Rootkits evade hardware detection
611897
(InfoWorld) - Security researcher Joanna Rutkowska has demonstrated several methods that sophisticated rootkits can use to hide from even the most reliable detection method currently available -- hardware-based products that read a system's RAM. Rutkowska is a researcher with security firm Coseinc Advanced Malware Labs. She recently outlined several ways of getting around the UAC (User Account Control) feature introduced in Windows Vista. Several researchers have identified problems with UAC. The demonstration, given at the Black Hat security conference in Arlington, Va., indicates that if a rootkit is advanced enough, there currently is no way it can be reliably detected, Rutkowska said. Rootkits are designed to hide some activity from observers and have recently been used to conceal the presence of Trojans and hacker backdoors -- not to mention Sony BMG's copy-protection software. Several hardware-based systems exist for acquiring an image of a computer's RAM, the most reliable way to detect the presence of certain kinds of rootkits, Rutkowska said. Those include Tribble, Komoku's CoPilot, and RAM Capture Tool from BBN Technologies, but she said none are particularly easy to find. Rutkowska's findings mean system designers may need to come up with a system architecture better suited to forensic analysis, such as an interface dedicated to memory acquisition. "We live in the 21st century, but apparently can't reliably read the memory of our computers," she said at the presentation. "Maybe we should rethink the design of our computer systems, so that they were somehow verifiable." Rutkowska's presentation outlined three types of attacks, one that crashes the machine when RAM acquisition is attempted, a "covering attack" that allows the acquisition tool to see only garbage when it inspects certain parts of physical memory, and a "full replacing attack" that allows the tool to see false information when it scans parts of physical memory. The denial-of-service attack could leave investigators legally liable for crashing the system, Rutkowska said. The "covering attack" might allow investigators to see the malware's "hooks" in some cases, but would make it impossible for investigators to analyze the malware. And the "full replacing attack" could simply mean that the malware is never detected at all, she said.
236076
Discovers virtualisation just as everyone else is trying to forget it
754394
Surfing the Web has never been more risky. Simply connecting to the Internet - and doing nothing else - exposes your PC to non-stop, automated break-in attempts by intruders looking to take control of your machine surreptitiously.
744672
Windows security holes patched; tool to rid PCs of malicious software now available.
644327
How do you protect a home network against a hackerÂs attack?
101788
MIT researchers develop an authentication system that's not so easily revealed to prying eyes.
503684
Talk about the worst of both worlds: When Jon Espenschied tried to untangle a malware attack on his dual-boot system, he found out just how vulnerable combining open- and closed-source software can leave a machine.
711512
Simple, cheap encryption method uses natural thermal noise to foil eavesdroppers.
674948
Finnish security company F-Secure has reported on new rootkit-like software discovered on USB thumb drives manufactured by Sony. Although the software doesn't appear to cause damage to a user's system, it does create a hidden directory that is inaccessible via the Windows API and some virus scanners.
749286
Want to hack Windows? Better get familiar with the Registry first.
768812
Password-stealing Trojan horse may--or may not--be targeting popular VoIP feature.
503721
Swapping out optical media drives does the trick, hardware hackers report. In Gadget Lab.
159977
Home net hardware could come under attack from malicious hackers, say security researchers
195221
Windows XP Service Pack 2 promises to raise the security bar for the sometimes beleaguered operating system. Unfortunately, one of the new features could be spoofed so that it reports misleading information
638637
Security reseacrhers are warning about the "Srizbi" Trojan, which is being distributed through the Mpack hacker toolkit and is difficult to detect because it hides in the Windows kernel.
711255
New PCs will ship with a chip designed to thwart hackers--a hardware approach that's said to be safer than software.
166352
Over the past month, a new type of malicious software has emerged, using a decades-old technique to hide itself from antivirus software.