gHacks technology news » rootkits

Check for root kits with rkhunter

Jack Wallen — Wed, 29 Apr 2009 20:46:46 +0000

Security means everything when it comes to your data. And for many, doing everything that is possible is still not enough. For most the checking ends at viruses, malware, and portscans. To think this is enough is a mistake. Rootkits are some of the most dangerous security threats around. No matter what your server OS, it is crucial to make sure there are no rootkits tucked away on your servers.

Those Linux servers you have chugging away need rootkit checks as well. Fortunately there is a simple tool to help you in your quest for server security nirvana. This tool is Rootkit Hunter. It’s easy to install, easy to use, checks deep into your system, and offers outstanding reporting.

Rootkit Hunter supports all Linux distributions and most BSD distributions. Rootkit Hunter will test your system against:

MD5 hash comparisons
Default files used by rootkits
Incorrect binary filepermissions
Suspected strings in LKM and KLD modules
Hidden files

RKhunter can also do optional scans within plaintext and binary files for even more complete checks.

Installing

Most distributions will include rkhunter in their standard repositories so you should be able to locate it with your Add/Remove Software utility. Open this tool up, do a search for “rkhunter”, select the results, and apply the changes. Once rkhunter is installed you are ready to check.

Usage

Rootkit Hunter is a command line tool so you will first need to open up a terminal window. You will need root access to run the command. The basic usage is:

rkhunter [OPTIONS]

A basic check is issued like so:

rkhunter –check

As the check runs you will see output like this:

Checking the network…

Performing check for backdoor ports
Checking for UDP port 2001                               [ Not found ]
Checking for TCP port 2006                               [ Not found ]
Checking for TCP port 2128                               [ Not found ]
Checking for TCP port 14856                              [ Not found ]
Checking for TCP port 47107                              [ Not found ]
Checking for TCP port 60922                              [ Not found ]

Performing checks on the network interfaces
Checking for promiscuous interfaces                      [ None found ]

[Press to continue]

As each portion of the test completes you will have to hit enter to continue on to the next portion. A very nice feature of rkhunter is you know, as the test runs, if you do or do not have a root kit on your machine. During the group and accounts check on a Fedora machine I came across this:

Performing group and account checks
Checking for passwd file                                                 [ Found ]
Checking for root equivalent (UID 0) accounts            [ None found ]
Checking for passwordless accounts                              [ None found ]
Checking for passwd file changes                                  [ Warning ]
Checking for group file changes                                     [ Warning ]
Checking root account shell history files                       [ OK ]

A warning should be examined, but in this case it is no root kit.

Once the test runs the results will be quite clear. The most telling section of the results is:

Rootkit checks…
Rootkits checked : 68
Possible rootkits: 0

This machine is clear.

There are other options for testing. One particular option you should run every so often (maybe even creating a cron job for it) is the –update option. This option checks to see if there is a later verion of rkhunters’ text data files. This is critical especially when new (or new versions) of root kits are released into the wild.

Final Thoughts

If you are serious about security, and you have a Linux machine on your network, make sure you install rkhunter and use it often. You and your network will remain happy and healthy.

Tags: Linux, rkhunter, root kits, rootkits

Rootkit Detection Software Codewalker

Martin — Wed, 29 Apr 2009 11:17:49 +0000

Most computer users remember rootkits from the Sony BMG scandal a few years ago where the company installed rootkit like features on computer systems that were distributed with several of their music CDs. Rootkits are still not considered a huge threat by many. It is more likely to get infected by a computer virus or trojan than by a rootkit. Rootkits have been designed to hide on a computer system to prevent detection by normal security programs and system tools which makes them dangerous.

Codewalker is a rootkit detection software that has been developed by a member of the Sysinternals forum. The current version that has been released today is 0.24b which clearly outlines that the software program is a work in progress. It is a portable software that can be run from the local drives or removable devices.

The security program suggests a deep scan of the computer system upon startup which takes a few minutes to complete. It is possible to avoid this deep scan which will lead directly to the main program interface. The main interface uses tabs to display various information including system processes, hidden code, kernelmode and usermode hacks.

The connected disk drives are displayed on the right side with the option to select some or all of them for a scan. The same scan that was suggested upon program start will then be performed. The results are shown in the various tabs after the scan has finished.

The developer explains his program:

For hidden driver detection, you can test it with some pretty well hidden driver PoC such as phide_ex and many builds of Rustock.B variants. Although you have to use the “Hardcore Scan” method to detect them.

