Article: "Microsoft Says Recovery from Malware Becoming Impossible"

[RebateMonger]

http://www.eweek.com/article2/0,1895,1945782,00.asp

"In a rare discussion about the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation."

"When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit," Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here."

 

[stash]

This doesn't seem to earth shattering to me, this has pretty been the way the Security team at PSS has operated all along. They do a best effort to remove malware from a machine, but even if they do, they always caution that the box can never truly be trusted again unless a complete wipe and reload.

 

[Robor]

Wow, that's encouraging news. When these malware creators are caught they need to be strung up by the... 😉

 

[Doom Machine]

i dunno why its such a recent news, i remember back in 98 or 99 in hacker chats people discussing them mostly kernal vxd's running ring0, i think it was used by some hackers since the later days of win95 , i remember ihad a keylogger that was app level rootkit and would send data by bypassing any firewalls using ie shell exploit and that even didnt get fixed till sp2, cmon now..all those whitehats out there and takes them this long to get that stuff patched... alot of ppl at that time i recall used email spam attacks and denial of service tools,retroroutine code wasnt too common but existed, but most didnt have antivirus and firewalls anyway back then
i dunno what moron spread the advice of reformating as an only solution, just use another filesystem driver, theres ones you can download that do it all for you, the rootkit cant be reloaded cuz its corupted, problem solved , also you dont have to wipe it..a simple reformat does it and quickest easiest way to do it, thats why administrators dont bother trying to remove it. if you want to detect it, use alternative cd to boot, if its not running it cant hide itself
nowadays tools can recognize by fingerprinting and will alert you to any activity, i dont think most people on average will have to worry much about it, although of course worms can install a rootkit too

 

[Markbnj]

That's the problem with these bastards. Since effective enforcement is not being done on an international scale, we all end up with machines that are armoured like an M1 tank. From what I hear you have to explicitly tell Vista it is ok every time you take some action that requires higher privs. That's going to be frustrating as hell.

Personally, I think the international community should get together, track some of these guys down, and put them away for 20. A few of those and you'll chase them into the remote corners of the 3rd world, and then we can slap firewalls around those countries.... or something.

 

[drag]

Originally posted by: Markbnj
That's the problem with these bastards. Since effective enforcement is not being done on an international scale, we all end up with machines that are armoured like an M1 tank. From what I hear you have to explicitly tell Vista it is ok every time you take some action that requires higher privs. That's going to be frustrating as hell.

Personally, I think the international community should get together, track some of these guys down, and put them away for 20. A few of those and you'll chase them into the remote corners of the 3rd world, and then we can slap firewalls around those countries.... or something.

Trouble is that there is no such thing as a 'international community'. The closest you get is the UN which is full of third world country's governments trying to push everybody around in a attempt to hide their own 'crimes against humanity' and try to get 'human aid' to help finance and feed whatever petty internal war they have going on at the time and a few big players playing games to keep themselves at the top.

I doubt they could give a crap less about anything as pedestrian as 'computer security'.

People have to be out for themselves and work to protect themselves. It's same as it ever was and probably ever will be. Your responsable for your own security. Laws and law enforcement haven't stopped criminals from being a-holes yet.

---------

As far as not-being-able-to-recover from malware.

In Unix-land the only tried-and-true way to recover from a successfull root exploit is to wipe the machine and start over. That's why you aren't going to see a big market for things like anti-malware and anti-virus stuff in 'enterprise' unix stuff.

What you'll see is a lot of tools and items to detect a successfull attack.. Like Tripwire being used to detect any system files and drivers that may have been tampered with. (which you have to take a machine down to check it.. Modified kernels and kernel drivers put into place by hackers will provide false information about files/filesizes/file checksums to fool the most sophisticated sorts of file scanners) or IDS systems like Snort that assist in monitoring network traffic for any sort of suspicious activity.

However you won't find much in the way of tools to recover from a successfull attack. It's actually very pointless. With a Kernel-module-rootkit you can't trust your own OS. You can't trust any tools to detect backdoors.. Even if you isntalled them after the fact on a machine that you have off the network. You will never be sure what sort of things the hackers did or anything like that. You will never be sure what sort of system files they modified or anything like that.

So it's actually a lot easier, a lot faster, and a hell of a lot cheaper (for businesses) to simply format and reinstall.

It's been like this for years and years.

