Rustock and All That (Kaspersky Article)

Macstorm · Jul 15, 2008

In December 2006, rumors began to circulate among rootkit researchers (both blackhat and whitehat) that someone had created and released an ‘absolutely undetectable’ rootkit, Rustock.С, which could not be detected on computers where it was active by any of the existing antivirus or anti-rootkit solutions.

A long search for the ‘mythical rootkit’ yielded no result. As a consequence, any information about Rustock.C was treated as a joke in circles close to rootkit researchers. This continued until May 2008.

In early May, the Russian company Dr.Web announced to the antivirus community that its experts had detected a new rootkit called Ntldrbot, aka Rustock.С. This piece of news was about as unpleasant as it was sensational.

According to Dr.Web, the rootkit had eluded all antivirus vendors since October 2007. It was suggested that Rustock.C was used to create one of today’s most extensive zombie networks for sending spam. Dr.Web also referred to a study conducted by Secure Works, according to which the botnet created using Rustock was the third-largest zombie network, capable of sending up to 30 billion spam messages every day. However, it is unlikely that the Secure Works estimate had anything to do with the newly-detected rootkit, since it was virtually unknown until May 2008. In all probability, Secure Works experts meant the botnet created using the earlier variants of Rustock – А and B (Trojan-Clicker.Win32.Costrat and SpamTool.Win32.Mailbot, according to Kaspersky Lab’s classification).

Judging by the information published by Dr.Web, the company’s experts obtained a sample of the real Rustock.С in late March 2008 and it took them over a month to analyze the rootkit’s code and create and release tools enabling its detection and treatment. Other antivirus companies were only notified of the finding after this.

The description of the rootkit prepared by Dr.Web left too many questions unanswered. First and foremost, it was completely unclear how and when the rootkit had spread and why nobody had detected it since October 2007.

The sample of the rootkit’s body distributed by Dr.Web was a 244,448-byte Windows driver.

Unfortunately, the so-called dropper, i.e., the file designed to install the rootkit on the system, was missing. If it had been provided, this file could have significantly simplified the work carried out by other antivirus laboratories to analyze the rootkit and develop procedures to detect and treat Rustock.С. It might also have helped to clarify how the rootkit had originally spread.

There was also no reliable information about the existence of the rootkit ‘in the wild’. There remained the possibility that Rustock.С was nothing more than a ‘collector’s item’ and was not widespread, which would explain the length of time that it had taken to find it.

Kaspersky Lab began performing in-depth analysis of the rootkit’s code on May 12. The task faced by our experts was truly difficult, since the rootkit’s entire code was encrypted using an unknown method and could not be analyzed using the usual compressed-code analysis and emulation techniques. Further complicating the problem was the fact that each rootkit file had some kind of hardware binding to the infected computer and could not be executed and analyzed on other computers or virtual machines.

However, it only took our experts two days to overcome these difficulties, crack the key and decrypt most of the rootkit’s body. On the evening of May 14, we were able to view portions of the real code of Rustock.С.

.......................................................

Rustock.С indeed exists; it is not a myth. But the rootkit’s elusiveness is mythical: it is not due to any extraordinary masking capabilities, but is based on the rumors which appeared in late 2006 and which only played into the hands of the malicious program’s authors.
Click to expand...

Full Article: http://www.viruslist.com/analysis?pubid=204792011

aigle · Jul 16, 2008

http://www.rootkit.com/newsread.php?newsid=885

btman · Jul 16, 2008

aigle said:

http://www.rootkit.com/newsread.php?newsid=885
Click to expand...

I'm sorry that's a lot to read... Does someone care to sum it up I skimmed through it and read a lot of nonsense.. WoW? Calling people out? lol

Defcon · Jul 16, 2008

That was an interesting read (as a software developer). Its like an adventure story in code.

Baz_kasp · Jul 16, 2008

aigle said:

http://www.rootkit.com/newsread.php?newsid=885
Click to expand...

epxoff and co love to cry about kaspersky lab...and throw in some swear words to prove how 1337 they are...

Honestly, some of these coders should grow up and stop living in 1337world.

Macstorm · Jul 16, 2008

Baz_kasp said:

epxoff and co love to cry about kaspersky lab...and throw in some swear words to prove how 1337 they are...

Honestly, some of these coders should grow up and stop living in 1337world.
Click to expand...

Their 'Epilogue' speaks for themselves

fcukdat · Jul 16, 2008

Baz_kasp said:

epxoff and co love to cry about kaspersky lab...and throw in some swear words to prove how 1337 they are...

Honestly, some of these coders should grow up and stop living in 1337world.
Click to expand...

Unfortunetly whether we agree or disagree with their attitudes/opinions....the technical data returned is 100% accurate.
From a malware research prospective this is the most importent part

Baz_kasp · Jul 16, 2008

And I do appreciate that...however attitude goes a long way in my book.

There is a difference between writing a technical piece or combining technical knowledge with personal attacks and swearwords for the leet effect.

aigle · Jul 17, 2008

Abot EP n Co. , I hate their language/ attitude but i am really impressed by their knowledge, confidence n technical expertise. They seem ahead to any AV company in this regard, as far as I can guess.

aigle · Jul 17, 2008

fcukdat said:

Unfortunetly whether we agree or disagree with their attitudes/opinions....the technical data returned is 100% accurate.
From a malware research prospective this is the most importent part
Click to expand...

Hi, nice to see u, sorry for OT, any thing new about Mebroot?

Thanks

Log in or Sign up

Rustock and All That (Kaspersky Article)

Macstorm Registered Member

aigle Registered Member

btman Registered Member

Defcon Registered Member

Baz_kasp Registered Member

Macstorm Registered Member

fcukdat Registered Member

Baz_kasp Registered Member

aigle Registered Member

aigle Registered Member

Log in or Sign up

Rustock and All That (Kaspersky Article)

Macstorm Registered Member

aigle Registered Member

btman Registered Member

Defcon Registered Member

Baz_kasp Registered Member

Macstorm Registered Member

fcukdat Registered Member

Baz_kasp Registered Member

aigle Registered Member

aigle Registered Member

Useful Searches