Malicious Javascripts are being used to install rootkits in the latest web attacks according to Marco Giuliani an Italian Virus Researcher.
“In May, 2006, users started to report some strange behavior in Windows: strange crashes at boot up, unusual reports of antivirus software reporting heuristic detections of files they couldn’t clean, and odd files appearing on the hard drive. Italian users reported the URLs of suspicious websites. When users visited these websites, their CPUs spiked abnormally high and their systems slowed down.
After these first signs, people reported infections of rootkits on their computers, discovered by some rootkit scanners. Removing this infection, on the other hand, would turn out to be much more difficult than expected. In August 2006, three months later, this infection is still spreading widely - not only in Italy, but to other countries as well. No security company has released an update for their engine or found a solution which totally removes the infection.”
Visitors to malicious websites were given a quick check over to see if they were using a browser that had a vulnerability or hole that could be used to install the rootkit and malware. Users PC’s were also checked to see if they had anti virus software running. The attackers also tried to fool the recipients into downloading an executable file called www.google.com which many users believed may have been a link to the famous site Google. In actual fact it was a mailcious file called www.google and the .com made it executable on a persons PC.
If the user had not updated the security patches on their Windows PC for MS06-001http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx ( Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution ) then a malicious WMF graphic file (img.tif) was downloaded on to their PC and this gave the attacker the option to remotely run code on the affected PC.
The rootkit component had two newish forms of stealth built in. One was the use of Reserved Names within Windows and the other is called ADS ( Alternative Data Streams ).
Reserved names for example begin with COM or LPT to name just two.
“It is impossible with normal file operations to delete or create files with these names, but, if you use the \\.\ prefix, you can delete and create these files easily with the command prompt. If you have a file called:
com4.gip
and try to do
del C:\com4.gip
you will receive an error because you can’t access this file as it uses a reserved name, but if you try to do:
del \\.\C:\com4.gip
you can bypass the check and fully delete the file.”
Alternative Data Streams exist on NTFS formatted disks which a lot of XP users would have.
“Alternate Data Streams (ADS) is a feature of the NTFS filesystem that can fork file data into existing files without affecting their functionality, size, and prevent traditional file browsing utilities from viewing the stream.”
“If you want to see the ADS features of the NTFS file system, you can click on Start - Run and write this command:
“notepad C:\autoexec.bat:mytest.txt”
Notepad will create a text file hidden in the ADS of the autoexec.bat file. The
“:” is used when you want to write to an ADS.”
To run Antirootkit programs like GMER and Icesword Marco found that he had to modify strings in the scanners by using a HEX Editor so that the rootkit could not identify the scanner by its checksum. Until the rootkit is removed the user cannot “see” the malicious files that the rootkit is hiding.
Have a read of the full articel here and get a feel for how malicious and advanced this rootkit is and the lengths the attackers used to keep their operation going. This is big and if it wasnt for people like Marco it probably would have been bigger.
Keep Safe
regards
Steo
www.antirootkit.com
rootkit