Rootkits: How to Protect Yourself | Antivirus

     What you should know about rootkits

 An idea that shivers down your spine: your computer may right now be full of viruses and malware, and may even be connected to a botnet used to carry out cyber attacks and click fraud. large scope. If so, you absolutely won't notice. Because in most cases, a rootkit will make the user believe that everything is in order: the rootkit works a bit like a magic cloak under which all kinds of criminal activities take place invisibly. But if you know the risk of rootkits and how they work, you can better protect yourself. Below are the main things to know about rootkits.

What is a rootkit? Definition

By rootkit, we are not referring to unsystematic malware. It's a whole set of malicious programs that have managed to get into your computer by exploiting a security flaw that gives it Remote access , thus allowing the rootkit to be manipulated remotely as well. One of the peculiarities of the rootkit is to be able to hide itself, but also to conceal other malicious programs, and to make them undetectable by antivirus programs and other security solutions, to the point that the user is unaware of their existence .

Depending on the level of the system where the rootkit is installed, the attacker will be able to gain important administrator rights (in this case we speak of a kernel-mode rootkit) and thus gain unlimited control of the computer

 Definition

A rootkit is a collection of several pieces of malware that has entered multiple levels of a computer, which masks virus and malware activity, making it easier to access and monitor the system for subsequent events.

The first rootkits appeared in the early 90s and initially primarily targeted Unix-based operating systems, such as Linux systems. They were mainly composed of modified programs, such as for example "ps" (a Unix command allowing to launch a whole series of processes) and "passwd" (to modify the user's password). This is where their name comes from: The word "  Root  " designates at Unix the Administrator , and the word "  kit  " means "  Equipment  " or "  Toolbox. ". The compound word Rootkit therefore designates a set of software utilities that allow a hacker to gain administrative rights on a computer (in other words, kernel-mode rootkits).

In the meantime, rootkits have appeared that can affect all operating systems. Rootkits now affect Windows systems like any other operating system: Some rootkits manage to penetrate into the kernel , that is to say the internal kernel, and therefore at the "root" (in English: "root") of the system, where they develop their business.

How do rootkits work?

While there are a variety of rootkits out there, they generally have a common mode of operation . The way they enter the system also follows the same modus operandi.

Step 1: system contamination

A rootkit infection is usually preceded by some sort of Social Engineering  : Cyber ​​criminals exploit the weakest part of the security system, the human factor, to do this . By influencing or knowingly deceiving their victims, hackers often succeed in extracting their access data and passwords. With this data, they connect to the computer and install the rootkit there.

You can also get infected with a rootkit in other ways, for example by driving-by-downloads on an infected website, downloading software from an unverified source or clicking on a link. or on an attachment in a phishing email.

Another method is for a cybercriminal to leave a USB key containing a rootkit lying around in a strategic location . Someone finds this key and takes it home with them, curious to see what's in it. Once the key is plugged into his computer, contamination takes place. This is how " Evil Maid Attacks  " type attacks are carried out  where the hacker installs the rootkit himself on a computer left unattended. This method owes its name to the scenario of asking a maid in a hotel to contaminate the laptops of several hotel guests.

Stage 2: Stealth Mode

Once introduced into the system, the rootkit hides its existence. To do this, he begins to manipulate all the processes, swapping the data of programs and system functions. In this way, an antivirus program that will do a scan will obtain false information , in which all the indications indicating the presence of the rootkit will have been deleted. This is why it is sometimes impossible, even for the largest antiviruses, to detect these malicious programs by means of their signature or their behavior (heuristics).

Step 3: setting up a backdoor

To continue, the rootkit creates a “Backdoor”, a backdoor in the system, which the hacker can use by means of a spied password or a typo to be able to gain remote access to the computer . The job of the rootkit is to conceal all connections and suspicious activity.

The hacker thus has the possibility of installing other software, such as Keylogger, for example, to spy on what you type on the keyboard with Spyware, to steal data or (depending on the level and rights) to change your system settings . Quite often, computers infected with a rootkit are linked to botnets to be used for phishing or DDoS (denial of service) attacks .

What is the difference between rootkits and other malware?

For obvious reasons, rootkits are also called stealth viruses, although they are not officially categorized as viruses . But what exactly sets rootkits apart from other malware?

Viruses  : a virus attaches itself to an executable file or to a program (generally to a file with the .exe extension). It is certainly capable of replicating itself, but it cannot propagate itself. To do this, it needs the assistance of someone or other software.

