The poisonous rootkits rocking the security world

There are some seriously stealthy rootkits running on computers today. Tom Brewster investigates the extent of the problem...

It is the dark chameleon of the security world, the evil twin of Where's Wally?

Previous TLD versions loaded almost immediately after the OS booted up. Now, by going below the operating system, TDL-4 has become a powerful beast, able to hide dirty software on users' machines as it steals data before sending it back to command and control centre servers. Meanwhile, IT departments are left clueless.

Scary skills

Whilst TDL-4 is one of the most sophisticated and widespread rootkits around it infected over 4.5 million PCs in just three months earlier this year there are others with equally impressive skills.

Advertisement - Article continues below
Advertisement - Article continues below

Some have focused on exploiting hardware virtualisation technology and essentially pose as hypervisors. Once on a system, such rootkits host the targeted operating system as a VM, thereby intercepting machine interactions. It was what the Blue Pill concept imagined in 2006, the creators of which claimed was undetectable. Yet there have been no notable infections of such hypervisor rootkits in the wild.

Mebromi is one particularly terrifying piece of work that has made it onto actual machines, however. It is designed to infect the BIOS part of a machine the first software that loads when a PC is powered up. That's seriously low-level infection, beyond Ring Zero where anti-virus sits.

Detected on Chinese computers in September, the malware could infect the BIOS and then initiate more code to install another rootkit at the MBR and kernel levels.

The beauty/ugliness of Mebromi lies in its ability to re-infect on every system restart if it needs to. Even if anti-virus detects and cleans the MBR infection, it can be restored at the next startup when the malicious BIOS payload can overwrite the MBR code all over again. For an Advanced Persistent Threat (APT), this is the rootkit you want.

"It's really quite technical how they're doing this, but essentially what they want to do is hide their system processes and hide the bad things they want to do," said Kaspersky researcher Ram Herkanaidu.

"Even when Windows starts up, if you've got anti-virus or anything like that, because it is catching all the I/O requests and things like that, it can then give false information back. It's highly stealthy."

Advertisement - Article continues below

Thankfully for end users, Mebromi isn't likely to spread across the globe anytime soon. That's largely because of the complexity of a successful infection. Mebromi would have to be able to get inside all different versions of Award BIOS - used by Phoenix Technologies motherboards if it was to be truly useful to cyber criminals. Kernel-level or MBR infections like TDL can work on all PCs. If you were a cyber criminal, which kind would you punt for? It's a no-brainer.

Many will now be waiting for BIOS-infecting rootkits to emerge able to infect a wider range of systems, however. Looking at how diligently hackers have worked in the past few years, expect such noxious beasts to emerge in the near future.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now

Most Popular

data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
cyber security

If not passwords then what?

8 Jan 2020
Policy & legislation

GDPR and Brexit: How will one affect the other?

9 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020