The last exercise in the module and the last class of malware or route kids the discussion will cover
the definition of root kits and methods for detecting them.
A root kit is not necessarily malicious or harmful program
it's used to hide the existence of some process from users and administrators
what can be hidden using modern route kids this category can include other programs or their payloads
in the system.
Also internal system mechanisms can be hidden as well as services files directories user accounts an
active network connections a root kit can hide anything really.
This doesn't make it malicious per say.
Unfortunately it is often used to conceal the existence of programs that can harm your system.
Historically speaking the first virus brain made use of stealth techniques as well.
It wasn't strictly speaking a rootkit.
It didn't attempt to hide other objects but it did take cover in a system road kids have a relatively
long history the first root kit was written for Unix in the 60s.
The solution employed for the program was very simple.
It came to replace Unix systems tools for displaying files directories and processes with utilities
that did not display some files or selected processes.
Root kits have come a long way since that time
rude kids can be divided into three subgroups based on the working principle.
The first group of root kits are designed to hook user interface but not the kernel they execute in
the user mode.
The second class of rou kids alter kernel processes.
The third group modify data structures under the kernels API.
These are kids run at the lowest level
let's not discuss each type.
Let's start with user mode root kits that hook user api.
Imagine that a user launches Windows Task Manager.
The program is used to display active processes to perform this function.
The application calls a Windows API function implemented and TDL library.
If a root kit is placed in this library task manager would receive only selected information instead
of information on all active processes.
Explore when logon and malicious malware see information that a rootkit is trying to hide is filtered
then the user mode.
What are the strengths of user mode root kits.
Above all they can be run and executed without administrator permission.
A weakness for an attacker is that root kits that hook the user api are easy to detect.
Will show possible detection methods in a minute.
The popular hacker defender is an example of a user mode rootkit.
The free demo version of the rootkit is still available at.
W w w dot rootkit dot com.
It used to be developed extensively and personalized versions were sold for more than $100 dollars per
item in official free version of the rootkit was easily detected by anti-virus is in rootkit detectors
a tailored version was practically undetectable.
You could also buy a rootkit subscription from the vendor that guaranteed that the rootkit would not
be detected for six months.
The second type of root kits or kernel mode root kits that hook the kernel API.
Let's go back to the example given before a user or administrator wants to display a list of active
processes.
This time the list is not filtered user side but in a system function call a rootkit operates kernel
side and filters the calls by modifying kernel API
kernel mode root kits are much more difficult to detect which makes them more effective.
A drawback for attackers is that they require administrator permissions to run writing kernel mode rootkit
takes a lot more skills than other types of root kits.
It can be an example of malware that has been blocked at least for now through the use of defense mechanisms
such as the requirement to assign modules in kernel mode drivers or technologies that prevent patching
the kernel
enty a rootkit is a popular rootkit of this type.
It was created by the webmaster of w w w dot rootkit dot com.
A third type of root kits that execute at an extremely low level and are quite complex.
Our root kits that directly modify kernel data structures instead of kernel interface.
This makes rootkit code invisible even from the kernel but it still run
a system has to assign C-p time to the root kit from time to time.
Or the rootkit wouldn't have a chance to perform its function.
The cloaking is not performed by filtering API but in hiding directly in the kernel an example of a
root kit of this type is the aptly named F-you root kit.