Worms  : Worms are a sub-category of viruses capable of self-reproducing using data transfer functions within a system.

Trojans  : These are not viruses, but malware, that is, malicious software that masquerades as useful applications. Hackers use Trojans to open back doors in the system.

Rootkits: The rootkit is also described as a subcategory of Trojans. Several Trojans have the same characteristics as rootkits. The main difference is that rootkits deliberately hide in the system and help the hacker to gain administrator rights.

What types of rootkit are there?

Rootkits are distinguished primarily by the method they employ to camouflage malware processes and hacker activities. Most often these are kernel-mode or user-mode rootkits. These particularly dangerous toolkits are constantly being developed by cybercriminals , and it is increasingly difficult to protect against their actions.

Kernel-mode rootkits

When we talk about rootkits, we are usually referring to this type of rootkit. Kernel-mode rootkits slip into the operating system kernel . This zone, also called "ring 0" is the zone where you have the most privileged access rights, and which allows you to access all the hardware components, but also to modify the parameters of the system. Concretely: if a hacker succeeds in placing a rootkit there, he is able to take control of the entire system.

Such rootkits replace parts of the kernel with their own code. In the case of Unix-based operating systems, this is usually done by means of kernel modules which are downloaded later, hence the term "LKM Rootkits" (short for loadable kernel modules). In Windows systems, the kernel is usually manipulated directly, by introducing new system drivers into it. Whatever the procedure: the kernel-mode rootkit can exploit its privileged position to transmit false information to the antivirus program on the computer. Rootkits of this type are therefore difficult to detect and eliminate. Due to their complexity, they are also quite rare.

 Advice

Due to their complexity, kernel-mode rootkits are very vulnerable to programming errors, which can sometimes make a system that has been infected very unstable. In this case, the user will eventually notice that malware is installed on their computer, especially due to the numerous "blue screens" and system crashes.

User-mode rootkits

Unlike kernel-mode rootkits, this other type of rootkit is implemented at the user level of the computer , where all the programs to run are located. As this domain is the lowest level of the CPU (ring 3), user mode rootkits can only assign restricted access to the attacker. However, their structure is less complex and they are found more often than kernel-mode rootkits, especially in Windows environments.

User-mode rootkits camouflage themselves by detecting the exchange of data between the operating system and the security and antivirus programs installed on the computer. To do this, they use the DLL-Injection and API hooking  methods : a specific software library (Dynamic Link Library, abbreviated as DLL) slips into the data exchange and hijacks the functions of certain software interfaces (Application Programming Interfaces, abbreviated as API) to the rootkit. It thus manages to erase its own traces in process lists, such as those of the Windows task manager.

Other rootkits

In addition to these two types of rootkits, there are others, but which present less dangers:

Application rootkits  : this is the primitive and initial form of rootkits. They replace system programs with their own modified programs, and are therefore easily detectable. This is the reason why hackers hardly use them anymore.

Memory rootkits  : such rootkits exist only in RAM memory, and therefore disappear from the system on each restart.

Evolution of rootkits

Like most malware, rootkits are in constant development. Thus, for example, “  Bootkits  ” appeared, a kind of kernel-mode rootkit whose specialty is to replace a computer's boot loader to deactivate the operating system's security mechanisms. Cell phones (especially those running Android) are also increasingly infected, most of the time when downloading an uncertified application. We speak in this case of "  mobile rootkit  ".

In 2006, researchers from the University of Michigan made the talk, by making part of their project entitled Project SubVirt  : a rootkit implanted in a virtual machine, hence the name VMBR (Virtual Machine Based Rootkit) . This type of machine is usually used in order to be able to install several operating systems (for example Linux and Windows) on a single computer. Using this technology, the VMBR had to be able to implement an operating system in a virtual environment, and then act in a completely concealed manner. A year later, researchers at Stanford University claimed to be able to detect VMBR without any difficulty.

Since then, it does not seem that we have had any major innovations in terms of rootkits, which does not mean, however, that the risks have diminished. For example, the RIG Exploit-Kit gave birth in 2018 to a new rootkit called CEIDPageLock . This is introduced into Windows operating systems via certain drivers and takes control of the computer through your Internet browser . It then redirects the user to fake sites where all kinds of data extortion for criminal purposes are practiced. Currently, it is mainly computers in China that are affected (data from August 2018). Experts believe, however, that this malware will spread beyond these borders.