For code hooking detection, the engine walks all the branches of scanned module i.e any execution path of it to detect modification (btw, that’s why i call it CodeWalker). IMHO, It can detect code hooking very well especially with rootkits that place abnormal hooks like Rustock.C (FF25 & FF15 – jmp/call dword ptr [abc]) tho there’re still some problems with false-positive hooks/modifications.

Codewalker is a viable alternative to already available rootkit detection programs like Gmer or AVG Anti-Rootkit. It is probably be best used in conjunction with these tools.

Tags: codewalker, portable software, rootkit, rootkit detection, rootkit-scanner, rootkits, windows software

Which Programs Should I Run To Scan A Computer For Malicious Software?

Martin — Mon, 15 Sep 2008 12:12:35 +0000

The amount of security applications for the end user has reached a point where the choice is adding to the insecurity and confusion of the user. So called experts all have their set of tools that they recommend for certain situations but it can happen that you get a set of totally different applications for the same task when asking two advanced users.

To give an example. Should a user run Ad-Aware, Spybot Search And Destroy, Spyware Terminator or one of the other dozen or so anti-spyware applications that can be used freely for personal non-commercial use.

To much choice can be confusing and this article tries to narrow down the list to security applications that are recommended most of the time. Some users will disagree with the choices and they have every right to do so. You can rest assured on the other hand that the selection of tools should be sufficient to scan a computer system thoroughly

Anti-Spyware:

Spyware usually refers to malicious software that tries to spy on the user or serve advertisement to him. This can be done with tracking cookies, changing the user’s homepage or showing popups from time to time.

Spybot Search And Destroy – Spybot Search and Destroy is updated regularly and does not confuse the user with different versions like Ad-Aware does with Ad-Aware Free, Plus and Pro.
Spyware Terminator – A tool that has been downloaded more than 17 million times should do a good job. Spyware Terminator is fast and efficient.

Anti-Virus:

Anti-virus applications create probably the most controversy. There is so much choice of free and commercial applications that makes it nearly impossible to make a decision. The applications protect the computer in realtime and can scan the computer thoroughly.

AVG Anti-Virus – A classic anti-virus software that provides protection against viruses, rootkits and spyware.
Free AV – Antivir protects the computer against viruses, rootkits, dialers and phising.

Rootkits:

Rootkits have been gaining popularity in the last years and one could say that Sony did not have a small part in raising the public’s perception of rootkits with their music CDs that contained a rootkit in order to prevent customers from copying the music.

Rootkit Unhooker – a portable rootkit scanner with a size of under 100 Kilobyte.
Gmer – is another tool to scan the computer for rootkits.

Is the list missing any categories? Would you put other applications up there (I know you would so let me know)?

Tags: rootkits, scan system, security applications, security programs, security-software, software, Spyware, virus

AVG Anti Rootkit free

Martin — Thu, 05 Apr 2007 08:46:31 +0000

Rootkits received a publicity boost with Sony’s rootkit infested CDs that was supposed to be some kind of copy protection. Since then rootkits have become an ever growing threat on the Internet in line with Viruses, Trojans, Phishing and Spam. The major problem with rootkits is that most users think that their virus scanner protects them from rootkits as well which is most of the time not the case. Rootkits are much harder to detect by normal means and software that can scan systems for rootkits should be used by inexperienced users to be able to detect at least the most common ones.

AVG Anti Rootkit is a free software that scans a computer for rootkits and removes them if one or more of those have been identified. The anti rootkit application can be used to either quickly scan the computer for possible rootkits and the other to make an in depth scan which takes longer but is more thorough. The in depth scan for Rootkits takes some time depending on the amount of files and size of your hard drives.

Tags: avg, rootkit-scanner, rootkits, Security, system-scan

IceSword the better Rootkit Revealer ?

Martin — Wed, 19 Jul 2006 13:25:44 +0000

IceSword is a new contender for the title of the best rootkit revealing and removing program out there at the moment. It is rather hard to find a working download of IceSword but as always I provide a fast way to download the latest version of Icesword named IceSword1.18.rar. Click the link to download the rootkit scanner from rapidshare. In contrast to other rootkit scanners like Blacklight Icesword can not be run automatically. Icesword only provides perhaps the most powerful utilities to scan your system for rootkits and other information.

There is no way that I have enough time to write about all features of IceSword. I therefor decided to mention the most important ones and leave the rest up to you. The process tab of IceSword is one of the most important ones when it comes to detecting rootkits. Icesword will color most hidden processes red which means it is a good idea to take a look at those first. Some rootkits are not colored however so a second look never hurts. You are able to terminate a process by right clicking and selecting Terminate Process.

