What are Rootkits and how to detect them

Rootkits are one of the worst things that can happen to a system and they are one of the most dangerous attacks, more dangerous than usual malware and viruses, both in the damage they cause to the system and difficulty in finding and detecting them. Rootkits can stay on your system for a long time without the user even noticing and it can cause some serious damage to the system.

The word “RootKit” originally comes from the world of ‘Unix’ systems, where the root is the user with the most access privileges to the system’. While the word kit defines the kit containing a set of malicious tools like keyloggers, banking credential stealers, password stealers, antivirus disablers or bots for DDos attack, etc. Putting both of these together, you get RootKit.

They are designed in such a way that they remain hidden and do malicious things like intercepting internet traffic, stealing credit cards, and online banking information. Rootkits give cybercriminals the ability to control your computer system with full administrative access, it also helps the attacker to monitor your key-strokes and disable your antivirus software which makes it even easier to steal your secret information.

How do RootKits get in the system?

Rootkits are, according to their type, unable to spread by themselves. Therefore, they are spread by the attacker by such tactics that the user is unable to notice that something is wrong with the system. Usually by hiding them in devious software that looks legitimate and could be functional. Be that as it may, when you award the software consent to be introduced on your framework, the rootkit discreetly sneaks inside where it might lay low until the attacker/hacker actuates it. Rootkits are very hard to identify because they can hide from users, admins, and most of the Antivirus products. Basically, in case of a compromisation of a system by Rootkit, the scope of malignant movement is very high.

Social Engineering:

The hacker tries to obtain root/administrator access by exploiting known vulnerabilities or by using social engineering. Cybercriminals employ social engineering to get the job done. They try to install rootkits on the user’s system by sending them in a phishing link, email scams, redirect you to malicious websites, patch the rootkits in legitimate software that looks normal to the naked eye. It’s important to know that Rootkits do not always want the user to run a malicious executable to sneak in. Sometimes all they want is a user to open a pdf or Word document to sneak in.

Types of RootKits:

To understand the types of rootkits properly, first, we need to imagine the system as a circle of concentric rings.

• At the center, there is a Kernel known as ring zero. The kernel has the highest level of privileges over a computer system. It has access to all the info and can operate on the system as it wants.
• Ring 1 and Ring 2 are reserved for less privileged processes. If this ring fails, the only processes that are going to be affected are the ones the ring 3 depends upon.
• Ring 3 is where the user resides. It is user mode having a hierarchy of strict privilege access.

Critically, a procedure running in a higher privileged ring can bring down its benefits and run in an external ring, yet this can’t work the reverse way around without the unequivocal assent of the working framework’s security instruments. In situations where such security components can stay away from, a privilege escalation vulnerability is said to exist. Now there are 2 most prominent types of RootKits:

User Mode Rootkits:

Rootkits of this category operate at low privileged or user level in the operating system. As expressed before rootkits cause hackers to keep their authority over the system by giving a secondary passage channel, User Mode Rootkit will in general change the significant applications at the user level in this way concealing itself just as giving backdoor access. There are different rootkits of this type for both Windows and Linux.

Linux user-mode RootKits:

Many Linux user-mode rootkits are available nowadays for example:

• To gain remote access to the target’s machine, login services like ‘login’, ‘sshd’ are all modified by the rootkit to include a backdoor. Attackers can have access to the target’s machine just by getting to a backdoor. Remember that the hacker already exploited the machine, he just added a backdoor to come back another time.
• To perform the privilege escalation attack. The attacker modifies commands like ‘su’,sudo such that when he uses these commands through a backdoor he will get root-level access to services.
• To hide their presence during an attack by
• Process hiding: various commands which show data about procedures running on the machine-like ‘ps’,’pidof’,’top’ are modified with the goal that the assailant procedure isn’t recorded among other running procedures. Additionally, the command ‘kill all’ is typically changed with the goal that the hacker’s process cannot be killed, and order ‘crontab’ is changed so that malicious processes run at a specific time without changing in crontab’s configuration.
• File hiding: hiding their presence from commands like ‘ls’, ‘find’. Also, hiding from ‘du’ command which shows disk usage of a process run by an attacker.
• Event hiding: hiding from system logs by modifying ‘syslog.d’ file so that they cant logged in these files.
• Network hiding: hiding from commands like ‘netstat’ ,’iftop’ which shows active connections. Commands like ‘ifconfig’ are also modified to eradicate their presence.

Kernel-mode Rootkits:

Before moving onto kernel-mode rootkits, first, we will see how the kernel works, how the kernel handles requests. The kernel allows applications to run using hardware resources. As we have discussed rings concept, The ring 3 applications cannot access a more secure or high privileged ring i.e ring 0, they depend on system calls which they process using subsystem libraries. So, the flow is something like this:

Now what an attacker will do is he will alter the System Call Table by using insmod and then map malicious instructions. Then he will insert malicious kernel code and flow be like this:

What we will see now is how this System call Table is altered and how the malicious code can be inserted.

• Kernel Modules: The Linux Kernel is designed in such a way to load an external kernel module to support its functionality and insert some code at the kernel level. This option gives attackers great luxury to inject malicious code in kernel directly.
• Changing kernel file: when Linux kernel is not configured to load external modules, Kernel file alteration can be done in memory or hard disk.
• The kernel file holding the memory image on the hard drive is /dev/kmem. The live running code on the kernel also exists on that file. It doesn’t even require a system reboot.
• If memory cannot be altered, the kernel file on the hard disk can be. The file which holds the kernel on the hard disk is vmlinuz. This file can only be read and altered by root. Remember that for a new code to execute, a system reboot is required in this case. Changing the kernel file does not need going from ring 3 to ring 0. It just needs root permissions.

An excellent example of Kernel rootkits is SmartService rootkit. It prevents users from launching any antivirus software and hence serves as a bodyguard for all other malware and viruses. It was a famous devastating rootkit up to mid-2017.

Chkrootkit:

These types of malware can stay on your system for a long time without the user even noticing and it can cause some serious damage as once the Rootkit is detected there is no other way but to reinstall the whole system and sometimes it can even cause hardware failure.

Luckily, there are some tools which help to detect a variety of known Rootkits on Linux systems like Lynis, Clam AV, LMD (Linux Malware Detect). You can check your system for known Rootkits by using the commands below:

First of all, we need to install Chkrootkit by using the command:

This will install Chkrootkit tool and you can use it to check for rootkits by using:

Chkrootkit program is a shell script that checks system binaries in the system path for malicious modification. It also includes some programs that check various security issues. In the above case it checked for a sign of rootkit on the system and didn’t find any, well that’s a good sign.

Rkhunter (RootkitHunter):

Another awesome tool for hunting a variety of rootkits and local exploits in an operating system is Rkhunter.

First of all, we need to install Rkhunter by using the command:

This will install Rkhunter tool and you can use it to check for rootkits by using:

This will check for a large number of known rootkits in your system. To check for system commands and all types of malicious files in your system, type the following command:

If an error occurs, comment out the error lines in /etc/rkhunter.conf file and it will work smoothly.

Conclusion:

Rootkits can do some serious irreversible damage to the operating system. It contains a variety of malicious tools like keyloggers, banking credential stealers, password stealers, antivirus disablers, or bots for DDos attack, etc. The software remains hidden in a computer system and keeps doing its work for an attacker as he can remote access the victim’s system. Our priority after detecting a rootkit should be to change all the system’s passwords. You can patch all the weak links but the best thing is to completely wipe and reformat the drive as you never know what is still inside the system.