What is a rootkit and why should I be concerned?
“Rootkits… they are PURE EVIL… NO ONE IS SAFE… LOCK UP YOUR DATA!!!” OK, I admit that’s a little over the top, but hopefully I have your attention, because this is a very serious issue for anyone connected to the Internet that cares about their personal and financial data. What are rootkits? I’m SO GLAD you asked!
In the constant online warfare being waged over your personal identity and information, rootkits represent the next wave of attack. Before we get too far into this, let me present a few definitions of a rootkit.
What is a Rootkit?
Rootkits have been defined by Microsoft Technical Fellow Mark Russinovich as “anything in the software realm that hides objects from standard security administration or management.” Now, latch on to the word “HIDES” in that definition, for it’s the very core of why you should be concerned. Another definition found in Wikipedia reads, “A rootkit is a software system that consists of a program or combination of several programs designed to hide or obscure the fact that a system has been compromised.” Again, the word “HIDE” is brought forth. The final definition is for the word “Insidious”, which means “Working or spreading harmfully in a subtle or stealthy manner”. That also could be used to describe a rootkit. Are you starting to get the picture?
So rootkits are software programs that use various techniques to install themselves on a computer in such a way that they can hide themselves and their activity, from the Operating System. Please realize that when the Operating System itself is unaware of the existence or activity of a program, many programs designed to protect your computer may also not be aware of this activity.
Sneak Attack
The primary focus of this “next wave” is stealth, but to varying degrees. For instance, there are rootkits whose purpose is mainly to secretly download other malware onto your computer and install it. The malware itself may alert you to it’s presence, as in the case of a browser helper object (BHO) which redirects your browser to other sites; an obvious tip-off that something’s amiss. So you run something like Malwarebytes Anti-Malware program to get rid of the offender and all is good, until a few days later when you notice your browser is again redirecting you to a site you never intended to visit. That fact could be a clue that you either never fully removed the malware, or that a rootkit, which went undetected and continued to operate unseen, has downloaded more malware onto your PC and has re-started it.
In the case of an attacker who wants to steal your personal or financial data, you may never see any outward signs that your system has been compromised. Think about it – if you were going to steal something from someone, would you advertise it? Would you pull out a bullhorn and stand in front of your victims house and shout out what you’re about to do? Not likely, unless you were a genuine loony! No, you’d sneak in through an unlocked backdoor when no ones looking. You’d make every attempt to cover your tracks and not raise suspicions. You’d make sure you weren’t noticed. And that’s why you should be concerned! If a rootkit program has made it’s way onto your computer for the purpose of stealing personal or financial information, you likely won’t be aware it’s happening to you!!! Very insidious!
Who uses Rootkits?
We won’t attempt to explain the many techniques that rookits use to disguise themselves, but you should know it’s an ever evolving field of research, both by good guys and bad guys. Learning how to create new ways to circumvent the Operating System has moved into the big leagues. It’s no longer just some bored teenager with mad programming skills seeking attention. More and more, this research has big money behind it, funded by various nefarious (I had to say that) groups, because THERE IS A LOT OF MONEY TO BE MADE!!! That statement alone should wake you up. If the payback wasn’t worthwhile, they wouldn’t pump money into it!
Who – besides the usual bad guys – uses rootkits? Governments use them to spy on other governments or “groups of concern”. An example would be the Chinese governments use of rootkits to spy on the Dalai Lama and steal documents from his office computers. The Sony Corporation has used rootkit technology to implement their Digital Rights Management scheme. Sonys’ use of this technology wound up in court, which has since been settled, and Sony no longer uses that technology. The technology of rootkits, by itself, isn’t illegal. How you use it is another matter. The source code for various rootkits can be downloaded freely from the Internet. Anyone, from the kid down the street, to government security agencies, can use this technology.
I want to point out that, more often than not, the rootkit itself isn’t doing the actual spying or gathering of your personal information. The rootkit is usually just an enabler. It is typically used to hide the activity of other programs that the rootkit, once it is installed, secretly downloads to your computer. These downloaded programs can include programs which record your keystrokes or take screen-shots of your display and send them to someone for analysis. Rootkits can install “backdoor” or RAT (Remote Access Tool) programs which enable a remote user to gain further access to your operating system, altering security permissions as needed, and gain access to potentially interesting data files residing on your hard drive. Anything that an attacker wants to install, and do so in a manner that is undetected by the operating system, can be done through the functionality of a rootkit program.
