Slashdot Log In
New Antivirus Tests Show Rootkits Hard to Kill
Posted by
timothy
on Wed May 14, 2008 12:43 PM
from the malice-evolves dept.
from the malice-evolves dept.
ancientribe writes "Security suites and online Web scanners detect only a little more than half of all rootkits, according to new tests conducted by independent test organization AV-Test.org. Many of today's products struggle to clean up the ones they find. AV-Test.org also found that a few big name AV scanners had serious problems finding and removing active rootkits, such as Microsoft Windows Live OneCare 1.6.2111.32 and McAfee VirusScan 2008 11.2.121."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Interesting way of putting it (Score:5, Funny)
Re:Interesting way of putting it (Score:5, Funny)
Perhaps you yourself need a lesson in reading and comprehension.
Parent
Re: (Score:3, Funny)
(sorry to interrupt the flame war)
Re:Interesting way of putting it (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
Re:Interesting way of putting it (Score:5, Funny)
Parent
Re:Interesting way of putting it (Score:4, Funny)
You forgot the twiddle.~
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re:Interesting way of putting it (Score:5, Interesting)
But on a more serious note, I think these new super stealth rootkits are going to be the beginning of the end for the AV industry. IMHO we are going to have to end up with whitelisting at the OS level as the never ending tidal wave of viruses will simply become too hard for the AV industry to keep up with without overloading the systems with the constant scanning and updating. And in this day and age IMHO it is kind of silly that I can't simply make a list of the two dozen or so programs that I use and have them be the only things that are allowed to run. And with all the legacy systems out there running older MSFT OSes some company could make some good money with an easy to use system that lets a user specify the couple of dozen programs he uses and refuse to run the rest. Anyway that is my 02c,YMMV.
Parent
Re:Interesting way of putting it (Score:4, Informative)
"in this day and age IMHO it is kind of silly that I can't simply make a list of the two dozen or so programs that I use and have them be the only things that are allowed to run".
For Windows, what you are describing is Software Restriction Policies [microsoft.com]. This has been around for some time.
Parent
Re:Interesting way of putting it (Score:4, Interesting)
I had to dig deep, but the company that did the test, tested software that was released in 2005-2006. They weren't even testing what had been released in the past 2 years, only stuff that was known in security circles in 05-06!!!
they tested security suites as well as specialized removal tools, the sad part was that
3 of the rootkits were on COMMERCIAL PRESSED CD/DVDs I guess, only the likes of sony gets sued over offering rootkits on DVDs/CDs.
white-listing might help, but clueless users are going to override white lists because of the 'dancing pigs problem' http://en.wikipedia.org/wiki/Dancing_pigs [wikipedia.org]
I knew about this problem, but my experience was even worse, I couldn't find a single scanner that could even detect the trace files in a zipfile, other than google's g-mail scanner...
once again the rootkit came to infect my systems around 2006, or possibly earlier, but it could re-infect from CD-rs and DVD-rs I'm basically in a situation now where i am being forced to use linux to read those discs and salvage what data i can, and never even dare let that data go near a windows machine again... not a practical solution, but i couldn't find a single scanner that could detect the problem from it's source... so all my old cd-r and dvd-r are now suspect... because the virus can add on to any disc not 'finalized' and there isnt' a single detection program i can run (sending files through g-mail only works when you have small files, and a lot of free time)
but yeah, security firms aren't keeping up anymore. if they can't even keep up with 'known' rootkits, then frankly we should all switch to linux, and never never install anything not in a repository... (essentially white listing ourselves)
Parent
In other news... (Score:5, Insightful)
Grass is green, sky is blue, Pope is Catholic, etc...
When people create these things... isn't the intent to make them hard to detect/kill?
What this article has highlighted, though, is that a thorough study on how those rootkits got installed in the first place (especially with regard to the level of user interaction required) combined with some basic education provided to end-users within the OS could go a long way. It's the whole ounce of prevention worth a pound of cure thing. Obviously the cure is not yet up to snuff... and potentially never will be.
I don't even bother trying to clean them up. (Score:5, Interesting)
I'm pretty sure it was trojaned game mods that got him instead of the usual porn sites. At least, if it was porn, he did a pretty good job hiding his tracks. :->
Parent
Re:I don't even bother trying to clean them up. (Score:5, Insightful)
It would have to compare the checksum of every executable and every DLL on the system to known good examples to confirm they've not been infected (though to be honest I suspect most of them are just taking advantage of the labyrinthine mess that is Windows rather than going to all the hassle of infecting files).