A good idea is to check the compare the findings with other programs. Use a process explorer that shows the amount of processes but is able to view hidden processes. Compare that number with the number in Icesword and you should have the same amount of processes, if not take a closer look and compare the results.The Mitec Process Viewer is a good tool for this for example.

The ports tab lists all open ports and their applications. Compare the applications with the one that you´ve started. If you see for example that iexplorer.exe is currently connected to the internet but you are not using this program, well you know that you should block the connection and check what´s going on. IceSword should show the same connections that the command netstat -an shows. If they differ something is not right.

The Kernel Module tab in Icesword colors hidden drivers red. The BHO tab (Browser Helper Objects) should be empty if you are not using Internet Explorer but Firefox for example. If you see something in there search for it using Google to see if it is spyware or not.

As you can see it is not that easy to use Icesword compared to other rootkit scanners that work by clicking on the scan button. Iceswords biggest advantage is the fact that it offers more information which is good if you know what you are doing or how to search for the information that you need.

Alternatives to Icesword are still the sysinternals rootkit revealer and blacklight from f-secure.

Tags: icesword, rootkit-revealer, rootkits, Security

How to check your system for rootkits

Martin — Fri, 12 May 2006 18:19:36 +0000

Rootkits have been in the press lately and it´s a good idea to be on the safe side and check your system from time to time to make sure it is not infected. I´am going to introduce two freeware utilities that scan your system and reveal rootkits if they are installed and running on your system.

The first tool is called rootkit hook analyzer, the second one rootkit revealer. Both are great tools and easy to use. You probably have to do some research on the web after one or both of the tools scanned your system. You have to interpretate the output, the website that can help you with this is either the rootkit revealer homepage which has a short introduction on interpretating the output or the rootkit.com website which has lots of information on the subject.

Tags: rootkit finder, rootkits, Security

How to scan your Linux-Distro for Root Kits

Martin — Wed, 03 May 2006 10:01:42 +0000

Ghacks is running on a linux rootserver. It should be fairly secure but there is always a chance that someone might get access to it and comprimise the system. One of the biggest threats is the installation of a root kit which will be used to access the system at a later time and clean tracks of logins that might have occured.

The article “How to scan your Linux-Distro for Root Kits” walks you through all steps of downloading and running a script that is able to detect some root kits. Everything is explained in detail that even beginners will be able to follow the steps and check their system for possible root kits. If you don´t feel like compiling the script yourself you could try and use google to find a precompiled version and download that instead.

Tags: distirbutions, Linux, rootkits, Security

Dvd Rootkit on the way

Martin — Wed, 15 Feb 2006 09:38:27 +0000

Some weeks ago Sony made the attempt to protect the music from some of the cd´s they distribute by adding a rootkit software which would be installed if the user wanted to play the cd on his personal computer. The technique had its flaws and was only working on windows but it still ment that a rootkit was installed on the pc and other scripts could use this rootkit for malicious purposes. After a large outcry from the web community Sony decided to pull the cd´s from the shelves and offer a tool to uninstall the rootkit. (which you would only get through a long process)

Apparently the german movie dvd Mr. and Mrs Smith does contain a rootkit as well. F-Secure confirms that the Settec Alpha-DISC copy protection system is used on the dvd.

If you think you are infected by this rootkit you can use the uninstaller from the manufacturers website.

Besides the obvious threat that a rootkit poses many users claim that even standalone dvd players have troubles playing the dvd. I would advise everyone to not buy this dvd and sent a clear message to the company showing them that we don´t want and need rootkits or other means of copy protection on cd´s and dvd´s that we purchased.

[tags]cd, dvd, rootkit, sony, mr. and mrs. smith, settec[/tags]

Tags: dvd rootkit, rootkits, Security

Sony, the rootkit and the internet community

Martin — Wed, 16 Nov 2005 09:23:02 +0000

No matter which internet page you open this days you are guaranteed to find at least one article mentioning the Sony rootkit affair. Instead of providing you with the latest news on the case customer vs. Sony BMG I´d like to analyse an interesting aspect of it.

In the beginning, there was one guy, who found out about the rootkit software, analysed it in depth and wrote an entry in his blog named Mark’s Sysinternals Blog on a well frequented site. Then the ball got rolling, the news was copied and commented on other sites, big portals like slashdot.org and digg.com had articles that soon became the most popular ones for the day.

