Caution SONY Music CDs have trojan Malware

[Roger Wilco]

Roger Wilco wrote:
[snip]

If a rootkit was to gain access to root, then a dictionary attack
against a weak password would be a rootkit - as would an injection
vector through some broken ring zero process.

or a keylogger, or a password stealing trojan, or . . .

Any collection of software
used once root was attained (whether for stealthing or some other thing)
is where "kit" comes in imo.

forgive me, but isn't "root" sort of the more important part of the
compound word in question?

Not really, root could mean root directory as easily as root user. A
rootkit could be as simple as issuing the command cd\ in DOS .It really
is a stealth kit used when one has highest (or high enough) privilege to
install modified copies of utility programs.

it may seem wrong to you but it makes perfect sense to me...

the functional behaviour of what i call rootkits explicitly involves
root/administrative privileges...

Having them - or getting them?

the functional behaviour of what you call rootkits doesn't... their
function is to hide objects/activity...

It requires that the installer program runs with sufficient privilege.
You can't install a rootkit without already obtaining this privilege
level by some means. Just "getting root" does not imply a rootkit was
used - it could have just been a guessed password or physical access to
a machine already loggied in with such privilege.

maintaining root access is an intent, not a function, and we all know
how good a definition that involves intent is in the field of computer
science...

The UNIX "rootkit" to me is a collection of aptly named trojans suitable
for swapping out when one has sufficient privilege to do so - and with
whatever purpose the attacker has in mind (though usually to preserve
the attackers ability to maintain the machines compromised state -
stealth being a part of this).

Installing a Windows filter driver to mask return information from
certain calls only resembles a rootkit on this one respect. Why do they
need to use a new term for stealth anyway? It reminds me of the "Social
Engineering" term being used for what used to be called a confidence
game (congame or just con - as "I conned him out of his hard earned
cash).

 

[Roger Wilco]

Roger Wilco wrote:

i'm familiar with that line of reasoning, however it fails to convince...

there are those who say rootkits are for maintaining root access, those
who say rootkits are for gaining root access, and those (like the
anti-spyware coalition) who sit on the fence and say it's either one...

from a functional definition standpoint, the 'maintain' camp are lost...
hiding unspecified 'other activities' makes the definition context
sensitive (does it stop being a rootkit if the other activities cannot
possibly be hidden?)...

Nobody to the best of my knowledge has said that a "rootkit" is a
specific program or function. It is a thing without a formal definition.
It would indeed be difficult to nail it down if it is, as I say, a
collection of programs to be used by someone with newfound root access
to a UNIX machine. Just as "virus" has become synonymous with "malware"
in popular language, so has "rootkit" become synonymous with
"stealthware".

and that couldn't possibly be with a 'kit'...

Sure it could, I just don't think the kit we're talking about was for
obtaining root permissions. One could install a rootkit no matter how
the privilege level was attained.

further, gaining root is not always done by exploiting a vulnerability
unless you widen the scope of 'vulnerability' to include users - at
which point even your rootkit would be exploiting a vulnerability...

Yes, I was referring to vulnerable security not just broken software or
bad configuration settings when I posted "* Could also be just poorly
configured security". I include thigs such as acces to an already logged
on privileged user machine due to their leaving the console unattended.
An invisible janitor or courier with a disk could install a rootkit - it
is not about how it got there, it is about the fact that it IS there.

 

[kurt wismer]

ugg... i hate catching a cold in the middle of a conversation... sorry
for the delay...

Roger Wilco wrote: [snip]

is where "kit" comes in imo.

forgive me, but isn't "root" sort of the more important part of the
compound word in question?

Not really, root could mean root directory as easily as root user. A
rootkit could be as simple as issuing the command cd\ in DOS .It really
is a stealth kit used when one has highest (or high enough) privilege to
install modified copies of utility programs.

hmmm... now that so much time has passed and things have had a chance to
settle in, do you see just how far astray you've gone here?

the 'root' in rootkit isn't necessarily about the root user? that's funny...

Having them - or getting them?

sophistry... getting them of course - having them is not a function, it
is a property...

