The poisonous rootkits rocking the security world

There are some seriously stealthy rootkits running on computers today. Tom Brewster investigates the extent of the problem...

Cyber spy

It is the dark chameleon of the security world, the evil twin of Where's Wally?

Previous TLD versions loaded almost immediately after the OS booted up. Now, by going below the operating system, TDL-4 has become a powerful beast, able to hide dirty software on users' machines as it steals data before sending it back to command and control centre servers. Meanwhile, IT departments are left clueless.

Scary skills

Whilst TDL-4 is one of the most sophisticated and widespread rootkits around it infected over 4.5 million PCs in just three months earlier this year there are others with equally impressive skills.

Some have focused on exploiting hardware virtualisation technology and essentially pose as hypervisors. Once on a system, such rootkits host the targeted operating system as a VM, thereby intercepting machine interactions. It was what the Blue Pill concept imagined in 2006, the creators of which claimed was undetectable. Yet there have been no notable infections of such hypervisor rootkits in the wild.

Mebromi is one particularly terrifying piece of work that has made it onto actual machines, however. It is designed to infect the BIOS part of a machine the first software that loads when a PC is powered up. That's seriously low-level infection, beyond Ring Zero where anti-virus sits.

Detected on Chinese computers in September, the malware could infect the BIOS and then initiate more code to install another rootkit at the MBR and kernel levels.

The beauty/ugliness of Mebromi lies in its ability to re-infect on every system restart if it needs to. Even if anti-virus detects and cleans the MBR infection, it can be restored at the next startup when the malicious BIOS payload can overwrite the MBR code all over again. For an Advanced Persistent Threat (APT), this is the rootkit you want.

"It's really quite technical how they're doing this, but essentially what they want to do is hide their system processes and hide the bad things they want to do," said Kaspersky researcher Ram Herkanaidu.

"Even when Windows starts up, if you've got anti-virus or anything like that, because it is catching all the I/O requests and things like that, it can then give false information back. It's highly stealthy."

Thankfully for end users, Mebromi isn't likely to spread across the globe anytime soon. That's largely because of the complexity of a successful infection. Mebromi would have to be able to get inside all different versions of Award BIOS - used by Phoenix Technologies motherboards if it was to be truly useful to cyber criminals. Kernel-level or MBR infections like TDL can work on all PCs. If you were a cyber criminal, which kind would you punt for? It's a no-brainer.

Many will now be waiting for BIOS-infecting rootkits to emerge able to infect a wider range of systems, however. Looking at how diligently hackers have worked in the past few years, expect such noxious beasts to emerge in the near future.

Featured Resources

Unleashing the power of AI initiatives with the right infrastructure

What key infrastructure requirements are needed to implement AI effectively?

Download now

Achieve today. Plan tomorrow. Making the hybrid multi-cloud journey

A Veritas webinar on implementing a hybrid multi-cloud strategy

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

The workers' experience report

How technology can spark motivation, enhance productivity and strengthen security

Download now

Most Popular

WhatsApp could face €50 million GDPR fine
General Data Protection Regulation (GDPR)

WhatsApp could face €50 million GDPR fine

25 Jan 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

12 Jan 2021