What can you do?
Look for anti-rootkit functionality when you purchase protective software. Rootkit detection technology is becoming more common in commercial anti-malware programs. There are also standalone anti-rootkit programs that you can freely download. Be aware that rootkits are based on various techniques and not every anti-rootkit program will detect every type of rootkit. And some anti-rootkit tools are for detection only. Of course, the detection methods vary. Some require you to be in Safe Mode, and some require that the rootkit be operational in order for it to be detected. Try several from different vendors. Most of the standalone variety, it seems, require a fair amount of technical skill to use correctly, while others are as easy as clicking a few buttons. Here are a few which do not require technical knowledge.
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html
F-Secure Blacklight Rootkit Eliminator
http://www.f-secure.com/en_EMEA/security/security-lab/tools-and-services/blacklight/
As with any security program, try to get the most recent versions.
Isolate Yourself
Consider doing ALL of your Internet browsing within the confines of a virtual machine (VM), especially online banking or any online financial transaction. Virtual machines are really cool technology. Essentially it’s a software implementation of a machine ( a computer) that executes programs like a physical machine. A virtual machine is software that creates an environment that emulates real hardware. You can actually install other operating systems into this “environment”. The installation program thinks it’s communicating with real hardware and completes it’s installation as though it were installing to a real standalone computer. You can obtain free Virtual machine software from either Microsoft or VMWare. You can also purchase commercial products which have more features than the free versions but that’s another topic.
You can download Microsoft’s free Virtual PC program
You can download VMWare’s free VMWare Player
So how exactly does this benefit you? Glad you asked! Once you’ve created a virtual machine and installed a copy of Windows and updated it with whatever programs you need, you can save this configuration or the current “state” and call it up as needed. Each time you run it, it will be exactly as it was when you first created it – free of any rootkits or spyware – presumably. A totally pristene system each time you start it. Now if you add something later or visit a web site and save the changes, then that’s another matter. It’s now an altered state and may or may not be pristine. We are suggesting that you create a clean virtual machine environment for general surfing and another strictly for online banking or financial transactions. When you’re done surfing the net, you just close your virtual machine without saving any changes; anything malicious that was picked up while surfing essentially disappears. Use these VM’s only for their designated purpose and nothing else. Use the one designated for financial transactions to visit your banks web site, and when you are through, close the browser and close the VM. Don’t save any changes to the VM. If you want to purchase something online with a credit card, make sure you know what you want ahead of time and that the site you are going to purchase through is legit, open a virtual machine and go directly to the site and finish the transaction. When it’s finished, again, close the browser and close the VM. Don’t save any changes. You want to keep it pristine. That is currently about as safe as can be expected when doing anything financial online.
Hire a Professional
Removing rootkits can be a dicey proposition. Rootkits insert themselves into an operating system at a very low level and can manipulate the system at a low level. Depending on the variety of rootkit, they can be EXTREMELY difficult to remove, without crashing or rendering your system inoperable. If in doubt, seek out professional help. They have advanced knowledge and tools and are more likely to be able to extract the rootkit. Before taking your machine to a pro, please make a backup of your data if at all possible or have them do it. Even if your machine is infected, an infected backup can be better than no backup sometimes. Make sure to mark the backup as being possibly infected.
Also be aware that it’s entirely possible that the machine may need to be wiped out using special programs and techniques, so that the operating system can be re-installed from scratch. Why the special software? Some rootkits have found a way to install themselves in areas of your hard drive which your hard drive’s own firmware has marked as unusable. The operating system never uses these areas and most detection programs don’t look there either. Special drive erasure programs are needed to bypass this and erase or format these previously marked-as-bad sectors.
Closing thought
It’s been said that the creation of rootkits and anti-rootkit programs is a game of “cat and mouse” that no one can win. The reality is, if the bad guys are always a step ahead, then they are winning.
Comments are closed.