 Note

Exploit-Kits (from the English word “exploit”) contains a set of tools that target security vulnerabilities in widely used applications, such as Adobe Flash, Java, and Microsoft Silverlight. With its 27,000 infections per day, RIG is currently the most active Exploit-Kit.

Examples of known rootkits

Rootkits have been identified for different operating systems. Below you have two examples of rootkits that affect Windows environments:

TDSS aka Alureon (discovered in 2007) is classified as a Trojan horse, which says a lot about the proximity between these two types of malicious applications. The rootkit manipulates the Windows registry, and disables for example the task manager, the update function, even the antivirus programs that are installed, and then sets up a botnet.

ZeroAccess (discovered in 2011): another Trojan horse with rootkit attributes. This infects the Master Boot Record (MBR) (boot zone) as well as a random system driver, and in the process deactivates the Windows Security Center, Windows Defender and the firewall . Once this is done, the computer is integrated into a botnet, which is used for Bitcoin-Mining and click fraud .

However, rootkits are not always used for such extensive criminal activity. Some CD emulators employ this technique to bypass title protections. Whether it is legal or objectionable will depend on how it is used and the volume of files read of that kind.

It is not just consumers who flirt with the legality of copyright by means of rootkits: In October 2015, the Japanese group Sony sparked a major scandal, when it was found that the XCP protection (Extended Copy Protection) of several music CDs from the supplier had been camouflaged by a rootkit. The group wanted to prevent the illegal reproduction of its CDs. The malware took the opportunity to provide Sony with information about the musical tastes of its customers, thus violating the General Data Protection Regulation. Criticism of Sony was particularly harsh because rootkits concealed their presence from antivirus programs, thus opening doors for hackers to take advantage of them at their convenience.

Similar cases, for example that of the company Kinowelt in 2006, made IT experts say that it would not only be hackers who would use rootkits in the future ,but also large groups.

How can you protect yourself against rootkits?

Since camouflage is a rootkit's specialty , it is usually difficult, if not impossible, to detect and remove it. However, there are a few measures to improve your protection:

Prevent contamination

The steps to avoid rootkits are the same as for all other malware  :

Install security software on your computer.

Maintain your system well with regular updates .

Develop a critical mind for all forms of Internet scams , such as phishing .

Use strong passwords .

There are still some more specific tips to protect against rootkit infections:

Advice for computer beginners  : use your administrator account as little as possible, and especially not when you are on the internet. The administrator account is much less protected than the ordinary user account. The original user account having restricted rights, you will limit the damage in case of infection by a rootkit.

Advice for the pros  : to prevent a rootkit from contaminating your BIOS, and making it almost impossible to remove, it is possible to add physical protection blocking write access to your BIOS. This is a jumper that is inserted into the main board.

Identify a rootkit

Most antivirus programs scan for known rootkits by their signatures and seek to identify new ones by scanning for special behaviors, such as file deletion. The Problem: Unless you are faced with a poorly programmed kernel-mode rootkit that spawns repeating blue screens and catches your eye, most rootkits wo n't let anything filter their presence in your system .

As rootkits are subject to ever more sophisticated programming, it becomes more and more difficult to find them. However, we have technical tools, specially designed to attack rootkits: rootkit scans . This function is integrated in several security solutions, but it also exists as a program dedicated to this function. These include Sophos Anti Rootkit and Bitdefender Rootkit Remover , two tools available for free.

Such a rootkit scan can also be performed from a boot CD . Such a CD will start your computer without paying attention to the installed operating system. The rootkit will therefore remain inactive, which may allow an antivirus on the CD to detect it.

Remove a rootkit

Unfortunately, there is no 100% reliable solution to removing a rootkit from your computer. Even professional antiviruses like Antivirus, miss several rootkits if we are to believe many test reports. And even this method is not always effective in dealing with rootkits that are deeply hidden in the BIOS. 

To conclude: the risk remains

Rootkits are a difficult threat to counter, and can open the door for criminals to take over your computer. Becoming aware of this risk is taking a first step towards greater security. The main security measure is often to prevent system infiltration, because rootkits are difficult to detect, and even more difficult to eradicate. The remedy is often to reinstall everything.

At the "Black Hat" convention in January 2006, it was even reported that rootkits were able to survive formatting a hard drive - after having manipulated the ACPI (Advanced Configuration and Power Interface) that manages the power supply of the hard drive. 'a computer, or by logging into the BIOS of the machine. As long as a reliable solution to these problems has not been found, rootkits will remain dangerous and ultra-complex tools in the hands of cyber criminals.