Anti Rootkit Blog

JSharp in a blog entry recently, highlighted the potential of ID-triggered Rootkits, Rootkits that activate when they have reached a “Target” victim. This high profile victim could be a large company with a lot of Intellectual Property and a lot less security.
This does seem far-fetched to the average person but it has happened in the past and it will become more prevalent in the future.

Companies who are in a very competitive environment can only survive if they have the edge over their competitors. This edge can take many forms but information is the key. Information about competitor’s products, techniques, processes and sales are extremely valuable when making decisions about the future.

There would be no problem for an attacker to offer a low paid programmer a lot of money to write a rootkit that is undetectable by any of the current rootkit scanners.  Earlier this year rootkit maker of HackerDefender, an extremely powerful rootkit, had a service whereby an undetectable version of Hacker Defender was made for a price. This super stealth service is now unavailable.

The Attacker could then purchase a zero day exploit, and unknown program vulnerability, from one the many sites offering them.  There is a lot of money to be made from finding holes in software and selling the information or ready to go code for thousands of dollars. 
 
One form of rootkit delivery is via a compromised website. A malware creation kit called Webattacker contains scripts that could check out the version of the visiting user’s browser and send down a rootkit and its payload.  This payload could be a keylogger, perfect for capturing usernames and passwords for later attacks. It could also include file capturing software that could gather up Word documents, Spreadsheets or any other file type that could hold valuable information ready to be sent back via the same route it came in.

Another form of delivery is via email.  Craftily created emails could be sent to employees enticing them to open safe looking attachments and then to release the rootkit and it’s payload.  This happened in May of this year. A large, high profile, unnamed, company in Asia was targeted by an alleged criminal gang.  An email was sent to certain employees in the unnamed company.  The email contained a Word Document that in some way related to the employees area of work.  The Word Document contained exploit code that was unknown to everyone in the world except for the attacker.  The exploit code was then able to give the attack complete control over the employees PC.  This hole in Microsoft Word was patched by Microsoft some months later.  I am sure though that there are many companies out there that are still vulnerable because they have not patched or updated their Office Software.

“Detection is mostly the very hard part in these attacks. This case seems to have been detected by a very alert user detecting a domainname in an email that wasn’t completely right.
That user detected an email coming in that originated from a domain that looked like their own, but wasn’t their own (actually only had an MX record in it). The email was written to look like an internal email, including signature. It was addressed by name to the intended victim and not detected by the anti-virus software.” http://isc.sans.org/diary.php?storyid=1345
 
Arrests were made earlier this year in London and Israel after a company found it had rogue software or malware on their PC’s.  It turned out a married couple in London had written software that collected files that were then sent to a rival competitor. This software was used by “Private Investigators” to retrieve information from the competitors companies.

“Companies probed by the Israeli authorities in connection with the case include mobile phone operators, Cellcom and Pelephone, and satellite television provider YES. All firms have denied any wrong doing. The Trojan horse is said to have spied upon the Rani Rahav PR agency (whose clients include Israel’s second biggest mobile phone operator, Partner Communications), and the HOT cable television group. Mayer, a company which imports Volvo and Honda cars to Israel is suspected of having spied on rival Champion Motors, who import vehicles made by Audi and Volkswagen.” http://www.sophos.com/pressoffice/news/articles/2006/01/israeliesp.html

So there you have it. All an attacker bent on Industrial Espionage for gain has to do is get an undetectable rootkit. Package it with a file gathering payload. Deliver it via an unknown exploit to the target company and wait for all the companies’ information to flowing in.

This is why it is important for companies to have software installed on each machine that will stop software getting on to the machine in the first place.

Keep Safe,

regards
Steo
www.antirootkit.com

This entry was posted on Thursday, November 30th, 2006 at 5:07 pm and is filed under News, Debate, Corporate. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.