It would have to confirm that every patch which has security implications has been installed (eg. there have been patches which deal with code which loads JPEGs - not much point in rebooting if the first thing that's going to happen is you get reinfected so that's got to be solved).
It would have to delete any application that isn't on a known-good list. So you need a "known-good" list covering every Windows application known to man, and you also need to account for those rare cases where you're dealing with a software developers machine and there are executables on there that aren't known to man.
And remember what I said earlier about "there have been vulnerabilities in code that reads JPEGs"? Well, that means you need to delete any JPEG which isn't known-good, And any other file for which similar vulnerabilities in decoding have been found. Or it's possible that the first thing that will happen on reboot is the user will email out this "kewl JPEG" to all their friends, forwarding the malicious payload in the process.
And you need to do all this without breaking anything in the process. Or else if you do, you might just as well have wiped and rebuilt the system.
Parent
Re:I don't even bother trying to clean them up. (Score:5, Informative)
What you described sounds similar to how signature/definition-based scanners work. I'm sure a lot of scanners make bootable versions - I know that older versions of McAfee came with a boot floppy.
Signature-based scanners are a glorified form of grep. They look through every file looking for a string of bytes which is reasonably unique to a virus. It's not possible to have a computer know in advance with 100% certainty whether executing a particular block of code is dangerous - the best you can do is say "this is probably dangerous", so realistically your options are:
1. Look for things which are known to be bad, delete any we find. Well, 20 years of antivirus should have taught us by now that this is a crappy solution.
2. Look for things which are known to be good. Anything which isn't known to be good we delete. This is essentially what I described originally.
The minor issue with this (and indeed with what I described) is that writing a general-purpose application which does this without leaving the system broken beyond real use (who's going to put up with an AV product which deletes every data file they've got because there have been known vulnerabilities in programs which read those files?) is impossible.
However, they do say an ounce of prevention is worth a pound of cure, and nowhere in IT is it more true than here. Don't allow users to run as admin, filter email for anything even remotely suspicious, configure your desktop PCs to automatically update, run antivirus on your fileserver to slow down the spread of anything, get proper configurable desktop AV software - preferably configurable such that end users can't easily mess with the configuration - and set it up to scan everything on access.
And while we're at it, abandon any email scanner which filters dodgy attachments on the basis of their file extension. The first virus which comes with text saying "Rename to
This sounds like a lot of work, but I've been in the middle of dealing with virus outbreaks before. Once configured, 99.5% of my suggestions can be just left to their own devices and it's a lot less hassle than dealing with a virus outbreak.
Parent
Killing rootkits. You're doing it wrong. (Score:5, Interesting)
The problem with finding and removing rootkits (and other forms of malware) is that the vendor of the OS does not provide any means of identifying what the LEGITIMATE files are.
With Ubuntu, I can boot from a LiveCD and check any file on my hard drive. What package does it belong to? Does it have the correct checksums?
Anything that cannot be identified can be moved to a different drive. A drive without run permissions.
Problem solved.
Parent
Re:Killing rootkits. You're doing it wrong. (Score:5, Insightful)
Parent
Re:Killing rootkits. You're doing it wrong. (Score:4, Insightful)
Run-timeLibraryOfGraphicsFunctionsForWord.DLL
Parent
Re: (Score:3, Insightful)
On windows? Try "everywhere". Some other poorly-named libraries that come to mind are libm.so and libiberty.so (as cute as gcc -liberty may be, it is a useless name from a functional standpoint). Or if you consider any file, what about any of the 3-letter UNIX-style directory names?
I would want to shoot any developer
Re: (Score:3, Insightful)
You're confusing "stupid" with "ignorant". An ignorant user will have to reinstall Word if he removes one of its DLLs. A stupid user will have to reinstall Word a second time when he removed the DLL after reinstallation.
The ignorant user will no longer be ignorant, and will think twice before removing said file.
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
What a title! (Score:5, Funny)
Dan Kaminsky, Director - Penetration Testing
If you think that's bad (Score:5, Funny)
Parent
Re: (Score:3, Funny)
Female: "What Is Your Job?"
Male: "Souffler Le Travail?, nah... how do you say... May I l'Insertion?
Re:What a title! (Score:5, Funny)
I wonder if promotion to the position came with a raise.
I heard he reports to the VP for Internal Affairs.