It requires that the installer program runs with sufficient privilege.

and that is a dependency...

You can't install a rootkit without already obtaining this privilege
level by some means.

as has been the case since time immemorial, the person who uses a thing
and the person who installs that thing need not be the same person...
the malware world is rife with examples of nefarious folk getting
unsuspecting victims to install their malware...

Just "getting root" does not imply a rootkit was
used -

never said it was... what i said was that getting root is what a rootkit
helps you do, not if you got root you necessarily used a rootkit to do it...

The UNIX "rootkit" to me is a collection of aptly named trojans suitable
for swapping out when one has sufficient privilege to do so - and with
whatever purpose the attacker has in mind (though usually to preserve
the attackers ability to maintain the machines compromised state -
stealth being a part of this).

the earliest use of the term rootkit in google's usenet archive can be
found here http://tinyurl.com/a7x62 - it's from 1994 and in it you will
find the context clearly points to rootkit being of the root gaining
variety (stealthing objects "the hard way"? sorry, that interpretation
just doesn't seem to work)... bonus points to anyone who noticed the guy
also correctly used the term cracker instead of hacker which most people
these days would have used...

this phrack article from 1999 (http://www.phrack.org/phrack/55/P55-05)
clearly lays out the 'backdoor' aspect of rootkits...

this academic slide show from 2004 (http://tinyurl.com/but5e) describes
a particular rootkit (Lrk4) behaving in such a way as to redirect
/bin/login to the rootkit's login - the obvious implication being that
login information would be gathered...

this cert taxonomy document also from 1999
(http://www.cert.org/research/taxonomy_988667.pdf) contains an entry for
something they call a toolkit which they describe as "a software package
that contains scripts, programs, or autonomous agents that exploit
vulnerabilities", and they list as an example a well known toolkit that
went by the name "rootkit"...

another cert document from 1997
(http://www.cert.org/research/JHThesis/Chapter8.html) also makes
reference to the toolkit classification but breaks it into 2, tools
designed to exploit root access (such as the aforementioned "rootkit")
and scanners (such as the tool known as SATAN)...

finally, in this academic research paper from 1996
(http://tinyurl.com/ti5a) the toolkit known as "rootkit" is described as
something one installs *after* one gains root to a system (which i'm
sure you'll like) in order to sniff the network for credentials to use
on other systems...

i think what it comes down to is this: in the olden days network
topology looked a lot different than it does now (or people looked at it
a lot differently)... now all most people see when they look at nodes
are end-points, not potential pathways to other nodes... the point of
the rootkit was to gain root; in "rootkit"'s (and possibly many others)
case it was to gain root on a system other than the one it was installed
on by taking advantage of the fact that users of other systems may also
use the compromised system, but in general the means by which that could
be accomplished were as numerous as the stars in the sky... most attack
techniques evolve stealth tactics to help evade detection and so hold
the window of opportunity open longer and increase the chance of
success... eventually those same stealth tactics became a means by which
one could systematically detect the presence of a rootkit... at that
point what it was to be a rootkit became blurred in the eyes of the
masses just as at one point many people wrongly believed that all
viruses had to 'insert' themselves into *.exe or *.com files...

Installing a Windows filter driver to mask return information from
certain calls only resembles a rootkit on this one respect. Why do they
need to use a new term for stealth anyway? It reminds me of the "Social
Engineering" term being used for what used to be called a confidence
game (congame or just con - as "I conned him out of his hard earned
cash).

if they're going to classify something based purely on the fact that it
uses stealth technology then they need a term for that because stealth
alone has never been considered an attack technique before, it's always
been a refinement of other techniques...

 

[kurt wismer]

Nobody to the best of my knowledge has said that a "rootkit" is a
specific program or function. It is a thing without a formal definition.

then you weren't reading what you quoted as i just informed you that the
anti-spyware coalition have a *formal* definition for it... see
http://www.antispywarecoalition.org/documents/glossary.htm

It would indeed be difficult to nail it down if it is, as I say, a
collection of programs to be used by someone with newfound root access
to a UNIX machine. Just as "virus" has become synonymous with "malware"
in popular language, so has "rootkit" become synonymous with
"stealthware".

and just as i hand out a swift kick in the ass to people who propagate
the absurdity that virus and malware mean the same thing, i shall hand
out a swift kick in the butt to people who propagate the idea that
rootkit == stealthware....

