A forum for reverse engineering, OS internals and malware analysis 

Some stuff from my ZeroNights 2012 talk about the rootkits

All off-topic discussion goes here.

Re: Some stuff from my ZeroNights 2012 talk about the rootki

 #17598  by EP_X0FF
 Fri Jan 04, 2013 5:06 pm
Hi,

thanks for sharing, it is of course interesting, since no one else doing anything on public now and ITW malware rootkits become boring or died / stoped evolving.
Seems in rootkit you reimplemented yours old regbd idea dated back to 2006(?) + added feature your previously released (https://github.com/Cr4sh/DrvHide-PoC/bl ... driver.cpp, was discussed earlier http://www.kernelmode.info/forum/viewto ... f=11&t=574). Good job overall.

Kind Regards.

Re: Some stuff from my ZeroNights 2012 talk about the rootki

 #17601  by Cr4sh
 Fri Jan 04, 2013 5:44 pm
EP_X0FF wrote:reimplemented yours old regbd idea dated back to 2006(?)
No, It's completely different research motivation and background, also the new rootkit doesn't modify anything except few registry values at all. It blindly exploits zero day vulnerability in win32k.sys for startup from the system registry at os boot.

Re: Some stuff from my ZeroNights 2012 talk about the rootki

 #17602  by EP_X0FF
 Fri Jan 04, 2013 6:03 pm
Cr4sh wrote:
EP_X0FF wrote:reimplemented yours old regbd idea dated back to 2006(?)
No, It's completely different research motivation and background, also the new rootkit doesn't modify anything except few registry values at all. It blindly exploits zero day vulnerability in win32k.sys for startup from the system registry at os boot.
Thanks for clarification. What do you think about different method of startup, in case if this bug will be patched? With keeping registry as rootkit home. I assume since it was public speak this zeroday maybe already reported to MSRC?

Re: Some stuff from my ZeroNights 2012 talk about the rootki

 #17604  by Cr4sh
 Fri Jan 04, 2013 6:18 pm
EP_X0FF wrote:What do you think about different method of startup, in case if this bug will be patched?

There is a lot of similar bugs and attack vectors.
With keeping registry as rootkit home. I assume since it was public speak this zeroday maybe already reported to MSRC?
Just because such rootkits are not for the mass-spreading malware.

Re: Some stuff from my ZeroNights 2012 talk about the rootki

 #17605  by EP_X0FF
 Fri Jan 04, 2013 6:30 pm
Cr4sh wrote:There is a lot of similar bugs and attack vectors.
I thought so, win32k is a complete bugfest :) Latest fun denial of service bug with nested windows and hittest for example published week ago.

As for discardable sections hiding, have you anyhow changed this method for this rootkit, from your initial release? Sorry being lazy to look and compare sources.
 Return to “General Discussion”