Staying one step ahead of the intruders
Blue Pill Detection
The latest trend is virtualized rootkits. A virtualized rootkit works like a virtual machine: The first step is for the rootkit to modify the boot process so that a virtual machine is loaded before the operating system. The operating system you think is running on the hardware actually boots in a virtual machine. This gives the rootkit total control over the computer without the operating system or the user noticing a thing. This approach was demonstrated by Blue Pill , which explains why the process of identifying virtual rootkits is known as Blue Pill Detection.
Rootkits are very difficult to detect once they are installed on your system. Before they install, however, you can identify them with anti-virus programs and rootkit scanners (or rootkit detectors), which use signatures or heuristics to identify the culprits.
The best way to stop a rootkit is not to let it in. The articles in this issue discuss some techniques for shutting out intruders before they get comfortable.
In spite of all your efforts, however, you will never be safe enough to ignore the possibility of a rootkit slipping past your defenses. The following sections discuss some strategies for rooting out rootkits.
To Build, or Not to Build
Administrators are asked to build most rootkit scanners before they can use them. As you can imagine, this is a problem if the rootkit already has a stranglehold on your system. In this case, the compiler may already have been compromised by the rootkit, and would build a manipulated version of the scanner. For this reason, you should try to build the scanner as soon as possible after installing the system, or use a system that you know is clean.
Because the results on a running system are not entirely conclusive, you should down the suspect and then boot from a medium that you know is clean. This could be a rescue disk, for example. The real test is to cross check any suspicious files with files from a clean system. This is usually accomplished by comparing the current system with a snapshot of the system taken directly after installation. To prevent the rootkit from affecting the results of the comparison, store the original snapshot on a read-only medium.
Of course, a backup of a complete system takes significant disk space. As an alternative, you could just create checksums for an integrity check. To do this, the rootkit scanner calculates a fingerprint for each file; if the rootkit later attempts to manipulate the file, the checksum is automatically changed and will thus not match the original checksum stored at the time of the last upgrade.
Buy this article as PDF
Popular open source encryption tool is vulnerable to attack
New “Yakkety Yak” edition emphasizes cloud and servers
Google finally enters the phone hardware business.
Innovative system adds a hard drive and Ubuntu Core to the RPi for an IoT hub.
Linux is two weeks younger than we thought!
The Apache Software Foundation considers retiring OpenOffice
Adobe won’t kill the plugin in 2017
Linux Foundation's big event celebrates the 25th anniversary of Linux