Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that?

One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't there easier ways to accomplish this? Or are there even other reasons?

share|improve this question
add comment

3 Answers

up vote 18 down vote accepted

As you said, most drivers run in kernel mode, so they have access to all the interesting stuff and can easily hide from debuggers.

There are more reasons which makes drivers an interesting place:

  • There is a huge amount of device drivers, and vendors provide new versions of drivers that differ from the version included in the operating system. So unlike core parts of the operating system, it is not easy to manage a database with hashes of known good files.

  • There are standard tools and documentation for developing drivers. So this is a lot easier than directly patching kernel memory or replacing the boot loader.

  • Direct memory access in a device driver is not suspicious.

  • Some drivers are loaded early during the boot process, so they can apply their magic before a virus scanner is loaded. So the virus scanner only sees, what the rootkit wants it to see.

share|improve this answer
add comment

One particular driver type that is interesting to hide in for a rootkit is a file system driver. The rootkit can easily filter the results of directory listings and hide itself from the user and other system tools.

Similarly, hiding in a network driver can filter some connections and remove them from the list of open connections.

share|improve this answer
add comment

at driver level, applications can have full access to the system's hardware. That includes filter drivers that inserts between the HW driver and the OS in a totally transparent manner, making it almost impossible for other applications to detect their presence.

That can be applied to filesystem driver, network driver, input devices (keyboards..).

driver level applications can also be made invisible to process monitoring making them really hard to detect and get rid off.

share|improve this answer
    
So, how can you get rid of them? –  Erik Jun 9 '12 at 8:59
1  
as you might expect it is not a straight forward process, but it can be done. Here are some interesting links and info on this. technet.microsoft.com/en-us/sysinternals/bb897445.aspx#how and also techrepublic.com/article/detecting-rootkits/5030282 –  fduff Jun 13 '12 at 18:16
    
I just came across the RootKitHunter project on sourceforge forge, (rkhunter.sourceforge.net) –  fduff Jun 15 '12 at 20:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.