[ news_security_news ]
A Dangerous Development In Rootkit Evolution
Doug Caverly
Staff Writer
2006-07-19
 Insider Reports RSS Feed
Like so many security threats, rootkits are getting more dangerous. But now this breed of malware has taken a big leap forward.
Security researchers have identified a stealthy new rootkit that seems specifically (and skillfully) designed to avoid being detected by some of the more common rootkit detectors.
CNET has covered the new threat, which Symantec has dubbed "Backdoor.Rustock.A." Symantec employee Elia Florio wrote, "It can be considered the first born of the next generation of rootkits."
He went on to call it "an advanced example of ‘stealth by design' malicious code."
Florio listed a number of reasons in the company blog "that Rustock.A is turning heads" - it's not what one would consider an encouraging compilation. "Rootkit detectors can detect hidden processes, but Rustock.A has no process," he stated.
Additionally, "the malware contains aggressive rootkit technologies because it scans for the following strings in loaded programs, and then changes its behavior to avoid any detection."
Florio found that it could hide from BlackLight, Rootkitrevealer, and Rkdetector. Rustock.A is "totally invisible on a compromised computer when installed," he said.
And don't count on the next version of Windows to turn things around.
Rustock.A "even seems able to achieve all of its stealth functionality without any problems on a beta version of Microsoft Windows Vista (6.0.5270)," Florio wrote.
The Symantec employee also had something to say about the rootkit's origin, and its future.
"We believe that Rustock.A is probably a Russian creature, and it contains the string ‘G:bot-mailer 07spambot-01driverobjfre,' which leads us to believe that we'll undoubtedly see new versions of this malware."
Add to | DiggThis | Yahoo! My Web
Technorati: Rustock.A
About the Author:
Doug is a staff writer for SecurityProNews. InternetFinancialNews, SearchNewz, and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