With the introduction to Windows 2000 Microsoft had reached a level of security that is about the same level of sophistication found in most Unix boxes at the time. So then hackers began using technics used to compromise unix systems on Windows. Things like driver-based rootkits and such started popping up.

The idea is that after you hack a machine you install the rootkit. It loads a driver up, or you modify a existing driver or whatnot, that then goes and modifies how the system kernel behaves so that you can avoid detection from things like anti-malware or anti-virus. Then you have modified system binaries and hidden tools that help you do whatever you want to do.. Like setting up a IRC channel, or a ftp server, or a vehicle to launch other attacks.

In fact early on the ONLY way people knew these things were going on was that some of the driver-level rootkits people were using had a bug(s) in them that caused BSOD and caused mysterious backtraces and such. Nowadays, of course, these things are more sophisticated.

And with Sony's DRM rootkit blunder has popularized the use of rootkits to subvert windows computers so now every script kiddie in the world knows how these things work and more professional crackers (that is programmers who make livings on hacking secure computers) provide now well-tested tools to them to acomplish things like having armies of script kiddies (unkowingly) inserting backdoors into computers around the world with no legal risk to themselves.


With the new abilities that Pacifica from AMD and VT from Intel has openned up a new avenue of new and more sophisticated rootkits.

With these items it will be possible for a hacker to slip a Virtual Machine hypervisor underneath a operating system. That is they create a rootkit that then operates UNDERNEATH a system kernel. This is even more effective and more difficult to detect then before.

This is because these items will create a virtual machine environment for your Operating System to run in. No kernel drivers to cause BSOD. No modified system binaries to alert checksum'ing programs on a machine that is taken down. No need to do anything like that. It's also operating system independent. The same thing will work for Windows XP as it does Linux as it does OpenBSD as it will for Windows Vista.

It's even possible that uninstalling and reinstalling a OS won't wipe it out.

Microsoft working with the University of Michigan University have created several proof-of-concept viruses/rootkits that exploit VM environments to hide themselves. Details are outlined in this pdf.
http://www.eecs.umich.edu/virtual/papers/king06.pdf

The major barrier is that you have to reboot the machine to get the VM-based rootkits to 'lift' your operating system into their VM environment. This isn't that difficult if you think about it. With linux you'd just install the vm and wait for the administrator to do a kernel update. With desktop windows you'd just have to wait around for a security update or install it as a virus in another program like a shareware item. They'd bring up the dialog 'Please reboot now' and you'd reboot and then the damage is done.

That's what TPM (trusted platform module) is designed to provide a means to counter act. It's designed to create a hook into the hardware that can't be virtualized so that there will be a way to check the checksums of any hypervisor running your system (like Xen or Vmware server editions) and the kernels as well as most other things.

So using that it should provide a means to allow a way to detect even VM-based rootkits.

Unfortunately it's also going to be used for DRM. This provides a HUGE financial insentive for all sorts of people to crack hardware-based TPM for a whole veriaty of reaons. It may be used to prevent people from installing Linux on computers.. like MS did with first Xbox's DRM stuff (although obviously it didn't use TPM). Software pirates will want to hack it and they have all sorts of money and sophisticated tools to reverse engineer hardware. Then you have professional hackers that will need to figure out ways around it to keep comprimised machines hidden from those machine's administrators. And since it's hardware-based item it's not like your going to be able download a patch to fix any flaws with it.

In computer security a ounce of prevention is worth 3 tons of cure...

 

[DBSX]

From what I hear you have to explicitly tell Vista it is ok every time you take some action that requires higher privs. That's going to be frustrating as hell.

From my limited experience with Linux, this is the same. And it's not all that frustrating. I am coming from all Windows, all the time for the past 15 years. I can see how it might be frustrating, but then it should only happen when you are setting up your system. On my Linux 10 install, once I was setup I have not needed to invoke "higher privs" after initial setup of the system. I think this will be the case for a vast majority of users and thus, should not be a real problem.

also you dont have to wipe it..a simple reformat does it and quickest easiest way to do it

I think in cases like these, it is generally accepted that "wipe" is a simple reformat or throwing an imaged OS back on the drive. Not neccessarily a DOD level wipe of the hard drive...

As far as the original topic, I agree, this is hardly what I would call new.

