Windows Root kits a stealthy threat

After a quick test, renaming the exe file will not circumvent Norton Corp addition ver 7.61.928 with the 2/26/03 rev 7 signature. It throws it into the quarentine list immediately.

BUT, if you can get physical access to the box, you can easily place all the goods on a box after adding the nice stealthy filenames (one's that don't look too suspicious to the average person) to the exclude list. This will work with any anti-virus software. Just something to keep in mind ;) as this is something that HAS happened to me in the past.

Often the best way to detected that your box as been rooted and trojaned/rootkit'ed is to portscan the box: the rootkit can hide open ports from netstat or such, but they'll still show up in a portscan.

Ammo

Ammo,

You got it buddy. This is one technique that can be used. If I may add one thing, be sure to give it a nice close look as rootkits tend to hide on ports that usually don't raise much suspicion. A well trained eye should be able to spot it though.

My extra two cents ;)

It could probably be easily installed with a script. If you knew several popular e-mail services... you can create a script that will disable the antivirus software.

then have the script download it from a remote location and install it...

This would require a privledged account be logged in and internet access.

I have seen that no matter how many times you tell someone, they will still login as admin/root. They don't seem to think that it can happen to them. All it takes is for someone to open an attachment... which happens all too frequently as we know by all the sucessful viruses out there.

I have seen several different root kits out there and have played little with them.
One thing is for sure... the threat is real. Too real. These things are very easy to hide...

Unless you did a portscan on the machine... you'd never even know it was running....

It's technically feasible to make a trojan that listens for connections without any open ports. All it has to do is use raw sockets (or ICMP.DLL or something on Windows < WinXP) to listen for an ICMP_ECHO_REPLY with a magic value in the data, and responds with another ICMP_ECHO_REPLY. It wouldn't show up on netstat, or a port scan.

As ICMP_ECHO_REPLYs are normally seen (by local users pinging), they are rarely blocked or trigger IDS

Alternatively, it could hook a port that was already open, looking for some specially formatted data, therefore not opening any new ports.

Quote:

---

Alternatively, it could hook a port that was already open, looking for some specially formatted data, therefore not opening any new ports.

---

This is exactly how the rootkit works that I discussed in the original thread I started on this subject (before the link to the actual source code and binaries was stripped out by a moderator). It hooks port 80 on any W32 machine running IIS 4 or 5 and waits for packets from the client - nasty business.

Heh, nasty indeed!

Ammo

Would also be possible to bypass the safe mode disabling the driver the root kit runs of, by writing the modfied version of say the mouse or keyboard driver?

SittingDuck

Quote:

---

Would also be possible to bypass the safe mode disabling the driver the root kit runs of, by writing the modfied version of say the mouse or keyboard driver?

---

I do wonder if this is possible. My gut feeling suggests that it probably is possible.

Windows file protection (in win2k) would get in the way, but I expect any decent trojan could dodge that. Also, I'd imagine it would use a more trivial driver than mouse or keyboard, for instance NULL or BEEP

The non-working of null or beep would be unlikely to arouse much suspicion, unlike the keyboard or mouse.

Is null even used by applications much?

A kernel-mode driver should be able to hook filesystem functions to make it executable(s) disappear to anything running at a higher level (user-mode, for instance). To the best of my knowedge, this would probably include virus checkers.

Although virus checkers do normally use system call hooking (so they can veto the opening of unchecked or infected files), I don't think the scanning happens at kernel level.

This is the sort of unpleasantness that Linux rootkits have been doing for a few years now. It's obviously much easier on Linux with better documented interfaces and source available.

However, the principle is the same.

So having said all this, how easy or difficult is it to remove a root kit once it's been embedded? I've been having problems lately and another AO user said that a root kit could be my problem, and that I should nuke my system. Is this the only answer or can the known ones be detected through special means and removed of?