[ news_security_news ]
A Rootkit Under The Radar
David Utter
Staff Writer
2006-07-13
 Insider Reports RSS Feed
Although the threat of a virtualization rootkit, undetectable by normal means, has been proven, it is not in the wild yet; Rustock/Mailbot has been floating around since June, and is nearly impossible to track down.
Until late June, the Mailbot.AZ rootkit (aka Rustock.A) existed as an almost undetectable rootkit. It had behaviors coded in to it to help evade security software, including F-Secure's BlackLight product.
F-Secure posted about Mailbot, and its use of Alternate Data Streams to hide from detectors like Blacklight:
There's only a single component lying on the disk, and that is a kernel-mode driver. It's stored as hidden data stream attached to the system32 folder (yes, folders can have data streams as well)! Saving your data into Alternate Data Streams is usually enough to hide from many tools. However, in this case, the stream is further hidden using rootkit techniques, which makes detection and removal quite challenging.
Since the rootkit is hiding something that is normally hidden, F-Secure sees this particular bit of malware as being very problematic should it become widespread. Symantec detailed some of the scarier aspects of of Rustock, including this kicker:
Last, but perhaps not least, the SYS driver is polymorphic and changes its code from sample to sample.
Moreover, the malware contains aggressive rootkit technologies because it scans for the following strings in loaded programs, and then changes its behavior to avoid any detection...
All of the features that I have mentioned here make Backdoor.Rustock.A totally invisible on a compromised computer when installed. It even seems able to achieve all of its stealth functionality without any problems on a beta version of Microsoft Windows Vista (6.0.5270).
Rustock is the first such sample of a rootkit that hides so effectively from detection. It's scary to consider what the next one, with or without virtualization, will do.
---
Tag: Rustock
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
