One man’s fight against rootkits

When Mark Russinovich last October revealed how Sony BMG Music Entertainment was secretly using a rootkit aimed at copyright protection for its CDs, the public took Sony to task – and to court – and Russinovich gained some unexpected fame. The Sony case has been settled, but experts say the rootkit threat is growing. Network World Senior Editor Ellen Messmer recently spoke with Russinovich, co-founder of Winternals Software, about where the rootkit situation stands today.

Is there a common definition of a rootkit?

Not one formally agreed upon, but the one I came up with is that it is anything in the software realm that hides objects from standard security administration or management.

While rootkits used by malicious hackers are obviously bad, there are arguments as to whether rootkits could be used in commercial software for good purposes. What’s your view?

There is no such thing as a good rootkit. They modify the way the operating system works, and that causes pain on the part of the person managing the system. Cloaked objects could introduce vulnerabilities in the system, as happened with the Sony rootkit.

How prevalent are rootkits with obvious malicious intent?

There’s an accelerated use of rootkits. More and more, viruses are shipped with them. People are paying for this now in the context of spyware and botnets, because sophisticated people are treating rootkits like a business. By the way, the very first virus on the PC – 20 years ago this year – was called Brain, and it was a rootkit that has been coined a stealth virus.

What’s the difference between a user-mode and a kernel-mode rootkit?

At the [administrative] level, a rootkit can install itself at the system level in kernel mode. A user-mode rootkit could be installed by a person without administrative privileges.

Is there a guaranteed way to find all rootkits?

There is no 100% remedy for rootkits.

Why is it so hard to do away with rootkits?

The problem fundamentally is there are so many ways to extend Windows and modify its behavior. It’s not possible to tell evil and good extensions apart. All operating system software suffers from this. If you have a single instance of malicious code that executes in a machine, you have to assume you lost control of the machine.

So what was it like when you announced in your blog you had discovered a rootkit used by Sony BMG for its CDs?

Literally six hours after revealing it, it was on Slashdot, and in the mainstream media in the next few days. I ended up serving as an expert for the first class-action lawsuit that was filed, by supplying a statement.

Were you looking for a rootkit in this case?

I just happened to purchase a CD. I don’t make it my job to go out and police software. But I make it a point to understand what is going on when there’s any strangeness in Windows.

What happened in the case earlier this year when you accused Symantec of using rootkit techniques in its SystemsExpert product?

I didn’t view that in the same light as the Sony [case]. Sony’s was installed without the user’s knowledge and was there to limit the user. In Symantec’s case, they thought it would help the user, but that was flawed and they admitted it.

Why don’t you sell your freeware, RootkitRevealer?

Because we don’t believe in charging for something that we can’t guarantee can reveal everything.

Is any company leading the attack on this problem?

Not that I’m aware of. The bottom line is, don’t trust your ability to clean your machine of a rootkit. You’ve got to assume the worst. My advice is, wipe the system and start from scratch. You’ll have to do it manually.

So what approach do you take to the rootkit problem inside your company?

We came up with software with application controls, which is policy-specific about what users can run. It’s a way to prevent unrecognized applications from executing through the standard operating system.

Tell us about the contest you had to detect rootkits designed by the Czech-based designer calling himself Holy Father, who was selling gold versions of his rootkits for hundreds of dollars until he dropped out of sight on the Web earlier this year.

I was never actually in direct communication with Holy Father. He would say things publicly on his Web site, advertising how his gold rootkit would defeat our detector, RootkitRevealer. It was an intriguing contest. And he had the upper hand. We were releasing RootkitRevealer publicly to defeat his plain-vanilla root- kits, but his gold versions were only revealed to his customers.

How did you get interested in rootkits?

With my background in operating systems, I was familiar with rootkits for Unix systems back in the mid-’90s. Rootkits generally involved modifying the way the operating system works. In my Ph.D. in ’94 at Carnegie Mellon University, titled “Application Transparent Fault Tolerance,” I was dealing with some hooks in the operating system that a rootkit might use.

Later, one of the tools I wrote for Windows was Regmon, because until a few years ago, we had no way to monitor the registry activities. The system-hooking techniques we published in Dr. Dobb’s Journal in ’96 was a bread-and-butter technique for intercepting the operating system. I’m always watching what’s going on in development, for example at Rootkit.com.

The Sony rootkit was one that generated mainstream awareness, so in March, we made Rootkit Revealer available on [his hobby site for freeware] SysInternals. It uses a cross-view comparison to look at a system using APIs.