The news spread like fire in the world wide web, people from all over the world read the news. It was soon clear that there were only a few who supported Sony´s move, the majority was clearly against it.

News got worth for Sony the following days, Mark again identified some additional “features”. First, the rootkit software was phoning home to Sony. Second, it was almost impossible for the average user to uninstall it. Third, the rootkit possed a cloaking ability that other executables could use to hide inside, a perfect hiding place for viri and trojans.

Sony’s reaction was to provide an update to the rootkit software that disabled the cloaking feature. Unfortunately it was again almost impossible for the average user to find the uninstaller on their webpage. Still, Sony in its shining glory denied that the rootkit posed a security threat and that most users didn’t care whether a rootkit was installed on their system. The patch unfortunately had the nasty habit to crash windows on some machines.

The internet community created lists of cd´s that contained the software, boycott websites went into existence and had to deal with a massive amount of visitors who were looking for information or wanted to join the boycott.

With lots of News Coverage from respected institutes like BBC Sony presented a statement on Monday that they would cease the production of music cd’s containing First 4 Internet’s XCP technology, for now.

Yesterday Dan Kaminsky presented the first figures of rootkit infections analysing the rootkits phone home traces in the dns cache of nameservers. This lead to the conclusion that at least half a million networks are infected with it. He created a graphic showing infections on a map of north america.

Today Sony finally announced that it would institute an exchange program for already purchased cd’s and pull the rest from the market.

Now, what conclusion can we draw from this ? It´s pretty obvious to me that Sony underestimated the “might” of the internet community. From a single website the story spread into the whole world in no more than one day. It became so popular that big internet portal sites like wired.com, cnn.com and theregister.co.uk reported on it. The traditional media became aware and soon the story was also making headlines in newspapers, radio shows and even television.

Sony: 0
Internet Community: 1

What i learn from this ? We have a tremendous power in our hands and can use it to force even multinational corporations to yield, even countries ? That question remains to be answered.

Tags: rootkits, sony

How to remove the Sony – XCP DRM Rootkit

Martin — Mon, 14 Nov 2005 15:18:20 +0000

This article explains it all. It provides links to consumer made cd listings that contain the rootkit software, shows how cds with the rootkit software look like, explains how one can check his personal computer for the rootkit and finally gives a detailed walkthrough on how to remove the rootkit software manually from your computer.

If you suspect that your pc might contain sony’s rootkit protection take a look at the article posted at bleepingcomputer.com.

Tags: drm, rootkits, sony

Sony halts production of ‘rootkit’ CDs

Martin — Fri, 11 Nov 2005 20:31:09 +0000

After lots of controversy about their rootkit music cds Sony announced today that it will halt the production of rootkit music cds. It seems that consumer and media backlash finally paid off.

The Pressure on Sony increased over the last days with anti-virus companies warning its customers not to install this rootkit software and big companies like microsoft taking stand against it altogether.

Tags: drm, rootkits, sony

Sony and the rootkit, the story continues

Martin — Wed, 09 Nov 2005 18:52:16 +0000

The news spread like fire last week: Sony has a installer on some of their music cd´s that might install a rootkit on customers pc´s if they put them into their personal computer. The rootkit software could not be uninstalled by normal means and has already been used by hackers to hide World of Warcraft cheat scripts from being detected by Blizzards Warden client.

It is possible to hide other scripts and software as well, one possibility would be to hide virii and trojans from antivirus software. All of this could be done using this software. Yesterday First 4 Internet Ltd, the British company that developed the DRM software, issued a patch that did not add an uninstallation routine to the software but remove the cloaking feature. It also patched the software to a new version.

Sony´s reaction to the heavy fire from the internet community and privacy groups was to point their fingers at music pirates. Thomas Hesse, President of Sony BMG’s global digital business division, on NPR:

“Most people, I think, don’t even know what a rootkit is, so why should they care about it,” he asked? “The software is designed to protect our CDs from unauthorized copying, ripping.”

Yeah, why should one care if some software is installed on his personal computer that can´t be removed by normal means and can be used for all sorts of malicious actions (which Sony as of now still denies) ?

Why should one care that the software makes contact to a Sony server every time a song is played (there is no information about this for the user and of course no way to stop this) ?

The patch Sony issued is hard to find, if you are lucky enough to find it it is possible that receive a blue screen when you apply the patch.

