Another fascinating read from emailbattles, this one covers Window's rootkits, which I've been hearing more and more about lately.

Disclaimer, notice:::
Take note here, a rootkit is not a Windows only phenomena. But it is Windows that is easiest to take over due to the incredibly poor built in default security settings Microsoft continues to release it's products with. And the horrible, by design, built in security chasms that give direct access to core operating system functions, like MSIE's active x, that no other operating system has.

The attacks begin... what one rootkit author has to say

You may recall for example the recent problems Sony created with their copy protection installing a rootkit on Windows. For those of you wondering just why that was so bad, this type of article should begin to explain the problems. And also why Sony was immediately found guilty, and immediately settled the case, and immediately stopped using that method.

These types of methods are growing increasingly complex in nature, and the antivirus game of protect after the attack happens may have a limited lifespan.

What are rootkits for?

This is not good news for anyone trying to maintain a secure windows computer.

What is a rootkit?

Note the keywords here: after a successful intrusion. On windows, this can mean simply connecting to the internet, literally. Or going to a website with Internet Explorer. Or simply VIEWING an infected email. On unix based system it's generally quite a bit more difficult to achieve 'a successful intrusion'. Not impossible, but more difficult.

From the comments section of the emailbattles article:



So it's a tool to do something, but that something is not in and of itself illegal. Sort of like a gun I guess in areas where owning a gun is legal.

How do they avoid detection?



How bad is the problem?

20% of machines with XP service pack 2 with rootkits. This is just one type of malware keep in mind. Download the Windows rootkit cleaner. More on removing these things from emailbattles.com.

What to do?
Again from the comments:



You've read this a hundred times by now, and let's cover the same ground again:

Don't use MSIE or Outlook / Outlook Express
MSIE active x is the number one attack vector for such devices to install themselves on your system.

As has been pointed out to me by others, disabling active x completely is not enough, there have been, and continue to be, exploit after exploit that use for example javascript to switch on active x through other security holes.

The solution is to not use MSIE for any reason, ever, except to run windows update. Firefox, by Mozilla.org, is a great browser, and much more secure than MSIE.

The same goes for email: do not use any Windows program that depends on the MSIE HTML rendering engine to display html emails. That includes Outlook and Outlook Express. Thunderbird email client from mozilla.org set to view all emails in plain text mode is a great product.

Despite promises to fix the security of these issues, major holes continue to show up. Why is this? Because active x is still in existence. Until active x goes, security will never be achieved. MSIE and Outlook products must be rewritten from the ground up. All active x functionality must be removed from the core browser engine, and only be attached as an optional module which can be physically removed from the system.

Since this is not going to happen, you need to stop using MSIE for all web accessing. Noone I know who has fully switched to a non-MS email and browsing package has had any significant issues with spyware, viruses, trojans, or anything else.

But the coming Windows Vista will take care of these security issues, right?
Sadly, no:

And on and on it goes. Very nice sequence of articles by emailbattles, that site has been doing some nice work lately. For those of you paying attention, take note of what AV products are NOT mentioned.

Conclusions:
A standard windows user with no hardware firewall like a router, and running any windows without a software firewall, any Windows pre XP SP 2 that is, and who connects to the web, can be assumed to be infected.

Any standard user with ideally a hardware firewall in place but running standard MSIE and Outlook type products can be assumed to probably be infected.

Any user running firewalls and not using MS products to access the web in any way, email or websites, can be assumed to be less at risk, but still vulnerable due to the tendency to fall for social engineering attacks [like, I included the file you wanted; check out this screensaver; check out hot pix of <someone>, and so on...].

The 20% rootkit infection rate for XP SP 2 users is particularly disturbing. Keep in mind that this is only rootkits, not generic spyware or other types of malware, trojans, viruses, etc.

Essentially, only windows power users can hope to avoid infection, or people with power user friends who can train them how to do this. This is because Windows is barely useable if you run it in standard user mode, with restricted permissions. I tried having a client run in this protected mode and her Outlook 2003 would simply not work. That's right, an MS product would not run in that mode. Plus that triggered some other networking issues that took almost 1 year to resolve due to the bugs that were unearthed in the process.

MS is not designed to run in protected user mode, it's been built around running in administrator, full privilege mode. That's the direct opposite of unix based systems like Mac OSX and Linux.
Back to top

Interesting. I downloaded the "fix" just to see....

Okay. Now, y'all need to realize I am no neophyte with machines or windows (newish with linux, but that's nothing to do with this.) I have yet to install XP SP2. I've run this machine on XP SP1 ever since it was new (12/2002). I bought a full-version XP Pro after I got this machine, wiped the proprietary cr#p off the drive and installed XP MY way.

I've never done any of the "panic updates" windows insists you need to be "safe". Not one. I've never accessed the 'net with IE. I use IE on my localhost install ONLY - to look at sites I design locally (using XAMPP) before I put them online.

I used to use OE, but over a year ago moved to t'bird, and have been using it in tandem with Firefox and/or Opera (though I really don't like Opera, I mostly just check site display with it). I don't ever download mail to my machine unless I've vetted it first with MailWasher (which I've used since it was 0.5....) I don't click on oddball stuff online, and I use adblockers, popup stoppers, Spybot S&D, and a bunch of layered firewalls, virus programs, etc. I don't have a hardware firewall however, because I don't have broadband, so my "network" machines must connect separately.

I was interested to see if I might have a hidden timebomb - but guess what? Nothing. Ran the rootkit "rooter" on both my desktop and my laptop (same as all the above, except IS XP SP2, and XP Home at that *sigh*), and not one thing popped up. Absolutely clean. According to MS that is.

So I guess I'll go on my merry way. I'm pretty careful, and that's all that's required for me I guess!
Back to top