Rootkits What are they? What do they do? Where do they come from?

Introduction Bill Richards Bill Richards Adjunct Professor at Rose Since 2004Adjunct Professor at Rose Since 2004 Defense Information Systems Agency Defense Information Systems Agency Defense Enterprise Computing Center – Oklahoma City (Tinker AFB) since 1995Defense Enterprise Computing Center – Oklahoma City (Tinker AFB) since 1995 Network Security Officer since 2002Network Security Officer since 2002 Responsible for the security for 9 remote networksResponsible for the security for 9 remote networks 45+ Mainframes (IBM, UNISYS and TANDEM) 45+ Mainframes (IBM, UNISYS and TANDEM) Mid-Tier Servers (UNIX and Windows) Mid-Tier Servers (UNIX and Windows) 400+ Network devices (Cisco, Juniper, Sidewinder, BigIP, etc) 400+ Network devices (Cisco, Juniper, Sidewinder, BigIP, etc)

Rootkits are a serious threat to network and system security and most administrators know little about them Defining characteristic is Stealth Viruses reproduce but rootkits hide! Difficult to detect Difficult to remove Carry a variety of payloads Key loggers Password Sniffers Remote Consoles Back doors And more!!!

What is a Rootkit? The term rootkit is old and pre-dates MS Windows The term rootkit is old and pre-dates MS Windows It gets it’s name from the UNIX superuser UserID - - root It gets it’s name from the UNIX superuser UserID - - root aka administrator for windoze users aka administrator for windoze users A rootkit does not typically not cause deliberate damage A rootkit does not typically not cause deliberate damage

What is a Rootkit? A collection files designed to hide from normal detection by hiding processes, ports, files, etc. Typically used to hide malicious software from detection while simultaneously collecting information: userid’s Password ip addresses, etc Some rootkits phone home and/or set up a backdoors

What is a Rootkit? A rootkit does NOT compromise a host by itself A vulnerability must be exploited to gain access to the host before a rootkit can be deployed The purpose of a rootkit is NOT to gain access to a system, but after being installed, to preserve existing access and support the goals of the bad guy

Recent Rootkit History Source:

Rootkit History 1998 to 2002 Source:

How rootkits work A vulnerable system is detected and targeted A vulnerable system is detected and targeted unpatched, zero-day exploit, poor configuration, etc. The targeted system is exploited host via automated or manual means Root or Administrator access is obtained Payload is installed Rootkit is activated and redirects system calls Prevents the OS from “seeing” rootkit processes and files EVEN AFTER host is patched and original malware is removed

How rootkits work docs rootkit windows dir c:\ ReadFile() NTFS command C:\ windows rootkit docs Rootkit DLL rootkit filters the results to hide itself docs windows DLL “tricked” into thinking it can’t execute command, calls rootkit

Hacker Defender (Hxdef) A rootkit for Windows NT 4.0, Windows 2000 and Windows XP Avoids antivirus detection Is able to hook into the Logon API to capture passwords The developers accept money for custom versions that avoid all detectors FU Nullifies Windows Event Viewer Hides Device Drivers Recently added “Shadow Walking” (Read Phrack63) Common Windows rootkits

Common UNIX rootkits SucKIT SucKIT Loaded through /dev/kmemLoaded through /dev/kmem Provides a password protected remote access connect-back shell initiated by a spoofed packetProvides a password protected remote access connect-back shell initiated by a spoofed packet This method bypasses most of firewall configurations)This method bypasses most of firewall configurations) Hides processes, files and connectionsHides processes, files and connections Adore Adore Hides files, processes, services, etc.Hides files, processes, services, etc. Can execute a process (e.g. /bin/sh) with root privileges.Can execute a process (e.g. /bin/sh) with root privileges. Controlled with a helper program avaControlled with a helper program ava Cannot be removed by the rmmod commandCannot be removed by the rmmod command kis kis A client/server system to remotely control a machine, with a kernel rootkit as the server on the remotely controlled machineA client/server system to remotely control a machine, with a kernel rootkit as the server on the remotely controlled machine It can hide processes, files, connections, redirect execution, and execute commands.It can hide processes, files, connections, redirect execution, and execute commands. It hides itself and can remove security modules already loadedIt hides itself and can remove security modules already loaded

Detection & Removal Detection that doesn’t always work: Antivirus (Norton, McAfee, AVG, etc.) Anti-Spyware (AdAware, Giant, Spybot, etc.) Port Scanning Manually Looking Detection that can work: Sudden System Instability/Sluggishness Sudden Spike in Traffic MS RootkitRevealer F-Secure Black Light

“list running processes” Rootkit “nothing to see here” Compromised OS “Online” detection (ex: virus scans) relies on the OS’s API to report files and processes. The API has been “hooked,” however, so the rootkit remains concealed. Detection & Removal

“list running processes” Rootkit “something found” Compromised OS Detection compares the results of the OS’s API with the results of a clean API (Raw) provided by the tool. Discrepancies are potentially rootkits Black Light Rootkit Revealer Etc. “nothing found” Results != Possible Rootkit Detection & Removal

“list running processes” Rootkit “rootkit detected” Compromised OS Doing an “Offline” detection with a different OS to report files and processes. If the alternate OS is clean, the rootkit will be detected. Knoppix WindowsPE W.O.L.F. Etc. Detection & Removal

Only 100% sure removal: Only 100% sure removal: Format drive and a clean installFormat drive and a clean install Some tools can remove some rootkits Some tools can remove some rootkits But what was hidden may not get cleanedBut what was hidden may not get cleaned You cannot trust a system that’s been rootkit’edYou cannot trust a system that’s been rootkit’ed Passwords on the rootkit’ed system are suspect Passwords on the rootkit’ed system are suspect So change your passwords on the clean hostSo change your passwords on the clean host Detection & Removal

Prevention Keep hosts updated Keep hosts updated OSOS ApplicationsApplications Limit host exposure Limit host exposure Un-needed servicesUn-needed services Use Firewalls Use Firewalls Situational Awareness Situational Awareness CERT, Bugtraq, Security Web sites, etc.CERT, Bugtraq, Security Web sites, etc.

Some Reference Sites Questions?