Staying one step ahead of the intruders
Blue Pill Detection
The latest trend is virtualized rootkits. A virtualized rootkit works like a virtual machine: The first step is for the rootkit to modify the boot process so that a virtual machine is loaded before the operating system. The operating system you think is running on the hardware actually boots in a virtual machine. This gives the rootkit total control over the computer without the operating system or the user noticing a thing. This approach was demonstrated by Blue Pill , which explains why the process of identifying virtual rootkits is known as Blue Pill Detection.
Rootkits are very difficult to detect once they are installed on your system. Before they install, however, you can identify them with anti-virus programs and rootkit scanners (or rootkit detectors), which use signatures or heuristics to identify the culprits.
The best way to stop a rootkit is not to let it in. The articles in this issue discuss some techniques for shutting out intruders before they get comfortable.
In spite of all your efforts, however, you will never be safe enough to ignore the possibility of a rootkit slipping past your defenses. The following sections discuss some strategies for rooting out rootkits.
To Build, or Not to Build
Administrators are asked to build most rootkit scanners before they can use them. As you can imagine, this is a problem if the rootkit already has a stranglehold on your system. In this case, the compiler may already have been compromised by the rootkit, and would build a manipulated version of the scanner. For this reason, you should try to build the scanner as soon as possible after installing the system, or use a system that you know is clean.
Because the results on a running system are not entirely conclusive, you should down the suspect and then boot from a medium that you know is clean. This could be a rescue disk, for example. The real test is to cross check any suspicious files with files from a clean system. This is usually accomplished by comparing the current system with a snapshot of the system taken directly after installation. To prevent the rootkit from affecting the results of the comparison, store the original snapshot on a read-only medium.
Of course, a backup of a complete system takes significant disk space. As an alternative, you could just create checksums for an integrity check. To do this, the rootkit scanner calculates a fingerprint for each file; if the rootkit later attempts to manipulate the file, the checksum is automatically changed and will thus not match the original checksum stored at the time of the last upgrade.
Buy this article as PDF
Azure CTO says Redmond has already considered the unthinkable.
Lead developer quells rumors that the Debian version is slated for center stage.
MSBuild is now just another GitHub project as Redmond continues its path to the light.
Malware could pass data and commands between disconnected computers without leaving a trace on the network.
New rules emphasize collegiality in coding.
Upstart lands in the dust bin as a new era begins for Linux.
HP's annual Cyber Risk report offers a bleak look at the state of IT.
But what do the big numbers really mean?
.NET Core execution engine is the basis for cross-platform .NET implementations.
The Xnote trojan hides itself on the target system and will launch a variety of attacks on command.