His responsibilities include data massage, internal handling of customers, and staff management.
I could do this all day...
Parent
Re: (Score:3, Funny)
Please, go on.
Re:What a title! (Score:5, Funny)
Performance review:
His performance metrics primarily include duration of uptime and average time need to recover from downtime. He has expanded the scope of his role to fill the requirements.
He is able to handle repetitive tasks well.
He does not think outside the box.
He is good at getting his workgroup to multitask.
His staff responds well to stress.
Work/life balance may be an issue -- he always makes his work come first.
I think that's enough for now
Parent
Re:What a title! (Score:5, Funny)
Parent
AV's actually doing quite well (Score:5, Insightful)
If you read TFA it says that some products were actually able to detect, though not remove, as many as 29 out of the 30 rootkits tested once they were installed.
That's far higher than I would have expected. I thought the whole idea of a rootkit is that it modifies/hooks the kernel to make detection from userspace practically impossible, so either they're using poor/outdated rootkits or the antivirus makers are actually doing a pretty good job of detecting them (gasp).
Personally I run virus scans from a clean windows PE disk on any windows machine I suspect to be infected anyway; partly because some malware is very good at hiding itself from the OS once it's installed, partly because it makes removal much easier, but I wouldn't read these results as being bad for (some of) the antivirus makers concerned, as the summary seems to suggest.
Re:AV's actually doing quite well (Score:5, Insightful)
It's an arms race. Since a rootkit is making the appearance of reality disagree with physical fact, there's always some way to detect the deception: for example, hidden disk usage could be detected by writing data to fill the disk, and then seeing if the amount of data written is equal to the apparently-free disk space. The latest antivirus software will detect these discrepancies; the latest rootkits will patch over whatever techniques the antivirus software is using.
Parent
Not really surpirsed (Score:5, Interesting)
Norton (keep in mind, last time I used it was half a decade ago, if not more) had a great habit of going "HEY! YOU'VE GOT A VIRUS!" but when you actually tell it to delete the bloody thing, it refused to do anything. What was annoying was that often you could delete it simply by killing the process, but I digress.
Every other AV I've used has been able to handle most, but to this day, every now and then a virus will come along that whatever AV I try simply can't shift, forcing me to do the ol' safe-mode delete trick (or sometimes having to boot into a different OS entirely).
I don't understand why these AV's don't pop up saying "we've found a virus, unfortunately it's going to be a pain to remove, so I can't do it for you, instead here's some instructions on what to do to get rid of it..." instead of just repeatedly popping up that the Virus is there and refusing to do anything about it....
Re:Not really surpirsed (Score:5, Informative)
It's funny, the embarrassing part here isn't that you look at porn, it's that you get infected while doing it. Get NoScript, a bittorrent client, and a clue.
Parent
Re: (Score:3, Informative)
I found the easiest way to get rid of that one (Because all the 3rd party tools to do it simply didn't work) was to bite the bullet and install unlocker [ccollomb.free.fr]. This piece of software is without a doubt my favourite utility for windows and one of the first things I install (when I'm running 32bit, that is, no 64bit support yet
Well, DUH! (Score:5, Informative)
First rule of system scanning: if your system is compromised, you can't trust anything running on it including the scanning software. Any malware that's gotten far enough in to be a threat can readily trap the system functions to load programs and read the disk and the system functions used to detect trapping of system functions, allowing it to invisibly return false data to the scanning program. This was standard practice in the late 80s for viruses, see the origin of the term "stealth virus". You can scan incoming files using a scanner running on the main OS but to scan the main OS for infection you need to be running from a different boot image, one that's never been made available in a writable state to the main OS. And no, that doesn't mean a different partition on the hard drive, that's writable by the main OS even if it's not directly available as a drive. The media has to have been physically write-protected or read-only any time it's been in the drive while the main OS is running.
Info - Anti rootkit tools (Score:4, Informative)
AVG Free 8.0 (free.grisoft.com) or AVG free antirootkit if they are using 7.5 free.
Hint: AVG 8 *removes* their old free antirootkit.
For techie users grab the sysinternals toolkit from majorgeeks etc. (Rootkit revealer). For real techies a copy of "Rootkit Unhooker LE" (rku.nm.ru) but (like Hijack This) hide this one from non techie users so they don't fiddle with it ...
(oh and beware some versions of daemon tools which use rootkit like functionality to hide their virtual cd driver).