Sure it could, I just don't think the kit we're talking about was for
obtaining root permissions. One could install a rootkit no matter how
the privilege level was attained.

or, one could get root to run/install it for one...

 

[Roger Wilco]

ugg... i hate catching a cold in the middle of a conversation... sorry
for the delay...

No problem, I'm not online every day anyway. Hope you're feeling better.

Roger Wilco wrote: [snip]
is where "kit" comes in imo.

forgive me, but isn't "root" sort of the more important part of the
compound word in question?

Not really, root could mean root directory as easily as root user. A
rootkit could be as simple as issuing the command cd\ in DOS .It really
is a stealth kit used when one has highest (or high enough) privilege to
install modified copies of utility programs.

hmmm... now that so much time has passed and things have had a chance to
settle in, do you see just how far astray you've gone here?

Not really, there are already other ways to describe privilege levels -
the word "root" is not really a good substitute for "most privileged"
since it already refers to many other things that can be viewed as a
"tree".

the 'root' in rootkit isn't necessarily about the root user? that's

funny...

I'm just saying that "root" is UNIX slang for the "most privileged"
user - but the word "root" is not suitable comp sci terminology as there
are many other uses.

sophistry... getting them of course - having them is not a function, it
is a property...

Well.. I'll agree to disagree then. To me it is a collection to use once
you have sufficient privilege. The idea is to leverage your newly found
"root" privilege into further compromising the machine or network.

Not only that - but yes ... it would be a good thing to do.

privilege.

and that is a dependency...


as has been the case since time immemorial, the person who uses a thing
and the person who installs that thing need not be the same person...
the malware world is rife with examples of nefarious folk getting
unsuspecting victims to install their malware...


never said it was... what i said was that getting root is what a rootkit
helps you do, not if you got root you necessarily used a rootkit to do

it...

Having root allows you to install a rootkit, Getting root is outside the
scope of what a rootkit does in the first instance, although having it
(root, and the rootkit) can lead to additional machines being rooted
(and rootkitted).

the earliest use of the term rootkit in google's usenet archive can be
found here http://tinyurl.com/a7x62 - it's from 1994 and in it you will
find the context clearly points to rootkit being of the root gaining
variety

I didn't read it that way at all. He was referring disgustedly to the
"kit' aspect as a ready made decidedly not a "do-it-yourself"
combination of exploiter and rootkit - maybe implying the skill level of
his attacker was well beyond "script kiddie". The fact is that a skilled
cracker can make his own collection, to suit his target, and it is still
a rootkit.

What you describe (as rootkit) is more like what that poster describes
as "exploiter" software - specifically exploiter software that ends up
with your gaining root access.

(stealthing objects "the hard way"? sorry, that interpretation
just doesn't seem to work)... bonus points to anyone who noticed the guy
also correctly used the term cracker instead of hacker which most people
these days would have used...
)

this phrack article from 1999 (http://www.phrack.org/phrack/55/P55-05)
clearly lays out the 'backdoor' aspect of rootkits...

[snip - thanks for the links]

another cert document from 1997
(http://www.cert.org/research/JHThesis/Chapter8.html) also makes
reference to the toolkit classification but breaks it into 2, tools
designed to exploit root access

Again, to me "exploit root access" in this context means exploiting
(leveraging) the fact of root access. You can't exploit root access in
the sense that you can exploit vulnerabilities in broken software. You
can exploit the broken software to attain root access - but this is an
exploiter not a rootkit. Here they meant (to me at least) that they are
designed to exploit (make use of) root access, not that they are
exploits (injection vector w/payload) to attain root access.