\Dan

 

[daniel49]

Originally posted by: Markbnj
That's the problem with these bastards. Since effective enforcement is not being done on an international scale, we all end up with machines that are armoured like an M1 tank. From what I hear you have to explicitly tell Vista it is ok every time you take some action that requires higher privs. That's going to be frustrating as hell.

Personally, I think the international community should get together, track some of these guys down, and put them away for 20. A few of those and you'll chase them into the remote corners of the 3rd world, and then we can slap firewalls around those countries.... or something.

Lets put the UN in charge of it...that'll get er done😉

 

[nweaver]

Originally posted by: daniel49

Originally posted by: Markbnj
That's the problem with these bastards. Since effective enforcement is not being done on an international scale, we all end up with machines that are armoured like an M1 tank. From what I hear you have to explicitly tell Vista it is ok every time you take some action that requires higher privs. That's going to be frustrating as hell.

Personally, I think the international community should get together, track some of these guys down, and put them away for 20. A few of those and you'll chase them into the remote corners of the 3rd world, and then we can slap firewalls around those countries.... or something.

Lets put the UN in charge of it...that'll get er done😉

LMAO...

before this move any farther, the politcs forum is that way ------->

 

[RebateMonger]

Originally posted by: drag
As far as not-being-able-to-recover from malware......

Interesting reply. Thanks, drag.

 

[stash]

In computer security a ounce of prevention is worth 3 tons of cure...

This is huge. I can't stand this new market of reactive tools that have sprouted up in the past few years that purport to remove malware. Hate it. By running a tool that is by definition reactive (MS Defender, Hijack this, whatever), you are essentially conceeding defeat. I've never been hit with a virus or spyware or anything else, but if I were, I wouldn't waste any time running these tools.

Of course, Microsoft and other software vendors are complicit in this, by waiting far too long to secure their products, restrict user privs (no more admin by default), etc. But to me, promoting these sorts of tools just reinforces bad user behavior. Because guess what? Software vendors can secure their apps, Microsoft can not make users admins by default, whatever...but malware writers will adapt. The malware problem cannot be solved by technology alone.

Rootkits are another story, since they are usually difficult to detect "with the naked eye". But still, by taking appropriate measures to prevent any type of malware from getting on your system in the first place, you will also be in a good position to prevent rootkits.

 

[drag]

Rootkits are another story, since they are usually difficult to detect "with the naked eye". But still, by taking appropriate measures to prevent any type of malware from getting on your system in the first place, you will also be in a good position to prevent rootkits.

Exactly. By definition you have to get root access first. (or in Window's case a administrative account) You need some other hole.

If a attacker can't get his rootkit installed by a virus, worm, or social engineering then the most sophisticated and best rootkit in the world is worthless to him.

In single user environments then a root kit is not that much more dangerious then your average malware, worm, or whatnot... Once the user's information has been compromised it's been compromised.

But in enterprise environments they can be devastating. In a 'Single Sign On' environment (like Active Directory or any other major enterprise system) if you can get a keylogger installed as part of a root kit and you can figure out a way to get a network administrator to log into the system (especially if he has rights to a domain controller!! then total 0wnership is a single local user rights elevation exploit away..)) then the entire network is yours. They would be able to over possibly hundreds of computers in a short amount of time. Good luck trying to clean that mess up.

 

[Brentx]

Originally posted by: stash

In computer security a ounce of prevention is worth 3 tons of cure...

This is huge. I can't stand this new market of reactive tools...

I cannot agree with you more Stash. Promoting these type of tools does promote bad user behavior. But the bottom line is, as more people enter the computer scenario, we have more people who are not as knowledgable at computers coming on line. These people don't know what rootkits are, they don't care to know how a trojan or keylogger works. All they know is that their "computers are acting slow, and that they have a virus" (wow have I heard that saying way to many times). They don't know how it got there, even though it was user invoked, or they failed to patch their systems (half the people I work for didn't even know that Windows Update exsisted until I showed them 😕 ). That is a really bad thing.

We will never beable to change these people, because they simply don't care. So we have to make tools that counter it. All they want to do is burn their CD's and shop on eBay, and they will let their anti spyware and antir virus do the rest.

I myself don't run any virus or malware protection on my PC. My NAT router is all I need. If I notice my computer is acting funny, or their is a weird process running, I know that it is a virus, and wipe the machine. In my mind any computer that has been penetrated by malware, regardless if it is running Windows, can not be trusted any more. In my mind, some of the anti malware programs out there can be just as bad on system resources as the viruses themselves.

