Cyberstudy
PDF p.339 In progress

Rootkits

Open PDF at p.339 21 flashcards

Summary

PDF p.339

Rootkits are a type of malware that gain high-level privileges on a system, often through exploiting vulnerabilities. They can conceal their presence and perform various malicious activities, making them particularly dangerous.

Detailed explanation

PDF p.339
  • Privileges and Execution
    • User Privileges: Malware inherits the privileges of the logged-on user.
    • Administrator Privileges: Requires user confirmation via UAC or admin credentials.
    • SYSTEM Privileges: Critical processes run with SYSTEM privileges, higher than local admin.
  • Concealment Techniques
    • Process Names: Trojans may use deceptive names (e.g., "rund1132.exe" instead of "rundll32.exe").
    • Persistence: Achieved through registry entries or creating services.
    • Exploit Payloads: Can execute without authorization if exploiting severe vulnerabilities.
  • Rootkit Capabilities
    • System Changes: Can theoretically change anything on the system.
    • Detection Evasion: May compromise system files and interfaces to hide from tools like Explorer, taskmgr, or netstat.
    • Log Cleaning: Contains tools to clean system logs.
  • Privilege Rings
    • Ring 0: Most privileged, direct hardware access (kernel processes).
    • Ring 3: User-mode processes.
    • Ring 1 and 2: Drivers and I/O processes.
    • Virtualization: Adds complexity to this architecture.
  • Firmware Rootkits
    • Persistence: Can reside in computer or peripheral firmware.
    • Survival: Survive OS reinstallation and drive formatting.
    • Examples: DarkMatter and Quark Matter UEFI rootkits targeting Apple Macbook firmware.

Important terms

taken from the text above
User Privileges
Malware inherits the privileges of the logged-on user.
Administrator Privileges
Requires user confirmation via UAC or admin credentials.
SYSTEM Privileges
Critical processes run with SYSTEM privileges, higher than local admin.
Process Names
Trojans may use deceptive names (e.g., "rund1132.exe" instead of "rundll32.exe").
Persistence
Achieved through registry entries or creating services.
Exploit Payloads
Can execute without authorization if exploiting severe vulnerabilities.
System Changes
Can theoretically change anything on the system.
Detection Evasion
May compromise system files and interfaces to hide from tools like Explorer, taskmgr, or netstat.
Log Cleaning
Contains tools to clean system logs.
Ring 0
Most privileged, direct hardware access (kernel processes).
Ring 3
User-mode processes.
Ring 1 and 2
Drivers and I/O processes.
Virtualization
Adds complexity to this architecture.
Survival
Survive OS reinstallation and drive formatting.

What I should remember

Key Points PDF p.339
  • Privileges and Execution
    • User Privileges: Limited to user profile actions.
    • Administrator Privileges: Requires UAC confirmation.
    • SYSTEM Privileges: Highest level, critical processes.
  • Concealment Techniques
    • Deceptive Process Names: Mimic legitimate files.
    • Persistence Methods: Registry entries, services.
    • Exploit Payloads: Execute without user authorization.
  • Rootkit Capabilities
    • System Changes: Extensive potential changes.
    • Detection Evasion: Hides from system tools.
    • Log Cleaning: Conceals activity.
  • Privilege Rings
    • Ring 0: Kernel processes.
    • Ring 3: User-mode processes.
    • Ring 1 and 2: Drivers, I/O processes.
    • Virtualization: Adds complexity.
  • Firmware Rootkits
    • Persistence: In firmware, survives OS reinstall.
    • Examples: DarkMatter, Quark Matter.