The poisonous rootkits rocking the security world

There are some seriously stealthy rootkits running on computers today. Tom Brewster investigates the extent of the problem...

It is the dark chameleon of the security world, the evil twin of Where's Wally?

Previous TLD versions loaded almost immediately after the OS booted up. Now, by going below the operating system, TDL-4 has become a powerful beast, able to hide dirty software on users' machines as it steals data before sending it back to command and control centre servers. Meanwhile, IT departments are left clueless.

Scary skills

Whilst TDL-4 is one of the most sophisticated and widespread rootkits around it infected over 4.5 million PCs in just three months earlier this year there are others with equally impressive skills.

Some have focused on exploiting hardware virtualisation technology and essentially pose as hypervisors. Once on a system, such rootkits host the targeted operating system as a VM, thereby intercepting machine interactions. It was what the Blue Pill concept imagined in 2006, the creators of which claimed was undetectable. Yet there have been no notable infections of such hypervisor rootkits in the wild.

Mebromi is one particularly terrifying piece of work that has made it onto actual machines, however. It is designed to infect the BIOS part of a machine the first software that loads when a PC is powered up. That's seriously low-level infection, beyond Ring Zero where anti-virus sits.

Detected on Chinese computers in September, the malware could infect the BIOS and then initiate more code to install another rootkit at the MBR and kernel levels.

The beauty/ugliness of Mebromi lies in its ability to re-infect on every system restart if it needs to. Even if anti-virus detects and cleans the MBR infection, it can be restored at the next startup when the malicious BIOS payload can overwrite the MBR code all over again. For an Advanced Persistent Threat (APT), this is the rootkit you want.

"It's really quite technical how they're doing this, but essentially what they want to do is hide their system processes and hide the bad things they want to do," said Kaspersky researcher Ram Herkanaidu.

"Even when Windows starts up, if you've got anti-virus or anything like that, because it is catching all the I/O requests and things like that, it can then give false information back. It's highly stealthy."

Thankfully for end users, Mebromi isn't likely to spread across the globe anytime soon. That's largely because of the complexity of a successful infection. Mebromi would have to be able to get inside all different versions of Award BIOS - used by Phoenix Technologies motherboards if it was to be truly useful to cyber criminals. Kernel-level or MBR infections like TDL can work on all PCs. If you were a cyber criminal, which kind would you punt for? It's a no-brainer.

Many will now be waiting for BIOS-infecting rootkits to emerge able to infect a wider range of systems, however. Looking at how diligently hackers have worked in the past few years, expect such noxious beasts to emerge in the near future.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Most Popular

Windows XP source code allegedly leaked online
Microsoft Windows

Windows XP source code allegedly leaked online

25 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020