The Register® — Biting the hand that feeds IT

Feeds

Stealthy malware expands rootkit repertoire

Burrowing worm borrows Windows vuln

Customer Success Testimonial: Recovery is Everything

Security researchers have discovered one of the most subtle and sophisticated examples of Windows rootkit software known to date.

The AutoRun-NOX worm extends the standard VXer trick of using software vulnerabilities to infect systems, by including functionality that allows the worm to exploit Windows security bugs to hook into parts of the Windows system that operate below the radar of anti-virus packages.

"Most malware with rootkit functionality will tamper with the Windows kernel and attempt to execute code in kernel mode," net security firm F-Secure reports. "Typically, a special driver is used to do this... AutoRun.nox is different — it uses a vulnerability to do the job. For malware, it's rather unique to see such a technique being used."

The worm uses a long-standing Windows vulnerability, patched by Microsoft in April 2007, involving a GDI privilege elevation flaw. If the attack using the vulnerability fails, the worm falls back to plan B - using the more common (but less elegant) driver method.

A blog posting by F-secure containing screenshots and a detailed technical run-down of the worm's modus operandi can be found here. ®

Ensure Ease of Recovery with Asigra’s Agentless Software

Latest Comments

Are you subbing for Dan Goodin or something?

Isn't GDI exploitation dead? Patched to death, and running in user level code only, neutering anything running in a limited user account. So much for root kits.

You sound like your colleague, beating dead horses and scaring us into hitting the update button multiple times per day.

0
0

Swear I saw something similar to this...

A few weeks ago at work. Was a pain to get rid of. Eventually just noted what was running at startup that wasn't signed, pulled the HD, deleted files with drive mounted on another machine (with autoruns disabled), then reinstalled & cleaned up the registry.

Strongly recommend using the Group Policy editor to disable autoruns on all drives.

Start>Run>gpedit.msc

0
0

if Microsoft...

...were legally obliged to send a physical copy of every critical fix to every registered user, they'd soon get the hang of checking for flaws...

0
0

More from The Register

 breaking news
NSA PRISM-gate: Relax, GCHQ spooks 'keep us safe', says Cameron
Whatever they are up to, it's all above board, we're told
PRISM snitch claims NSA hacked Chinese targets since 2009
Snowden suddenly looks safer in Hong Kong after revelations
 breaking news
US chief spook: Look, we only want to spy on 6.66 BEELLLION of you
Americans assured they are not in the NSA's sights
Speech-to-text drives motorists to distraction
Will talking to you mean I crash into that car up ahead, Siri?
DHS warns of vulns in hospital medical equipment
Has your doctor's anasthesia machine been hacked?
 breaking news
Yes, maybe we should keep hackers in the clink for YEARS, mulls EU
Watch out black hats, they just might throw away the key
Microsoft borks botnet takedown in Citadel snafu
Stupid Redmond kicked over our honeypots, wail white hats
Critical Java SE update due Tuesday fixes 40 flaws
And yes, most are remotely exploitable
 breaking news
'BadNews is malware' says outfit that found it
Google says code harmless but Lookout says code base is evolving