Tags: drm, rootkits, sony

World of Warcraft hackers using Sony BMG rootkit

Martin — Thu, 03 Nov 2005 16:27:53 +0000

It has come to our attention that World of Warcraft Hackers already are using Sony BMG Music Rootkit Software to hide their hacking from Blizzards Warden Client.
We reported earlier this week that some Music Cds by Sony BMG labeled “Content enhanced & protected” would bring up an installation program when the music cd was put into a personal computer.

This program once installed could not be uninstalled by normal means. Hackers could use the software to hide their hacking attempts from antivirus tools and the like. Who would have thought that the first available use would be using this for hacking the online game World of Warcraft ?

Blizzards Warden Client checks every 15 seconds if the computer playing Word of Warcraft runs programs or scripts in its background that would illegaly help players cheat in the game. Take a look at the related thread to receive more information.

Tags: bmg, rootkits, sony, world-of-warcraft

Universal Music Group Music Cds might also install rootkit

Martin — Wed, 02 Nov 2005 16:50:23 +0000

And another player joins the rangs of the companies that might install spyware with their Music Cds when you put them into your pc drives. “Fontana Distribution, part of Universal Music Group and distributors for Upstairs Records Inc., are encouraging the independent records labels they distribute to use content protection on their CDs. “Twelve Eighteen”, featuring the hit song “Summer Nights”, carries the same content protection currently being used by Sony BMG.

John Lopez of Upstairs Records commented: “we are very pleased with the seamless production of the album. The media player on the CD has a good user experience and we intend using the technology on more new releases.”

That means, watch out if you intend to buy products from them as well. I especially like the survey they quote, claiming that “consumers have overwhelmingly reacted positively to these new discs.”

I can only think of two possible reasons for this. First, consumers don´t know about the software they install on the system and that they won´t be able to uninstall it without lots of troubles. Second, they don´t show the survey but only quote it. As long as we won´t have hard facts its not possible to draw conclusions. For example, how were the questions phrased, who was asked for their opinion, maybe the majority never used the Cds in their PC.

Take a look at the full press release by xcp-aurora.com

Tags: rootkits, Spyware, universal

Sony music cds might install spyware on your system

Martin — Tue, 01 Nov 2005 22:35:21 +0000

A few minutes ago I read a news article written by Brian Krebs who described how some Sony Music Cds try to install a software on pcs that could be labeled as spyware.

It seems that we have reached a new level in the fight between the record companies and its consumers. If you put a music cd in question into your drive a installer will popup. If you agree to install the software you won´t find a uninstall feature anywhere on your pc.

Apparently all Music Cds labeled “Content enhanced & protected” have the installer on the CD, make sure you check this before you buy a cd you would want to hear using your pc.

According to Krebs “The CDs in question make use of a technique employed by software programs known in security circles as “rootkits,” a set of tools attackers can use to maintain control over a computer system once they have broken in.”

It takes pc expertise to be able to remove this software ones it is installed on your pc. FSecure analysed the product and have a own virus definition for it. Lets take a look at their summary:

Extended Copy Protection (XCP) is a CD/DVD copy protection technology created by First 4 Internet Ltd. XCP has been used to protect some audio CDs released by Sony BMG Music Entertainment. The XCP protected disks contain digital rights management (DRM) software that allow the user to make a limited number of copies of the disk and also rip the music into a digital format to be used on a computer or portable music player.

Once installed, the DRM software will hide:

Files
Processes
Registry keys and values

No means of uninstalling the DRM software is given. The software supports Windows 98SE, Windows ME, Windows 2000 SP4 and Windows XP.

This analysis was conducted on Windows XP. The music CD that contained the DRM software was Van Zant: Get Right with the Man (Sony BMG Music Entertainment).

F-secure also posted a guide on how to remove the software once installed on your system.

Tags: music-cd, rootkits, sony, Spyware

gHacks technology news » rootkits

Check for root kits with rkhunter

Related posts

Rootkit Detection Software Codewalker

Related posts

Which Programs Should I Run To Scan A Computer For Malicious Software?

Related posts

AVG Anti Rootkit free

Related posts

IceSword the better Rootkit Revealer ?

Related posts

How to check your system for rootkits

Related posts

How to scan your Linux-Distro for Root Kits

Related posts

Dvd Rootkit on the way

Related posts

Sony, the rootkit and the internet community

Related posts

How to remove the Sony – XCP DRM Rootkit

Related posts

Sony halts production of ‘rootkit’ CDs

Related posts

Sony and the rootkit, the story continues

Related posts

World of Warcraft hackers using Sony BMG rootkit

Related posts

Universal Music Group Music Cds might also install rootkit

Related posts

Sony music cds might install spyware on your system

Related posts