47

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread). Hook the Process32First /...


41

Who's to say that the phone is really off? If someone controls the firmware of the device then the off functionality could be replaced with state in which the phone appears to be "off" but is in fact maintaining a line of communication to a remote user. However firmware cannot stop you from introducing a hardware switch to disconnect the microphone. A ...


32

A rootkit is a set of tools that you run on a target machine when you somehow gained access to it with root-level privileges. The point of the rootkit is to transform that transient access into an always-open door. An example of a rootkit would be a modification of the sshd binary, so that it always accepts "8gh347vb45" as password for root, regardless of ...


27

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and the ...


26

A Korean researcher demonstrated this on Samsung Smart TVs at Black Hat this year. (Slide deck here.) He mentions that the malware was originally designed for cell phones, and that TV sets were even easier to attack because battery life did not give them away. His basic premise is that if he owns your device, he owns the power indicators, too. Remote ...


24

A "rootkit" normally tries real hard not to be detected. However, it cannot, in theory, be completely undetectable, since the point of the rootkit is to maintain an entry path for the attacker, so at least the attacker can know whether the root kit is in place or not. A lot of methods have been used in the past. For instance, some rootkits install ...


23

Let's break it down by category. What information does Carrier IQ monitor? Trevor Eckhart says (depending on the phone manufacturer) it receives each key pressed/tapped, the location of any tap on the screen, the contents of all text messages received, the name of each app that you open or switch focus to, information about each call you receive, your ...


21

TURLA is the final stage of a large and sophisticated family of malware. There have been known Windows versions since at least 2010. This 40 page presentation is the most comprehensive resource I have seen, for either platform. TURLA - development & operations Some Windows Highlights Stage 0: attack stage - infection vector Stage 1: reconnaissance ...


19

As you said, most drivers run in kernel mode, so they have access to all the interesting stuff and can easily hide from debuggers. There are more reasons which makes drivers an interesting place: There is a huge amount of device drivers, and vendors provide new versions of drivers that differ from the version included in the operating system. So unlike ...


18

As the system is compromised, nothing is to be trusted via way of tools. Unless you have the tools validated (e.g. Tripwire FIM), your best bet is to take a similar system, copy over what is necessary, which should run if the systems are similar in architecture, etc. This is not the optimal method though. Because the machine is compromised, depending on your ...


13

As stated above, root kits work similar on a virtual host as they do on a normal host EXCEPT that many malware/virus/rootkit authors have developed mechanisms to detect whether or not they are in a virtual machine, so they can be scripted/programmed to behave differently than they would on a normal machine. This is highly evident when reverse engineering ...


11

The answer is simple, and it's a similar phenomenon to the the anthropic principle, called survivor bias. There are many, many stealthy viruses that stay in place a long time, because they don't do this—but you don't ever hear or think about those, for the very reason that they're stealthy. Remember, what you're really asking is, "Why do I see so many non-...


11

Removal? Forget about it. There is unauthorised root access to your server; anything could have been installed by now and you would have no reliable way to detect it. Even for a forensic expert with local access, it would take a long time to completely audit a system to ensure no trace of extant malware. The only reasonable and responsible course is to ...


10

As part of a CTF challenge that I run, we had some reverse-engineering challenges last year. I posted some advice on how to perform the analysis (verified by folks that do this on a daily basis). The blogpost is here. The links point to tutorials for IDA and OllyDbg, two of the most popular tools for such analysis and there's a nice paper from one of the AV ...


10

Yes, it is less safe than if you switched to text console and log in as root directly. Proof 1: If you are logged in as root in a terminal, another process can send commands to that terminal. Simple proof of concept: Open a terminal, place in in the top left corner of the screen and switch to root. Open a second terminal that does not overlap the first ...


9

tl;dr - compare the results of two functions that do the same thing, and look for differences. Instead of focusing on that single rootkit scanner, I'm going to talk about generic techniques that rootkits use and how we can find them. This should give you a better overview of the challenges involved. Rootkits work by intercepting certain system calls and ...


9

As a rule, this is a fruitless endeavor. It is very uncommon for a hacker to log in from his home IP or from any server directly traceable back to him. It's far more common for hackers to use previously-hacked targets as jump-off points for future attacks. Often attackers will also use other relays (such as IRC bouncers or public IRC networks) to relay ...


8

You don't need anti-virus. Simply look at the contents of one of the drives. Are they empty? Fine, then you are ok. Pull random samples out and check them. If you asked the vendor to put files on the drive, such as promotional materials for you company, then makes sure that the files match precisely. Remember: do this from a machine with the latest patches....


8

Quick Answers The quickest answers are: "defense-in-depth", and "plan for failure" You have protections in place, but what if they fail? What if an attacker finds a way in using a method that you did not anticipate? From these perspectives, then, yes, rkhunter is necessary. But, then you start asking, "when do I stop adding more protection?" Right ...


8

You must define "transmitting". There are two categories; active and passive. Active transmissions require relatively large amounts of power to actually send out data whereas passive transmissions require little to no added power and could represent a NFC transmission such as an RFID chip being read by a scanner. There are also some theoretical ...


8

Normally, no. Not in a self-bootable area. You might have data not overwritten by the disk wipe, in "out-of-band" areas, but those areas aren't normally accessible, and if made so, they also become accessible to the wipe. Theoretically, for very large values of theoretically, yes. In some hard drives, there may be a third memory area that is accessible, ...


8

To expand on @tlng05's point, rootkit authors are professionals, often with decades of experience. Unless you have decades of experience fighting rootkits, then they'll know about more hiding places than you do :P If you suspect there's a rootkit, then your only choice is to wipe the system. This is a classic example of Ken Thompson's reflection on ...


7

Your server is infected. It shall be cleansed. With fire. The primary function of a rootkit is to install itself in an inconspicuous place, and intercept whatever it needs to resist reboots and upgrades. For instance, it may have added its code in the kernel itself, and hijack read and write system calls so that it automatically reinfects the kernel file ...


7

Most of the time, it's only just barely safer, and sometimes it's less safe. Under what conditions can I simply download the exe(cutable?) Signed packages from major distributions are built on the Distribution's build servers. In that regard, it's almost certainly best to use the packaging system. Are there times when I should I compile the binary ...


7

I'm root@anapnea.net, and grsec is the reason I can sleep at night. As an example of an exploit blocked by grsec, you can look at almost any of the recent kernel vulnerabilities. Stock exploits simply don't work against a grsec kernel. As an example of a vulnerability blocked by grsec, and in particular UDEREF, you have the recent x86_32 local root. Grsec ...


7

If your system has been compromised, you shouldn't trust anything. I think usually the standard utilities will mostly work correctly, but leave out stuff related to the attacker's processes. Rootkits are designed this way so you're less likely to notice that the machine is compromised. So I think you can generally trust them for looking at your own ...


6

There was WeaponX in 2004, there is even a guide here on how to develop one yourself. Since OSX is a combination of Mach and BSD, there have been rootkits specially developed to target the Mach or Unix side or both. I use Rkhunter on my Unix machines, there is a version for OSX as well, so I suggest you take a look at that. The problem with a rootkit is ...


6

Another aspect that has not been adequately addressed by CarrierIQ or their customers (the network providers) is what is effectivly stored in memory by the CarrierIQ rootkit and how. All we know from the CarrierIQ marketing person interviewd is that between 200K and 400K of data is sent on a regular basis, but no indication has been given as to if this is ...


Only top voted, non community-wiki answers of a minimum length are eligible