Stealthy malware expands rootkit repertoire
Burrowing worm borrows Windows vuln
Customer Success Testimonial: Recovery is Everything
Security researchers have discovered one of the most subtle and sophisticated examples of Windows rootkit software known to date.
The AutoRun-NOX worm extends the standard VXer trick of using software vulnerabilities to infect systems, by including functionality that allows the worm to exploit Windows security bugs to hook into parts of the Windows system that operate below the radar of anti-virus packages.
"Most malware with rootkit functionality will tamper with the Windows kernel and attempt to execute code in kernel mode," net security firm F-Secure reports. "Typically, a special driver is used to do this... AutoRun.nox is different — it uses a vulnerability to do the job. For malware, it's rather unique to see such a technique being used."
The worm uses a long-standing Windows vulnerability, patched by Microsoft in April 2007, involving a GDI privilege elevation flaw. If the attack using the vulnerability fails, the worm falls back to plan B - using the more common (but less elegant) driver method.
A blog posting by F-secure containing screenshots and a detailed technical run-down of the worm's modus operandi can be found here. ®
COMMENTS
Are you subbing for Dan Goodin or something?
Isn't GDI exploitation dead? Patched to death, and running in user level code only, neutering anything running in a limited user account. So much for root kits.
You sound like your colleague, beating dead horses and scaring us into hitting the update button multiple times per day.
Swear I saw something similar to this...
A few weeks ago at work. Was a pain to get rid of. Eventually just noted what was running at startup that wasn't signed, pulled the HD, deleted files with drive mounted on another machine (with autoruns disabled), then reinstalled & cleaned up the registry.
Strongly recommend using the Group Policy editor to disable autoruns on all drives.
Start>Run>gpedit.msc
if Microsoft...
...were legally obliged to send a physical copy of every critical fix to every registered user, they'd soon get the hang of checking for flaws...
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