 

[Markbnj]

myself don't run any virus or malware protection on my PC. My NAT router is all I need. If I notice my computer is acting funny, or their is a weird process running, I know that it is a virus, and wipe the machine.

If it works for you, great, but it doesn't sound like a good strategy for most people. I'm not willing to wipe and reinstall if I get a virus, not unless I have to. NAT routers are great, but every one of them will permit an outbound connection. So if you get a drive-by install that process is going to be able to punch out and pull down it's delivery packages without there being any warning. A NAT router along with something like Avast, Norton (ugh), or Windows Firewall that is monitoring outbound connection attempts is the best protection.

 

[spyordie007]

I like the turn this thread has created but havent had a chance to post (been pretty busy the past couple of days).

Just wanted to throw in my quick 2 cents and say that I agree that most detection tools play a minimal-at-best role. They'll allow you to detect some problems but once you've been owned it doesnt much matter. The big concern I have is all the people who spend tons of money on these tools and that leads them into a false sense of security ("I have a virus scanner, I'm safe").

Personally I follow the same set of principals that I do professionally. Run as a limited user account to help mitigate the chances of something major running in the first place, run trusted software, close ports and than firewall what I cant close and run virus scanners at multiple stops along the way (server, client; to help avoid the common stuff).

The basic concepts of keeping your enviroment secure are fairly simple (just see my sig.); unfortunetly it doesnt fit well when you have a "I just want it to work" mentality.

Resposibility still starts with "me"

 

[spikespiegal]

Of course, Microsoft and other software vendors are complicit in this, by waiting far too long to secure their products, restrict user privs (no more admin by default), etc

Why the frak is it's Microsoft's fault you're running with admin rights?

The reason you don't see this by default with windows is all the crappy 3rd party software and driver installs out there that require local admin rights, or it can't install. Harp on those losers for writing apps with Win98 based API tools that don't take into account you *don't need* admin rights on XP to install a frikken print driver if it's written properly.

Honestly, the biggest way to castrate this junk is to avoid IE for general surfing, or simply stup surfing with admin rights on the box. Also, an increasing majority of serious Spyware infections I clean for friends come from file sharing services and less and less Internet Explorer. So, if you're going to steal software, and your OS gets nuked by a happy russian trojan, perhaps there's justice in the universe after all.

Even Sony's infamous rootkit would not load if the user didn't have admin rights.

Given a choice between running 10 of the best spyware scanners on the market at the same time with admin rights, or using no spyware scanner at all, but not running with full admin rights, the later scenario a 1000x more secure.

Oh yeah...while I'm ranting. While you guys are learning how to over-clock your video card, please learn that a software firewall doesn't protect you from squat and doesn't perform content filtration. While the system exploits metioned above are scary, what's even scarier is are supposedly 'technically experienced computer culture' still thinks blocking ping requests protects you from ActiveX exploits. You've got an entire industry selling software and making jillions of dollars selling consumers security software that does nothing.

 

[stash]

The reason you don't see this by default with windows is all the crappy 3rd party software and driver installs out there that require local admin rights, or it can't install. Harp on those losers for writing apps with Win98 based API tools that don't take into account you *don't need* admin rights on XP to install a frikken print driver if it's written properly

That's a good point, but there are/were also many Microsoft applications that require(d) admin rights. And running as a non admin is either impossible (9x) or less than easy (2000/XP).

 

[drag]

That and for home users Microsoft sets up administration for the default user automaticly. I'd bet the infection rates for Windows machines would of been slashed 50% by simply having people being prompted for a password when they try to install software.

There are some other things... Like being able to execute programs by simply doubleclicking on them and depending on the file name itself to determine executable-ability. It's natural for when you get a e-mail attatchment to double click on it to see what it is. This is expected and natural human behavoir and the UI is setup so that people are taught to do this. So that sort of thing should be taken into account when designing applications and such to help users be protected. Throw in a couple extra steps the user has to go through to execute programs in this manner and it again would of made a huge difference.

Of course you can't make a system fool-proof and still have it usefull. Both those things are diametricly opposed.. But you can sort of help people to help themselves so at least people that are smart enough to go 'what-a-sec... that's not a jpeg' can be saved. 🙂