RE: Rootkit Detection - No Worries

[Mark <mark () vulndev org>]

On Tue, 28 Jun 2005, Steve Wilson wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Gage wrote:
> > Microsoft doesn't even have confidence in their own developed
> > tool to get rid of Kernel Rootkits.  Take note of the last
> > paragraph of the article below.
> <snip>
> > > However the paper admits that the only way to be sure
> > > that you have killed a kernel rootkit is to completely
> > > erase an infected hard drive and reinstall the
> > > operating system from scratch.
>
> OK, after lurking on the list for a while I'm going to take the bait,
> have a quick bite (metaphorically) and expose the world to my great
> idiocy. Fear not, normal service will be resumed shortly. ;-)

.. normal? is this comparative or actual normality?

> Now, rootkits aren't really my thing, so feel free to point and laugh

Mine neither, but regardless of that people will laugh at me so it's all
good. I'm pretty much always wrong so I won't get people to correct me
_if_ .. just when they can be bothered.

> - - but I seem to recall there being discussion during Greg Hoglund and
> Jamie Butler's rootkit training course at Blackhat last year re:
> infecting hardware (or, more to the point flashable firmware type
> stuff) such that malicious code could survive warm reboots, cold
> reboots and even hard drive reformatting/replacement. I've heard some
> other random discussions and anecdotal evidence to suggest that this
> might be possible.

Well, the problem is the loading once you've got the blighter onto the
location you want it to sit and hide on.. some form of residency needs to
be maintained to kick it in the binary bits when you want it to
start up again (unless you're just patching the operation of the actual
device and it's onboard OS..OpenBoot styleee or something..)

there's a scarey idea.. rootkit in forth.... hmmmmmmmmm.

[...]


> I'll go back to lurking now. Apologies for the interruption.

Me too, time to return to the regularly scheduled caffeine injections.


M

> Cheers,
>
> Steve.
>
> - --
> Stephen Wilson
> Senior Security Consultant
> Security Health Check
>
> WW/B109, QinetiQ, St Andrews Rd, Malvern, Worcs, WR14 3PS
> Tel: 01684 894153  Fax: 01684 897417
>
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.1
>
> iQA/AwUBQsFYuSnAQqfJ4bodEQK/LQCg2rmP6u7CP4wDUMZUkf+70cJI6kMAoJXa
> nXycuiKanbE6OCuMByVR+uqs
> =Ky8I
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Dailydave mailing list
> Dailydave () lists immunitysec com
> https://lists.immunitysec.com/mailman/listinfo/dailydave

--
                VulnDev\[.\]org
"Paranoia, keeping us clothed and fed since _init();"

_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave