SAMURAI. Useful enough to stop all drivers?

Anyone with some past experience with the app Samuari, do you find the "prevent rootkits from installing" feature something of the past with little or no use or can anyone verify or confirm that by applying this one particual feature, can you confirm with some certainty that it still is in it's lack of long overdue updating still prove useful enough to depend on as an additional hardening application that prevents ANY drivers installs AFTER it's been applied to a system setup?

This is some interest because in my testing this one aspect of the other many of features that it offers seems to prevent even IceSword/Rku, and other apps flat out denying them to activate/load those analysis apps drivers in effect rendering them disable.

Just wondering if it's that strong and and could also defend attempts at rootkit intallations.

Thanks EASTER

 

Easter,

I tested it on XP SP2, and it worked fine. I have not tested it under SP3 lately, but you are still running SP1 don't you. In that case it does not matter (f.i. WinPooch does not work 100% under XP3).

Regards Kees

 

Your observations are corrrect EASTER post 9 on

 

EASTER,

I thought you were using LUA/SRP (which alone reliably prevent the installation of any rootkit/driver) plus EQS and/or SSM? Why bother about Samurai at all

 

Why bother at all - to test, find out and learn about it. I know he tests alot and goes after malware. I should imagine EASTER has images, snapshots, test machines and vms with all sorts of configs.

 

maybe lots of free time as well
i heard good things about samurai too btw ;p
too bad this one is "the last of the samurai" :/

 

I've had this just sitting on the box for a while: no specific issues, in fact, sort of forgotten it was there.
Apart from hooking, the configs are an extensive set of registry tweaks..
http://gladiator-antivirus.com/forum/index.php?showtopic=51273&hl=

where ??

??
Why do you say that?
No real updates or development for quite some time: not even sure it would function in blista
I admit to not really checking for myself for a long time since that thread quoted above https://www.wilderssecurity.com/showthread.php?t=167309&highlight=samurai hips

heh:Meriadoc really put it through it's paces.
The way it is written I doubt there is any need for updating as such.
(and it is only 18 months... )

 

Most my units i have turned to SP2 now with few exceptions of other HD's.

Why not both? Or would that be considered redundant in a SuRun LUA setup?

Thanks for the reassuring confirmation, i thought as much from my testings but wanted to sure others experienced similar protection with use of it.

Thanks Longboard for the links and boy i would love for it to be updated again myself seeing as according to Gladiator Forums that was 2007.

It would be so fantastic for super hardening and to put the proverbial icing on the cake wouldn't it be a treat if he could somehow add a way to protect the MBR/Partition Table from the likes of (Ugh) KillDisk and other destructive system disruptors.

 

Definitely. With limited rights you can't install a driver or a rootkit. In that regard even SSM/EQS are already redundant.

 

with LUA+SRP onboard ( i have tlu to thatnk for that) the only thing u need is file control , in case something tries to fool SRP and maybe registry guard for the 7 open entries that LUA lets open and like in my case you do not wanna use kafu (gave me BSOD)

 

A BSOD Shouldn't happen. Did you execute kafu with Surun in your limited account? Was there possibly a conflict with a HIPS?

 

Well it's no means down to a science, but there definitely is some very useful scientific programming that goes into some of these hardening apps. Still haven't found a way around when using the "prevent rootkits from installing" (provided they are driver related?) in Samurai to free up both the USB Ports and other Devices mentioned earlier. That would be a plus because as-is you need to completely uninstall Samurai to free those USB Ports, and besides there is a simple little batch file that can on-the-fly LOCK a system's USB Ports that simply disables USBstor in the good ole registry.

This is just another technique. Of course LUA w/SRP and/or SuRun can offer (i think) somewhat similar protection, it's just that Samurai get's into the Ring0 hooking biz to block driver installations as evidenced by trying to run IceSword and some other deep analysis apps while it's engaged.