i think what it comes down to is this: in the olden days network
topology looked a lot different than it does now (or people looked at it
a lot differently)... now all most people see when they look at nodes
are end-points, not potential pathways to other nodes... the point of
the rootkit was to gain root; in "rootkit"'s (and possibly many others)
case it was to gain root on a system other than the one it was installed
on by taking advantage of the fact that users of other systems may also
use the compromised system, but in general the means by which that could
be accomplished were as numerous as the stars in the sky... most attack
techniques evolve stealth tactics to help evade detection and so hold
the window of opportunity open longer and increase the chance of
success... eventually those same stealth tactics became a means by which
one could systematically detect the presence of a rootkit... at that
point what it was to be a rootkit became blurred in the eyes of the
masses just as at one point many people wrongly believed that all
viruses had to 'insert' themselves into *.exe or *.com files...

To me, a rootkit could also be installed on a system with no attempts at
further compromise of other systems or machines. To me, it doesn't
matter was programs/functions were chosen for inclusion in the kit.
Obviously one would choose stealth in most cases - but it would not be
limited to, nor required to include, stealthing.

if they're going to classify something based purely on the fact that it
uses stealth technology then they need a term for that because stealth
alone has never been considered an attack technique before, it's always
been a refinement of other techniques...

True here too - the rootkit is not the attack. The rootkit comes after
the attack has resulted in root access.

 

[Roger Wilco]

definition.

then you weren't reading what you quoted as i just informed you that the
anti-spyware coalition have a *formal* definition for it... see
http://www.antispywarecoalition.org/documents/glossary.htm

I dislike definitions like that. The "gains or maintains administrator
level access" part makes both of us neither right nor wrong - and opens
the door for any exploit or combination of exploits that achieve root
access to be called rootkits. So now a DoS attack against a process
running with root privilege is a rootkit. Even if it has no staying
power. The injection vectors' "payload" code doesn't even have to
properly execute.

I suppose their definition is good enough for them though...did you read
some of their other definitions?

and just as i hand out a swift kick in the ass to people who propagate
the absurdity that virus and malware mean the same thing, i shall hand
out a swift kick in the butt to people who propagate the idea that
rootkit == stealthware....

This I agree with - stealthware is only a part of what rootkits can
contain and it is not entirely necessary that they even contain this.

or, one could get root to run/install it for one...

Sure, by attaching an exploiter to the front, Or by having the exploit's
injection vector's payload code obtain and install it from elsewhere.

 

[kurt wismer]

Roger Wilco wrote: [snip]

is where "kit" comes in imo.

forgive me, but isn't "root" sort of the more important part of the
compound word in question?

Not really, root could mean root directory as easily as root user. A
rootkit could be as simple as issuing the command cd\ in DOS .It
really
is a stealth kit used when one has highest (or high enough)
privilege to
install modified copies of utility programs.

hmmm... now that so much time has passed and things have had a chance
to
settle in, do you see just how far astray you've gone here?

Not really, there are already other ways to describe privilege levels -
the word "root" is not really a good substitute for "most privileged"
since it already refers to many other things that can be viewed as a
"tree".

all words can be ambiguous in one context or another, however in the
context we're talking about root is most certainly not related to trees...

further, the "root" in rootkit never applies to the root directory on a
drive... these are all red-herrings...

I'm just saying that "root" is UNIX slang for the "most privileged"
user - but the word "root" is not suitable comp sci terminology as there
are many other uses.

technical jargon != slang...

as for suitability, extra-contextual uses do not affect a term's
suitability for use in computer science... you don't see people
complaining about ambiguity of terms like port or packet or pipe, do you?

Well.. I'll agree to disagree then. To me it is a collection to use once
you have sufficient privilege. The idea is to leverage your newly found
"root" privilege into further compromising the machine or network.

and here you've slipped up... if you have root on machine A you cannot
further compromise machine A, therefore you can only further compromise
the network - which you do by compromising other machines on the
network, by gaining root (or privileges that can be escalated to root)
on them...

therefore you're actually agreeing with me...

Not only that - but yes ... it would be a good thing to do.

you have made it quite clear that you think a rootkit in the unix sense
is a set of replacement binaries designed to hide your presence... if
that is so then the function of a rootkit in your terms is to hide things...

