A rootkit is a type of malware that lets cyber attackers gain access to and infiltrate data from systems without being detected. An example would be a software toolbox designed to infect computers to give attackers remote control while remaining hidden for an extended period.
The malware is one of the most difficult to discover and remove. It is, therefore, frequently used to eavesdrop on users and launch destructive attacks.
The malware can come with multiple capabilities. The most common can turn systems into bots for launching distributed denial-of-service (DDoS) attacks, disable cybersecurity software, steal banking and credit card details and passwords, and log keystrokes.
Finally, the malware can give attackers back doors into systems, providing unfettered access that lets them change or remove software and components.
Read More about a Rootkit
Learn all about one of the most challenging malware to detect in this post.
A Brief History
The term, also known as “rkit” or “root kit,” originally referred to a maliciously modified set of administrative tools for a Unix-like operating system (OS) that granted users root access. That said, attackers who manage to replace the standard administrative tools on a system with the malware obtains root or complete access over the system while concealing their activities from legitimate system administrators.
The first documented one, as we know it today—a malicious program, was discovered in 1986. Dubbed the “Brain virus,” it used cloaking techniques to hide.
The first to attack Windows OSs was discovered in 1999. It was a Trojan called “NTRootkit” created by Greg Hoglund. The first to target macOS, meanwhile, was introduced during the Black Hat conference in 2009. The Stuxnet worm, discovered in 2010, was the first to target programmable logic controllers (PLCs).
This video shows how the malware works.
What Are Its Types?
The malware can come in various forms and we named them below.
Application Rootkit
This type modifies regular files with malicious code, giving the malware author access to your machine every time you run infected files. Unlike other types, this is easier to detect because infected files behave unusually, giving security solutions a better chance of identifying them.
Bootloader Rootkit
You may not be aware of it but each time you turn your computer on, its bootloader loads the OS. Also known as a “bootkit,” it infiltrates the bootloader, running even before the OS is ready to use. Note, however, that bootkits are now easier to address, thanks to security features like Secure boot.
Firmware Rootkit
Did you know that all kinds of devices—from washers to mobile phones—have firmware? Firmware is a type of software that provides rudimentary control over the piece of hardware it is written for. That is where the malware hides, making it hard to find because cybersecurity solutions do not usually look for malware in it.
Kernel Rootkit
An OS kernel is essentially your computer’s nervous system. A system will not work without it. The malware can thus be entirely disastrous because it attacks a core component and gives threat actors complete control over a system.
Memory Rootkit
This type resides on your computer’s random access memory (RAM). As such, it slows down your machine while performing malicious tasks. Less complex versions can usually be cleared by restarting your system since it clears your machine’s memory of all processes.
What Are the Signs of Infection?
Despite having the ability to hide from security solutions, it is possible to spot infections. Here are signs you can look out for.
1. Blue Screen of Death
A definite sign of infection is a Windows error message or blue screen with white text, also known as the “blue screen of death (BSoD),” causing your computer to constantly reboot.
2. Slow Device Performance
A device that takes a long while to start and performs slowly or freezes often could be infected as well. It may also fail to respond to mouse or keyboard inputs.
3. Unwanted Settings Modifications
If your screensaver, taskbar, or date and time display and settings have changed without your consent, your computer may have been infected.
4. Unusual Web Browser Behaviors
Some can also cause link redirections when you access any of your bookmarked sites.
5. Web Page Malfunctions
Another telltale sign of infection is when you experience intermittent network connection or web page malfunctions. These can be caused by excessive network traffic.
What Are Its Devastating Effects?
Threat actors use the malware because they have very useful payloads. First, they can give attackers full access to a system via a backdoor. That way, they can steal or falsify documents.
In some cases, they can conceal other malware, notably password-stealing keyloggers. In other instances, compromised machines can be turned into zombies for DDoS and other attacks.
What Are Its Popular Examples?
Over time, we have seen attackers use the malware. Here are some of the most notorious examples.
TDSS
Discovered way back in 2008, TDSS is considered a bootkit since it loads and runs as soon as the OS starts. It is thus hard to detect and remove.
Stuxnet
Still the most notorious in history, Stuxnet is a computer worm discovered in 2010. It caused substantial damage to Iran’s nuclear program. Although neither country admitted responsibility, it is widely believed to be a cyber weapon jointly created by the U.S. and Israel in a collaborative effort known as the “Olympic Games.”
Stuxnet largely differed from others in that it infected PLCs, which are not connected to the Internet. See how it worked below according to the Institute of Electrical and Electronics Engineers (IEEE).
ZeroAccess
In 2011, ZeroAccess infected more than 2 million computers worldwide. Instead of directly affecting the functionality of infected systems, it downloaded and installed malware to make them part of a botnet hackers used to carry out various cyber attacks. Threat actors still use the malware to this day.
