[Fwd: Re: Thoughts about Cross-View based Rootkit Detection]

[Joanna Rutkowska <joanna () invisiblethings org>]

as usual, I forgot to cc to DD..

-------- Original Message --------
Subject: Re: [Dailydave] Thoughts about Cross-View based Rootkit Detection
Date: Sun, 19 Jun 2005 16:49:04 +0200
From: Joanna Rutkowska <joanna () mailsnare net>
To: Dave Aitel <dave () immunitysec com>

Dave Aitel wrote:
> I'm not sure exactly what is meant by "cross view" in this context.
> Is there a simple dictionary for us non-rootkit developers to follow?
for e.g. look here: http://research.microsoft.com/rootkit/
and if you, for some reasons;), don't like the above source, look here
too: http://www.sysinternals.com/Utilities/RootkitRevealer.html:

"RootkitRevealer compares the results of a system scan at the highest
level with that at the lowest level."

[the lowest level expression is a little bit exaggerated here, as I
pointed out in the paper]

> Is it any detector that follows a "low level" view with a "high
> level" view and then does a compare?

RootkitRevealer (http://www.sysinternals.com/)
BlackLight (http://www.f-secure.com/blacklight/)
GhostBuster (http://research.microsoft.com/rootkit/)
...just to name a few ;)

> Just out of curiosity, do any of the win32 rootkits out there move
> their files out of the way? I.E. if I'm in the kernel, I can watch
> you read sectors, and if I see a sector that looks like me, I can
> move myself to an earlier sector, right? Kinda core-wars-esq, if
> you've ever played that game.

this way you can only escape from a signature based scanner. but we all
known that signature based detectors have lots of limitations, right?
to escape from a "cross-view diff" based detection, you need to cheat
also about the MFT data (if we consider NTFS).

> I still do like the idea of hiding in plain sight. There's just so
> much entropy on a normal system - you can replace explorer.exe and be
> pretty happy.

doesn't my discussion about "why bother to hide files at all?" convince
you? ok let's assume it doesn't. sill, there are lots of things that
cannot be done if you only replace some binaries. and also, we cannot
use it on servers, where all(?) admins use tripwire like things to check
that nobody actually replaced their lovely explorer.exe... ;)

joanna.


_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave