NWA-PCUG Newsletter Article, July 2005
Another Silent Attack on Our Computers
by Ira Wilsker,
APCUG Director; Columnist,
The Examiner, Beaumont, Texas’ Radio Show Host; Police Officer


WEBSITES:
http://research.microsoft.com/rootkit
http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml
http://www.f-secure.com/blacklight
http://www.f-secure.com/blacklight/rootkit.shtml

At the recent computer security symposium in Corpus Christi, one of the speakers mentioned something that I was vaguely aware of as a threat. The threat is considered as a silent attempt to invade our computers for the purposes of installing viruses, Trojans, worms, or other malware devices. This silent threat may be used by terrorists to launch a coordinated attack on our infrastructure, steal our personal information, or otherwise wreak havoc. So insidious is this threat that it would sound like the content of an urban legend, yet it is documented as real. Imagine a threat that would be undetected by the current antivirus, firewall, and anti-spyware software, yet be so powerful as to effectively take over our computers, without our knowledge. This threat, formerly considered solely as an unproven concept, is now known to be real. This threat is also now implicated in taking over countless computers. This contemporary threat is known by the innocuous term “Rootkit”.

A rootkit is defined on the Sysinternals website as, “ … the mechanisms and techniques whereby malware, including viruses, spyware, and trojans, attempt to hide their presence from spyware blockers, antivirus, and system management utilities. There are several rootkit classifications depending on whether the malware survives reboot and whether it executes in user mode or kernel mode.” The security software company F-Secure expands the definition with, “Rootkits for Windows work in a different way and are typically used to hide malicious software from for example an antivirus scanner. Rootkits are typically not malicious by themselves but are used for malicious purposes by viruses, worms, backdoors and spyware. A virus combined with a rootkit produces what was known as full stealth viruses in the MS-DOS environment.”

Because rootkits are currently very effective at hiding malware from our antivirus and anti-spyware scanners, it is quite possible or even probable that our computers are infected, despite repeated scans with properly updated software.

Microsoft, and other vendors, have acknowledged the threat and are now beginning to produce software that can detect and destroy the rootkits on our computers. The software is still in its infancy, and lacks the ease of use, automation, and attractive graphical interfaces that we are used to with our antivirus software. It is inevitable that as word of the rootkit threat spreads, and more computers are identified as having stealthy rootkits hiding viruses and other threats, that the small current crop of rootkit detecting software will improve, and other competitors, probably the major antivirus vendors, will join the fight. If rootkit technology continues to spread, the current crop of generally excellent computer security suites from the likes of Symantec (Norton), McAfee, Panda, TrendMicro, and others will be forced to add rootkit protection to their respective suites, or face competitive obsolescence.

Fortunately for us, there are a few rootkit detectors already available, mostly for free! This first generation of products still needs much refining to enable the average person to scan for rootkits with ease, but they are still a very good first step. There are a few rootkit detectors available which are currently free. One “RootkitRevealer” is from a company known for its excellent and often free software, Sysinternals. This software uses a patent-pending technology to detect rootkits, and is currently available for download at www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml. RootkitRevealer will run on almost any Microsoft operating system, NT4 and later, which includes Windows 2000, and XP.

Another rootkit detector is from F-Secure, a well-known computer security company headquartered in Finland, with offices in the US and elsewhere. F-Secure’s product is “Blacklight”, available as a free beta (pre-release) version until July 1. Blacklight can be downloaded at www.f-secure.com/blacklight.

I have recently tried both products, and I personally found Blacklight the easier to use. It seemed effective at detecting and eliminating rootkits.

Microsoft will shortly be making available its rootkit detector, the “Strider GhostBuster”, details at research.microsoft.com/rootkit.

Persons unknown who wish to do us harm, either at a personal level such as stealing our account information and committing the crime of identity theft, or the impersonal level, such as cyber terrorists intent on shutting down our critical infrastructure, may use the rootkit technology to bypass our otherwise necessary defenses.

Until such time as the integrated computer security suites catch up with this threat, I will now have to add a rootkit detector to my recommended list of essential computer security utilities, alongside antivirus software, a good firewall, and a spyware detector. It is also imperative that all four of these utilities be frequently updated to ensure a reasonable degree of personal security. We will also have to add rootkits to our vernacular of cyber threats, along with the now ubiquitous terms “virus”, “spyware”, and “hacker”.

I shudder to wonder what may be coming down the pike next.

There is no restriction against any non-profit group using this article as long as it is kept in context with proper credit given the author. The Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member, brings this article to you.

Click here to return to top



==================================================================