[snip]

Having root allows you to install a rootkit, Getting root is outside the
scope of what a rootkit does in the first instance, although having it
(root, and the rootkit) can lead to additional machines being rooted
(and rootkitted).

i think you have that backwards... a rootkit is always about getting
root, but the first root you get on a network may not have been through
the use of a rootkit...

[snip]

I didn't read it that way at all. He was referring disgustedly to the
"kit' aspect as a ready made decidedly not a "do-it-yourself"
combination of exploiter and rootkit - maybe implying the skill level of
his attacker was well beyond "script kiddie". The fact is that a skilled
cracker can make his own collection, to suit his target, and it is still
a rootkit.

i'm sorry but your analysis has missed the mark... the context is
clearly about penetration of the machine, not persistence on the
machine... his use of rootkit in that context implies that rootkits are
generally used in the penetration phase (although not in his specific
case)...

What you describe (as rootkit) is more like what that poster describes
as "exploiter" software - specifically exploiter software that ends up
with your gaining root access.

then i suggest you go back and re-read... those exploiters are what *he*
refers to when he says "steenking rootkit toolbox stuff"...

[snip]

Again, to me "exploit root access" in this context means exploiting
(leveraging) the fact of root access.

that's all well and nice... but what it means to you is irrelevant as
they specify an example of what they meant and the example was the
toolkit known as "rootkit", whose properties and functions are well
documented...

You can't exploit root access in
the sense that you can exploit vulnerabilities in broken software. You
can exploit the broken software to attain root access - but this is an
exploiter not a rootkit. Here they meant (to me at least) that they are
designed to exploit (make use of) root access, not that they are
exploits (injection vector w/payload) to attain root access.

they meant tools like "rootkit"... it was designed to sniff passwords so
as to allow you to gain root on machines other than the one it was
installed on...

To me, a rootkit could also be

can i be blunt (or perhaps just curt)?... don't you think we're past the
point in the discussion where you tell me what you *feel* a rootkit is?

installed on a system with no attempts at
further compromise of other systems or machines.

??? i'm sorry, am i reading this right? people compromise machines in
order to 'hang out' on them? that's pretty much what it amounts to if
you make no attempts to further compromise anything else...

To me, it doesn't
matter was programs/functions were chosen for inclusion in the kit.
Obviously one would choose stealth in most cases - but it would not be
limited to, nor required to include, stealthing.

then there is no reason to call them *root*kits... i'm sorry but where i
come from people (especially people who come up with new classifications
for things) do things for a reason...

[snip]

True here too - the rootkit is not the attack. The rootkit comes after
the attack has resulted in root access.

the rootkit is *part* of the attack... you're hiding your presence on a
system for a *reason*... either what you want is there for the taking
and you take it (in which case hiding your presence isn't necessary,
hiding your point of origin is), or you're waiting for something -
something like oh i don't know maybe passwords to other systems...

 

[kurt wismer]

I dislike definitions like that.

i dislike fence-sitting as well...

The "gains or maintains administrator
level access" part makes both of us neither right nor wrong - and opens
the door for any exploit or combination of exploits that achieve root
access to be called rootkits. So now a DoS attack against a process
running with root privilege is a rootkit. Even if it has no staying
power. The injection vectors' "payload" code doesn't even have to
properly execute.

I suppose their definition is good enough for them though...did you read
some of their other definitions?

yes... most of the definitions aren't *too* bad, however their main idea
of using spyware as an umbrella term is rather idiotic...

[snip]

Sure, by attaching an exploiter to the front, Or by having the exploit's
injection vector's payload code obtain and install it from elsewhere.

no, no, i mean the person who has root privileges... root is actually a
principal, a 'user' of the system...

 

[Dustin Cook]

i dislike fence-sitting as well...

Do you hear it? It's the sound of a dead horse. This is truely a
lost cause Kurt. It's akin to playing with the trolls. If he feels a
rootkit is something that "hides" itself, leave him be. Ignorance
knows no bounds anyway, you should know this.

