Do any antivirus products use “canary files” to detect rootkits?

Question

Recently, I've learned how some rootkits are able to hide certain files, services, etc. from programs in the kernel or user modes.

This got me wondering: Are there any antivirus programs, or other intrusion detection systems, that use "canary files" with common strings in their filenames that are normally hidden by rootkits to detect these?

i.e:

1.) MyRootkit.vir is known to hide files which include the string ".vir" in their filename.
2.) Upon installation (or signature update) MyAV puts MyRootkitcanary.vir in C:\Program Files\MyAV\Canary Files\
3.) During a scan, MyAV runs cmd -c dir "C:\Program Files\MyAV\Canary Files\"
4.) If MyRootkitcanary.vir is not included in the system's response, MyAV alerts that the system may be infected with MyRootkit.vir.

Answer 1

I am not aware of any common anti virus product for end users doing this.

Many root kits, however, use either absolute paths or put their files into well known operating system folders. So an approach, that put canary files into an arbitrary folder, is not likely to catch many root kits.

But putting the canary files outside the the anti virus folder, is likely to raise suspicion about a real infections. This makes live for anti virus vendors a lot harder because it will create extra support requests and in the worst case may result in bad press coverage: "Anti virus A infected with rootkit B as discovered by anti virus C".

Dedicated rootkit detection tools might try this approach. On a quick glance chkrootkit, however, is primary based on detecting inconsistencies: For example it uses different ways to list processes (chkproc) and folders (checkdirs).

Answer 2

A more robust detection technique is to read the filesystem catalogue directly from the disk, and compare what it reports with the results of asking the operating system what files are there. If the results differ in unexpected ways, then you might have a root kit. As other people have reported the mechanism you propose relies on the root kit not being good enough to only hide its own files.

Notice that there are expected differences in output: for example, the HFS+ file system has a collection of files in its catalogue file for internal housekeeping that good implementations won't expose to the OS.

Answer 3

Good idea. Some rootkit hunters implement similar canary tests as you describe. Lets formalize the concept a bit. You create a resource which will be altered by the presence of a rootkit.

Many linux rootkits hide processes/etc based on uid or gid. You could create a canary for each user/group:

for uid in {0..65535}; do
 touch /root/tmp/canary_$uid
 chown $uid:$gid /root/tmp/canary_$uid
done

then count the files seen by i.e. ls

if (( $(ls -la | head -n +1 | grep total | cut -d\  -f 2) -ne 65536 )); do
 echo "missing canary file, possible RK detected"
done

Also, some rootkit hunters also check for what resources that should be available, but is not. I.e sockets and process id's. You could easily create a program that tries to bind to every available tcp/udp port, and if it fails it would indicate that there is "something hidden" that have already binded itself to that port.

But that is about how far these techniques go, and can easily be subverted. Rootkits can run inside other processes (as threads) and can avoid allocating shared resources for communication (sniffing instead of binding).

Also, you could check out: http://www.rootkit.nl/projects/rootkit_hunter.html