:
what would stop someone from making a driver for, say, a usb flash drive and having it access the sam/syskey files to extract password hashes, and then paste them onto that very flash drive
Unless you're talking about rootkits, you don't need to worry too much about kernel mode driver vulnerabilities ..."yet" ... It is a threat but most modern anti-virus programs and Intrusion dedection programs can handle the driver exlpoitation.
Also ... The USB drivers run in user mode not in kernel mode, same goes for printers and I think graphics to, so the risk is much lower. (Does that count as built-in security ?)
And you need to have local access if you want to insert a USB device in a computer and get the hashes or whatever... Or even run the driver for that matter... So ifthey can do that, your basic security isn't good to begin with ;)
Well that's my 2c. anyway ...
.C.
Hi Jareds411 , this is just my opinion, so it is probably worthless :D
I think that you have a very good point there, however you would have to somehow persuade the victim to download and apply the driver from what must be an untrusted source?
However, as a follow on from your thinking, suppose a viral type malware attached itself to a legitimate device driver?
I think that the reality situation is that there are so many devices with so many different drivers that the total number of combinations is too large. Applications and operating systems are more consistent, so make a better target?
I could see it as happening as some sort of "commercial terrorism" that attacked products of a particular company to undermine their market confidence?............. that could spawn some sort of internet blackmail scenario?............. corporate extortion or whatever you may like to call it?
just a few thoughts..............
I had a HP all in one printer that had drivers and software that took over operation of my computer quite a few times before I removed them.
Always looking for updates, changing assignments for program calls for various file extensions. I removed the TSR programs from my startups but every time I printed something they activated themselves and reintroduced themselves to my startup.
Using SpyBot's Teacup program I started disallowing them but finally I said chuck it and I bought another printer.
If that wasn't commercial malware, what would you call it. It's the last HP product I'll buy.
I've been tracking malware trends and rootkit and ring zero DLL exploits are tracking upward. Scary.Quote:
Unless you're talking about rootkits, you don't need to worry too much about kernel mode driver vulnerabilities ..."yet"
Just the other day I found a rootkit sitting behind the windows API. This one traced back to a malware site in India. It was a single purpose logger (looking for credit card number strings) which it then would pass the data back via its own SMTP engine one time every 5 minutes. Very sneaky. It also had a listener activated by a port knock. Obviously this wasn't the work of a kiddie.
LOL. I think you mean TeaTimer. ;)Quote:
Using SpyBot's Teacup program I
--TH13
Yes I concur ...The rootkits are steadilly growing to become the biggest security risc ...If not so allready ..Quote:
I've been tracking malware trends and rootkit and ring zero DLL exploits are tracking upward. Scary
TH13 Do you have a resource which explain the ring zero DLL exploits more indepth ??
Monitoring systems and networks will be more and more important ... reacting with speed on vulnerabilities and outbreaks ... What if a pc in the firm gets infected with a rootkit ...
Anyway ...
.C.
Most of what I know about ring 0 exploits is sittin in meh head. I should really document it.
--TH13
Do I smell a tutorial potential :D ;)
.C.
An area I see is "Un-Offical MS update sites",
hmm just waht is in those thar hotfixes..
so what you and your pc think are MS patches, could easily be a rootkit or similar..
Not saying that these are all bogus, just be bloody careful ... and it is a vector..
my 0.2c
Hmmmm..........................
A little while ago, when dinosaurs roamed the Earth, I worked on a retail EPOS system............ I have a proggy that generates fake CC numbers that pass the normal validation checks................. now if I were to find one of these "harvesters" and connect the two.................. I wonder how long it would be before they were doing serious bubba time?Quote:
It was a single purpose logger (looking for credit card number strings) which it then would pass the data back via its own SMTP engine one time every 5 minutes
This is very moot under our laws............ it is not criminal, but I might get sued by a CC company...... they would have to prove that it was me though ;) and explain how a fake number actually worked?
:eek:
Greeting's
Well here you go :
Everyone interested in Rootkits must read this :Quote:
Rootkit detectors can detect hidden processes, but Rustock.A has no process. The malicious code runs inside the driver and in kernel threads.
And best of all its Its Windows Vista compitableQuote:
- Rootkit detectors find hidden files, so Rustock.A uses NTFS Alternate Data Stream
to hide its driver into the "\System32:18467" ADS. In addition, this ADS can't be enumerated by ADS-aware tools since it is protected by the rootkit.
- Some detectors check for the presence of system hooks by analyzing native API
and scanning for hooked functions, however Rustock.A does not hook directly any native API.
- Rootkit detectors also check for the integrity of some kernel structures like the Service Descriptor Table, but Rustock.A controls kernel functions by hooking MSR_SYSENTER and other special IRP functions. [2]
- Rootkit detectors try to detect hidden drivers, but Rustock.A removes its entries from many kernel structures including the Services Control Manager, Object manager, and the loaded module list so that this enumeration fails.
- Last, but perhaps not least, the SYS driver is polymorphic and changes its code from sample to sample.
Moreover, the malware contains aggressive rootkit technologies because it scans for the following strings in loaded programs, and then changes its behavior to avoid any detection:
- BlackLight
- Rootkitrevealer
- Rkdetector
Quote:
All of the features that I have mentioned here make Backdoor.Rustock.A totally invisible on a compromised computer when installed. It even seems able to achieve all of its stealth functionality without any problems on a beta version of Microsoft Windows Vista (6.0.5270). We believe that Rustock.A is probably a Russian creature, and it contains the string "G:\bot-mailer\007spambot-01\driver\objfre", which leads us to believe that we'll undoubtedly see new versions of this malware. So, the bar is raised again.
Here you go :
http://www.symantec.com/enterprise/s...cka_advan.html
OK,
Interesting post there Byte~ . I remember playing with the ADS vulnerability (?) some five or six years ago when it came out as a POC. I was kinda waiting for something like this.
I still think that the driver issue is getting people to d/l it in the first instance? like if I have modern kit and it runs on Windows, then the PC supplier or device supplier will have a driver, if it is not in Windows driver files already?
AFAIK this is an NTFS thing so will not affect any OS apart from Windows?
So, it looks to me as something that might be aimed at Vista itself. Like I have old kit and update the OS and there is no driver, so I get a dodgy third party one?
I really don't see it as a major potential vector at this time but it is certainly worth watching IMO.
:)
The main problem I saw was that if a driver on something like a USB device, which installs automatically, was malicious.
OK Jareds411
I see what you are saying, but all the USB stuff I have installed recently works with the native Windows XP drivers and all the CD has is drivers for legacy environments.Quote:
The main problem I saw was that if a driver on something like a USB device, which installs automatically, was malicious.
There is also the question of how you would get the malware to actually ship with the hardware............. after all, hardware manufacturers don't like going out of business and malware authors are too insignificant to be major hardware manufacturers?
I know that malware has been shipped with hardware in the past (Dell for example) but this has never been in significant quantities.
I guess it is sort of "security through obscurity" but I would think that the diversity of hardware is such that it is not a very attractive vector to the malware boys?
:)
If Symantec knows about it, it sure as hell isn't invisible and my fear level of the threat goes waaaaay down.Quote:
All of the features that I have mentioned here make Backdoor.Rustock.A totally invisible on a compromised computer when installed.
;)
BUt seriously, it leaves footprints which are a dead give away that you're infected. This alone should tip you off that something is wrong:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pe386
--TH13