Andy
Bootable ClamAV CD image... Ubuntu live CD? (Score:5, Interesting)
Once a root kit has its tentacles through your system, you can't trust your system. So it just makes sense to boot a trusted system before running a malware scan.
I know enough that I could boot an Ubuntu CD, make sure clamav is installed, update it to the latest virus definitions, mount each disk volume, and then run clamav by hand. But more people could use it if this was easier.
Originally I was thinking of a CD you boot just for virus scanning. But I already carry around an Ubuntu CD to use as a utility disk (you can boot it as a RAM tester, or you can boot to a desktop to help repair a non-booting computer). And if it finds any malware you will want to fire up a web browser and read about how to clean your system. So now I think the very best thing would be for the standard Ubuntu live CD desktop to have a "scan computer for viruses" icon. Ideally it should have some kind of attractive GUI interface, but I'd settle for a scrolling text display as long as it does everything automatically.
Ideally this would also have a way to download a signed program, verify the signature, and run the program; then people could write programs that automatically clean malware off a computer.
I already give away Ubuntu CDs to friends who use Windows, and I tell them how to use them to test their RAM. It would be so cool if they could also use it to check their computers for malware. (Who knows, they might get tired of cleaning malware off their computers and try running Ubuntu someday.)
Is there any way to suggest this as a "summer of code" project or something?
steveha
Re:Bootable ClamAV CD image... Ubuntu live CD? (Score:5, Informative)
http://www.ultimatebootcd.com/ [ultimatebootcd.com]
http://www.ubcd4win.com/ [ubcd4win.com]
Both have excellent tools on them, including some UPDATABLE AV kits.
Parent
A compromised system can't diag/fix itself (Score:3, Informative)
Sometimes it happens to work. If it does, you're lucky. But you can't rely on it, and you never will be able to, and anyone who sells you a product that says it can do that, is deceiving you.
Don't execute the rootkit in the first place. That's the only way to be sure. Once you've run untrusted code, your system is compromised until you boot from read-only media.
Sorry if you don't like hearing that. Sorry if it's inconvenient. Sorry if you're an AV company stockholder and you don't want people to know. But that's just how it is, period.
And when you look at it that way, today's rootkits are actually really easy to kill; you just have to go "far enough" (e.g. nuke the whole damn partition). (I have to say "today's rootkits" because if your BIOS is flashable, well, you've got serious problems.)
no shit? (Score:3, Insightful)
Any half-competent root-kit will simply tell the scanner what it wants to hear via hooks into the O/S to trap any "diagnostics" that it may perform.
The trick is not not get infected in the first place - once your PC *is* infected, you're fucked. Do not pass go, do not collect $200. Reinstall time - nothing on your box can be trusted any more.
The sooner people "get" this, the better off they'll be.
Re:Naturally, (on first) (Score:4, Informative)
Parent
Re:Bootable antivirus discs? (Score:5, Informative)
Parent
Re: (Score:3, Interesting)
I haven't looked at Windows antivirus products in a few years, but all antivirus products used to do this. Originally, it was a boot floppy; later, a boot CD. The neccessity of an internet connection to get the latest virus definitions would make this harder these days, as you'd need to support an incredible variety of network cards.
Re: (Score:3, Insightful)
Re:Bootable antivirus discs? (Score:4, Informative)
It is not totally burn and go, thanks to Microsoft and the EULA, but very close. I was just updating my images today, as a matter of fact. Several clients have the latest "It burns when I pee" support calls scheduled.
Parent
System Rescue CD does (Score:3, Informative)
I'm sure there is a LiveCD distro out there that comes with ClamAV.
System Rescue CD [sysresccd.org] does include ClamAV [clamav.org] among lots of other useful tools [sysresccd.org].
It's mainly a boot disk geared toward partitioning and hard disk recovery (helped me save a b0rked FakeRaid), but it has lots of tools to help rescue & repair a broken system.
It has ntfs-3g, so you can read and write Windows partitions.
It also has chkrootkit [chkrootkit.org] (but apparently not rkhunter [sourceforge.net]) so you can also scan Linux boxes for rootkits.
Speaking about ClamAV, sadly that anti-virus isn't mentioned anyway in the AV-test.org publication [av-test.org]. I
Re: (Score:3, Funny)
We're screwed."
No way. Not with my new Chuck Norris(TM) brand anti-rootkit software. Not only does it find the rootkit and get rid of it, but it first makes it cry and beg for it's life needlessly.