Flame
Flame was used to spy on countries in the Middle East and discovered in 2012. Also known as “Flamer,” “sKyWIper,” or “Skywiper,” it affected a computer’s entire OS. As such, it gave attackers the ability to monitor traffic, capture screenshots and audio, and log keystrokes. While its creators were not found, research suggests they used 80 servers across three continents to access infected computers.
Necurs
Throughout 2012, Necurs emerged and was detected in 83,000 infections. Associated with elite cybercriminals hailing from Eastern Europe, it stood out due to its technical complexity and ability to evolve.
How Can You Protect against the Malware ?
Protection against the malware is twofold. Since they are typically hard to detect and remove, prevention is almost always better than cure so that is the first step. But if any of your network-connected systems has already been infected, removal is still possible and recommended.
Infection Prevention
Here are some ways to prevent the malware from infecting your computer.
Don’t Get Phished
Phishing awareness is critical to avoiding infections. Like most other malware types, attackers use phishing messages to get victims to install the malware. That said, it is vital to be aware of common phishing tactics like always verifying a sender’s email address and never clicking links embedded in emails or downloading attachments.
Do Patch Software Regularly
Outdated and unsupported software (i.e., those that have reached their end of life) are prime cyber attack targets. They are, after all, vulnerable to exploitation and, therefore, malware installation. That said, do not forget to install patches as soon as they are made available. Better yet, set all your applications to automatically update.
Do Use Anti-Malware
While anti-malware is not a foolproof means to defend against the malware, they can still detect their presence. After that, you may need to use more targeted tools for removal, if any are found.
Do Scan and Filter Network Traffic
Use traffic-filtering software to monitor and scan incoming and outgoing network traffic at all times. These applications can help detect the malware before they can infiltrate computers.
Detection and Removal
If, however, prevention is too late, follow the process below to remove the malware.
- Back up critical information: No one can predict how the malware will behave when it is removed. It may have built-in defensive measures that can damage the affected system. As such, you must back up important data and files even before starting the removal process.
- Boot up the affected computer in safe mode: Many prevent users from executing security solutions to remove them. If that is the case, restart the computer in safe mode with networking to limit the malware’s access. To do that, simply press F8 during the bootup process.
- Use as many dedicated scanning tools as possible: There are many types, especially new ones. And while a scanner may detect some, it may fail to discover all. If you are unsure of the scanner’s capability, use a combination of scanners with different offerings.
- Freeze the malware’s remnants: Unfortunately, removing the malware does not always guarantee your computer is clean. It may have been infected by other malware the rootkit dropped. In this case, use other security solutions to address the remaining malware.
- What to do if all else fails: Some are very hard to remove. Firmware rootkits, for instance, cannot be removed by standard scanners. If that is the case, you need to back up and wipe the data from the affected computer and reinstall the OS. If the malware targeted the Basic Input/Output System (BIOS), however, data wiping and OS reinstallation are still not enough. You need to wipe and replace the BIOS drive then perform a hard reset of the computer.
Does the Malware Have Nonmalicious Uses?
Sometimes, developers create nonmalicious versions to provide desired functionality. They can, for instance, detect attacks in a honeypot. Others can enhance emulation and security software. Still others provide anti-theft protection. Case in point? A few laptops have BIOS-based rootkits that periodically report to a central authority, allowing it to be monitored, disabled, or wiped of information in case it gets stolen.
—
As you have learned, the malware is very hard to detect and remove. As such, preventing infection is the way to go about things. But, while the malware is generally classified as malicious in the realm of cybersecurity, it can also have legitimate uses.
Key Takeaways
- A rootkit is a type of malware that lets cyber attackers gain access to and infiltrate data from systems without being detected.
- It is one of the most difficult malware to detect and remove.
- The malware, as we know it today, has been around since 1986, when the Brain virus was discovered.
- It comes in various forms, depending on what device it is designed to infect. It can infect an application, the bootloader, firmware, a kernel, or the memory.
- BSoD, device lags, and unauthorized settings modifications are just some of the signs of infection.
- The malware can be armed with very useful payloads for attackers, such as full access to a system via a backdoor, concealment for other malware, and turning infected systems into bots.
- Stuxnet is probably the most infamous to date, but we have seen other notable ones like TDSS, Necurs, and Flame as well.
- Since the malware is very difficult to detect and remove, prevention is considered better than cure.
- Avoiding infection is possible if you patch systems regularly, use anti-malware, and scan and monitor network traffic at all times.
- Removing the malware requires backing up critical data, booting in safe mode, using scanners, removing dropped malware, and sometimes, BIOS drive wiping or even replacement.
- Some are not malicious. Legitimate uses include detecting attacks in a honeypot, enhancing emulation and security software, and providing anti-theft protection.
Sources
- https://en.wikipedia.org/wiki/Rootkit
- https://www.fortinet.com/resources/cyberglossary/rootkit
- https://www.kaspersky.com/resource-center/definitions/what-is-rootkit
- https://www.malwarebytes.com/rootkit
- https://csrc.nist.gov/glossary/term/rootkit
- https://www.paloaltonetworks.com/cyberpedia/rootkit
