Looking for a lil review of some info im gathering for work.
Posted: Wed Oct 26, 2005 9:39 pm
Im trying to build a database of info for the people at work and for myself. I keep it on a forum and update it as i learn new things. I found something really interesting and i tried to pool all the knowledge i could about it and wrote a lil article/post whatever about it. Its tech related and if anyone is interested i would enjoy and value feedback and fact corrections as well.
Here it is.
Rootkits
Basicly a rootkit is a collection of tools and utilites that allow a user access to a PC and its resources beyond the administrative level. In the malicious context this can be installed on a PC and used to run anything it wants and hide its process. Basicly its like this....
The core OS or kernal is the foundation of the entire product known as windows or linux or whatever. At that core level its essentialy a server and client relationship. The applications your trying to run are in essence a client to the server thats the core OS. When you call upon IE to get you online it requests from the OS the resources it needs to accomplish the task.
Now that said, the rootkit tools that are being used in spyware now, will hide themselves in the core of the OS and lie to any process requesting tis status. For example when you run a spyware scanner its essentialy using the command "find first file" and "find next file", "find next file", etc, but what the rootkit from these spyware will do is trick the outside request, since the spyware scanner is operating as a client and the rootkit is basicly at the server level, the spyware will trick the scanner and just tell it to check the next file, basicly hiding itself from the scanner or anything else that would want to request its status.
So thats basicly the threat, here is whats going on to take care of it.
This is a link to a root kit revealer utility which if i understand correctly is very interesting. Its basicly as lil mini OS that goes in at the core OS level and examines it for any changes. The program goes in and checks the core OS for anything that shouldnt be there and more to the point anything that is lying about its status in the method i mentioned above or in other words running in a hidden or stealth mode. Cool web search which we are all familar with is already using " rootkit technology ." to hide itself in the operating system. A malicious piece of software like this would drive a bench tech nuts trying to remove cause itll keep rebuilding itself even though spyware programs say its cleaned it and nothing is listed in the task manager.
Here is the rootkit revealer link.
http://www.sysinternals.com/Utilities/R ... ealer.html
This is a link to a project that MS has started on thew basis of this technology to combat this new threat present in spyware. Its my undersanding that the current MS spyware utility include this anti rootkit technology.
http://research.microsoft.com/rootkit/
Really interesting stuff, have fun.
Here it is.
Rootkits
Basicly a rootkit is a collection of tools and utilites that allow a user access to a PC and its resources beyond the administrative level. In the malicious context this can be installed on a PC and used to run anything it wants and hide its process. Basicly its like this....
The core OS or kernal is the foundation of the entire product known as windows or linux or whatever. At that core level its essentialy a server and client relationship. The applications your trying to run are in essence a client to the server thats the core OS. When you call upon IE to get you online it requests from the OS the resources it needs to accomplish the task.
Now that said, the rootkit tools that are being used in spyware now, will hide themselves in the core of the OS and lie to any process requesting tis status. For example when you run a spyware scanner its essentialy using the command "find first file" and "find next file", "find next file", etc, but what the rootkit from these spyware will do is trick the outside request, since the spyware scanner is operating as a client and the rootkit is basicly at the server level, the spyware will trick the scanner and just tell it to check the next file, basicly hiding itself from the scanner or anything else that would want to request its status.
So thats basicly the threat, here is whats going on to take care of it.
This is a link to a root kit revealer utility which if i understand correctly is very interesting. Its basicly as lil mini OS that goes in at the core OS level and examines it for any changes. The program goes in and checks the core OS for anything that shouldnt be there and more to the point anything that is lying about its status in the method i mentioned above or in other words running in a hidden or stealth mode. Cool web search which we are all familar with is already using " rootkit technology ." to hide itself in the operating system. A malicious piece of software like this would drive a bench tech nuts trying to remove cause itll keep rebuilding itself even though spyware programs say its cleaned it and nothing is listed in the task manager.
Here is the rootkit revealer link.
http://www.sysinternals.com/Utilities/R ... ealer.html
This is a link to a project that MS has started on thew basis of this technology to combat this new threat present in spyware. Its my undersanding that the current MS spyware utility include this anti rootkit technology.
http://research.microsoft.com/rootkit/
Really interesting stuff, have fun.
