Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Rootkits evade hardware detection

Even the most reliable detection methods aren't that reliable, it turns out.

Article comments

Security researcher Joanna Rutkowska has demonstrated several methods that sophisticated rootkits can use to hide from even the most reliable detection method currently available - hardware-based products that read a system's RAM.

Rutkowska is a researcher with security firm Coseinc Advanced Malware Labs. She recently outlined several ways of getting around the User Account Control (UAC) feature introduced in Windows Vista. Several researchers have identified problems with UAC.

The demonstration, given at the Black Hat security conference in Arlington, Virginia, indicates that if a rootkit is advanced enough, there currently is no way it can be reliably detected, Rutkowska said. Rootkits are designed to hide some activity from observers, and have recently been used to conceal the presence of Trojans and hacker backdoors - not to mention Sony BMG's copy-protection software.

Several hardware-based systems exist for acquiring an image of a computer's RAM, the most reliable way to detect the presence of certain kinds of rootkits, Rutkowska said. Those include Tribble, Komoku's CoPilot and RAM Capture Tool from BBN Technologies, but she said none are particularly easy to find.

Rutkowska's findings mean system designers may need to come up with a system architecture better suited to forensic analysis, such as an interface dedicated to memory acquisition.

"We live in the 21st century, but apparently can't reliably read the memory of our computers," she said at the presentation. "Maybe we should rethink the design of our computer systems, so that they were somehow verifiable."

Rutkowska's presentation outlined three types of attacks, one that crashes the machine when RAM acquisition is attempted, a "covering attack" that allows the acquisition tool to see only garbage when it inspects certain parts of physical memory, and a "full replacing attack" that allows the tool to see false information when it scans parts of physical memory.

The denial-of-service attack could leave investigators legally liable for crashing the system, Rutkowska said.

The "covering attack" might allow investigators to see the malware's "hooks" in some cases, but would make it impossible for investigators to analyse the malware. And the "full replacing attack" could simply mean that the malware is never detected at all, she said.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *