Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently, I've learned how some rootkits are able to hide certain files, services, etc. from programs in the kernel or user modes.

This got me wondering: Are there any antivirus programs, or other intrusion detection systems, that use "canary files" with common strings in their filenames that are normally hidden by rootkits to detect these?

i.e:

1.) MyRootkit.vir is known to hide files which include the string ".vir" in their filename.
2.) Upon installation (or signature update) MyAV puts MyRootkitcanary.vir in C:\Program Files\MyAV\Canary Files\
3.) During a scan, MyAV runs cmd -c dir "C:\Program Files\MyAV\Canary Files\"
4.) If MyRootkitcanary.vir is not included in the system's response, MyAV alerts that the system may be infected with MyRootkit.vir.

share|improve this question

3 Answers 3

I am not aware of any common anti virus product for end users doing this.

Many root kits, however, use either absolute paths or put their files into well known operating system folders. So an approach, that put canary files into an arbitrary folder, is not likely to catch many root kits.

But putting the canary files outside the the anti virus folder, is likely to raise suspicion about a real infections. This makes live for anti virus vendors a lot harder because it will create extra support requests and in the worst case may result in bad press coverage: "Anti virus A infected with rootkit B as discovered by anti virus C".

Dedicated rootkit detection tools might try this approach. On a quick glance chkrootkit, however, is primary based on detecting inconsistencies: For example it uses different ways to list processes (chkproc) and folders (checkdirs).

share|improve this answer

A more robust detection technique is to read the filesystem catalogue directly from the disk, and compare what it reports with the results of asking the operating system what files are there. If the results differ in unexpected ways, then you might have a root kit. As other people have reported the mechanism you propose relies on the root kit not being good enough to only hide its own files.

Notice that there are expected differences in output: for example, the HFS+ file system has a collection of files in its catalogue file for internal housekeeping that good implementations won't expose to the OS.

share|improve this answer

Good idea. Some rootkit hunters implement similar canary tests as you describe. Lets formalize the concept a bit. You create a resource which will be altered by the presence of a rootkit.

Many linux rootkits hide processes/etc based on uid or gid. You could create a canary for each user/group:

for uid in {0..65535}; do
 touch /root/tmp/canary_$uid
 chown $uid:$gid /root/tmp/canary_$uid
done

then count the files seen by i.e. ls

if (( $(ls -la | head -n +1 | grep total | cut -d\  -f 2) -ne 65536 )); do
 echo "missing canary file, possible RK detected"
done

Also, some rootkit hunters also check for what resources that should be available, but is not. I.e sockets and process id's. You could easily create a program that tries to bind to every available tcp/udp port, and if it fails it would indicate that there is "something hidden" that have already binded itself to that port.

But that is about how far these techniques go, and can easily be subverted. Rootkits can run inside other processes (as threads) and can avoid allocating shared resources for communication (sniffing instead of binding).

Also, you could check out: http://www.rootkit.nl/projects/rootkit_hunter.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.