Taking a lesson from stealthy rootkits

Abstract

A fter breaking into a system, attackers usually install rootkits to create secret backdoors and cover their tracks. Unlike the name implies, rootkits don't provide root access. Instead, they arm attackers with stealth on already compromised systems. Stealthy operations hide processes, files, and connections that let an attacker sustain long-term access without alerting system administrators. (See the "Rootkit 101" sidebar for more details on rootkits.) Fortunately, most rootkits suffer from a lack of covertness and secrecy within their binaries. This lets administrators with access to the binary, or kernel, memory, analyze it for suspicious string and symbol characteristics. They can extract the strings and symbols and determine what attackers are doing to their systems. Unfortunately, attackers can avoid analysis by using code-obfuscation techniques that make it difficult for system administrators to detect and analyze kernel rootkits. Merely looking at symbol-table and text-segment information, which contains function names, variables, and strings contained in a program, provides valuable insight into rootkits (and even nonmalicious programs) that do not employ obfuscation. In this article, we show how software developers can use obfuscation techniques to fight attackers who reverseengineer or illegally distribute commercial-software.

The Evolution of Process Hiding Techniques in Malware - Current Threats and Possible Countermeasures

“…This means that DLL-or EXE-files, which hold the binaries of the Windows API such as ntdll.dll, ntoskrnl.exe, etc., are replaced with malicious code [47]. An advanced level on reverse engineering is required to alter official binaries correctly without destroying necessary routines and data structures, especially when it comes to kernel binaries.…”

SilentKnock: practical, provably undetectable authentication

“…While our definition implies that having access to the network device will not reveal the presence of the service to unauthorized users, it does not prevent users from exploiting other operating system tools. We note, however, that this is an orthogonal issue and a variety of techniques are known for this purpose [24,25].…”

Rootkits and Their Effects on Information Security

“…According to Ring and Cole (2004), there are two major categories of rootkits: user level and kernel level. User-level rootkits are often combined with Trojans into one category because they operate by placing a Trojan horse within applications.…”

“…This lets administrators with access to the binary, or kernel, memory analyze it for suspicious string and symbol characteristics. They (administrators) can extract the strings and symbols and determine what attackers are doing to their systems" (Ring and Cole, 2004). Levine et al (2005) contends that identifying rootkits requires a more accurate system of classifying the different types.…”