View Single Post
  #47  
Old July 16th, 2010, 07:56 PM
Rmus Rmus is offline
Exploit Analyst
 
Join Date: Mar 2005
Posts: 3,624
Default Re: Rootkit.TmpHider

Quote:
Originally Posted by wat0114
...would a whitelist or other anti-executable measure stop this?
I put the files on a USB drive and they are flagged as I view the drive in Windows Explorer:

Name:  rootkitTMP.gif
Views: 2172
Size:  21.5 KB

This exploit goes nowhere with proper protection in place. To test, using the command prompt, which simulates a lnk file attempting to start the two ~tmp files (see screen shot of the lnk file in the PDF):

Name:  rootkitTMP-cmd.gif
Views: 2133
Size:  12.0 KB

Being an espionage exploit, as has been suggested, begs the question of how company personnel acquire a USB drive infected with these files.

One scenario was proven to work some years ago. This article references a penetration test from 2006:

Island Hopping: The Infectious Allure of Vendor Swag
http://technet.microsoft.com/en-us/m...ritywatch.aspx

The original article was on DarkRoom's Perimeter/Security page, but doesn't seem to be accessible now.

----
rich

Last edited by Rmus : July 17th, 2010 at 01:33 AM.