 

well i ran it with the limited acc but with run as admin from the context as any software that needs to write something (e.g install) well my HIPS still seems to allow any action so thats definately not the prob...will try in vm soon.

 

Ah, no - you must execute it in your limited account with SuRun and NOT with the built-in run as admin function since that would mean that you apply kafu to the autostarts of your admin account - but you want to apply it to the autostarts of your limited account!

On the other hand, even apllaying it with run as admin shouldn't cause a BSOD ...

Okay, but that wouldn't be the first example of a HIPS blocking something without giving a warning.

 

too true. i've run kafu on three of my machines (different makes and models) and on 6 of my friends machines, not once have i received a BSOD. it must be a conflict somewhere.

 

Hi EASTER,

Check your magic box for an answer about Samurai rootkit stopping abilities
Do not share seppuku.exe with others =)

PoC for winxp only, password included.

Regards.

 

Excellent choice of words in code.

Thanks and i'll give that round with it and see how disappointed i can become. Question however, this obviously has to be a targetted PoC or are you at liberty to expand on it per say hooking offered by various HIPS? If that is indeed so soft within the SSDT Table, (Unhookers come to mind), and mind you Samurai desparately "NEEDS" updating greatly IMO with some self-protection, then it would leave no other alternative then either HIPS or the likes of Faronic's AE to stall off an executable's attempt to proceed.

Thanks EASTER

 

This is samurai 2.7 oriented proof of concept. It can be used against SSM v2.3 also. Everything else will (but are not obliged) prevent this. Regarding to samurai it can be simple removed by any sophisticated malware even w/o loading drivers.

Regarding to rku3.7 it can be loaded even with samurai protection against rootkits. To do this, start rku from command line with option -console
e.g.
cmd.exe
c:\rku3.7.exe -console
type forcesafemode [enter]
reboot, samurai will be out of business.

 

OK Thanks Laerua

That's was my first thought, and another reason these apps such as Samurai bounce on the scene only to seem like a flash-in-the-pan and quit updating unfortunately.

So Samurai in it's current and nearly obsolete version 2.7 is not of much use unfortunately as previously hoped.

I know for a fact that there are some clever programmers who could fill these gaps with designs of their own but my guess they prefer to sell their source to the big boys to impliment into larger commercial interests.

I'll see how it fairs with EQS also. LoL

 

I tested SAMURAI with VirusTotal, 5 scanners considered SAMURAI as infected, I hope they are all false positives ?

 

It's hardly malware, but then it's not bad at disengaging drivers loading to the SDDT Table and thus getting a hold on your system in the process for whatever reason designed. This hooking thing is driving me plum bananas, i know for a fact XP Systems could be hardened in this particular area without causing problems, thats the underlying basis for HIPS like SSM, where in their case they hook nearly the entire table.

I'm on a quest that may never be realized, but i'm convinced it can be done in similar manners as HIPS use to hook the table. The key to it is designing the best way to keep their drivers seated without being displaced by an unhooker.

In the meantime, it boils right back down to frontal defenses against executables like AE offers and ScriptDefender as well as the sandboxes, virtual systems, and in some case ISR's. I'm looking for bare bones, simple hardening of potential areas of interest by malicious intruder files be they virus or trojans or both, including MBR disrupters.

This revolving door of turning to this app then that app in a never ending circle to see which app offers the most authority is bordering on repetition that repeats itself over and over again. At this rate no one will ever be able to fully enjoy their computer investment if we must constantly be running to different apps all the time to avoid the contamination of the possibility of becoming infected by the latest and greatest threats.

 

Easter,
I installed Samurai v2.7 and applied all 33 settings without BSOD's. How do I undo each setting ?

 

Self-explantory. You should be able to start Samurai the app again then proceed to undo ALL protections that you applied. I can't explain it any better then that.

 

I couldn't find the Undo button, only the Apply button. I got rid of it my way.

 

Yep, your way is the best way too....