Researchers make anti-rootkit advance

One of the most insidious types of malware is a rootkit, which can effectively hide the presence of other spyware or viruses from the user – allowing third parties to steal information. But now researchers from North Carolina State University have devised a new way to block rootkits and prevent them from taking over computer systems.

Rootkits typically work by hijacking a number of ‘hooks,’ or control data, in a computer's operating system.

"By taking control of these hooks, the rootkit can intercept and manipulate the computer system's data at will," says Dr. Xuxian Jiang, assistant professor of computer science at NC State and a co-author of the research, "essentially letting the user see only what it wants the user to see."

As a result, the rootkit can make itself invisible to the computer user and any antivirus software. Furthermore, the rootkit can install additional malware, such as programs designed to steal personal information, and make them invisible as well.

In order to prevent a rootkit from insinuating itself into an operating system, Jiang and the other researchers determined that all of an operating system's hooks need to be protected. "The challenging part is that an operating system may have tens of thousands of hooks – any of which could potentially be exploited for a rootkit's purposes," Jiang says, "Worse, those hooks might be spread throughout a system. Our research leads to a new way that can protect all the hooks in an efficient way, by moving them to a centralized place and thus making them easier to manage and harder to subvert."

Jiang explains that by placing all of the hooks in one place, researchers were able to simply leverage hardware-based memory protection, which is now commonplace, to prevent hooks from being hijacked. Essentially, they were able to put hardware in place to ensure that a rootkit cannot modify any hooks without approval from the user.

The research, ‘Countering Kernel Rootkits with Lightweight Hook Protection,’ will be presented at the 16th ACM Conference on Computer and Communications Security in Chicago, Nov. 12. The study's co-authors are Jiang, Dr. Peng Ning, associate professor of computer science at NC State, NC State Ph.D. student Zhi Wang and Weidong Cui of Microsoft Research.

•Date: 4th Nov 2009• Region: World •Type: Article •Topic: ISM news
Rate this article or make a comment - click here