Regards,
Dustin Cook
http://bughunter.atspace.org

 

[Rebecca]

Ignorance
knows no bounds
Retard,
Dustin Cook

New sig? Very apt for you.

 

[kurt wismer]

Do you hear it? It's the sound of a dead horse. This is truely a
lost cause Kurt. It's akin to playing with the trolls.

....says the guy who plays with the trolls... my killfile is now several
orders of magnitude larger than it was before thanks to you...

If he feels a
rootkit is something that "hides" itself, leave him be. Ignorance
knows no bounds anyway, you should know this.

even when the principals in a discussion make no headway, the gallery
can still be better off for knowing more than it did before...

 

[Roger Wilco]

Roger Wilco wrote:

[snipped - getting too long]

all words can be ambiguous in one context or another, however in the
context we're talking about root is most certainly not related to

trees...

If you view privilege levels as one with most privilege and others with
different subsets of permissions (like inheritance in forking child
processes - a family tree) then you can see that we are indeed talking
about "most privileged" being the 'root' of a 'tree' structure. Much the
same as directory structures can be viewed as trees.

further, the "root" in rootkit never applies to the root directory on a
drive... these are all red-herrings...

Geesh - it applies to UNIX slang for most privileged user in a multiuser
environment. That doesn't mean it is a computer science-wide term any
more than "folder" from Windows slang becomes the replacement for
"directory" in describing a filesystem.

technical jargon != slang...

In many cases it should, especially when there is already a technical
term to describe a thing and someone 'invents' a new term to describe
it.

as for suitability, extra-contextual uses do not affect a term's
suitability for use in computer science... you don't see people
complaining about ambiguity of terms like port or packet or pipe, do

you?

They're pretty much accepted terms no matter what OS you're talking
about aren't they? You talk about traversing directories even though
Microsoft might like to call it 'browsing folders'. Directory traversal
exploits don't suddenly become folder browsing exploits just because
Microsoft prefers other names for things.

[snip]

and here you've slipped up... if you have root on machine A you cannot
further compromise machine A,

Not even by making it available for others to get the same privilege? If
I get physical access to a machine with root user logged on that is a
sort of compromise (security is compromised, but the machine itself is
unchanged). If I want back in, I would have to dress up like a courier
again and hope that the opportunity again presents itself. If while
there I make provisions for re-entry from a remote location the machine
is then compromised (changed).

therefore you can only further compromise
the network - which you do by compromising other machines on the
network, by gaining root (or privileges that can be escalated to root)
on them...

Having me logged on as root user (unauthorized) is a breach of security.
The machine is not compromised in the sense that it is still configured
exactly as it was before I got access. In this case the network is
compromised because physical access resrictions weren't properly
enforced.

therefore you're actually agreeing with me...

I agree to disagree.

you have made it quite clear that you think a rootkit in the unix sense
is a set of replacement binaries designed to hide your presence...

No, that is only one intent. It could be a set of programs that cause
information to leak out (or trickle in). Hiding whatever programs and
processes you add to the system is so commonly done that "hiding" has
now become synonymous with "rootkit'.

if that is so then the function of a rootkit in your terms is to hide

things...

That is not at all what I am saying. Picture a kiddie with a t-shirt
that saya "Got root?". I'm sure you've seen such shirts. The rootkit's
function is to answer the unasked question "what do I do next".

Yes, the meaning of rootkit has evidently changed now to mean hiding
whatever it is you decided to do next.

i think you have that backwards... a rootkit is always about getting
root, but the first root you get on a network may not have been through
the use of a rootkit...

From: http://www.sans.org/y2k/TFN_toolkit.htm

"The Attack

The hackers are using buffer overflow exploits on rpc.ttdbserverd,
rpc.cmsd, sadmind, rpc.statd to gain root access to a machine. In some
cases, they use a variant of the /tmp/bob attack which is associated
with
the ffcore buffer overflow exploit. In any event, if they are successful
in gaining access, they ftp the toolkit into a directory on the machine
...."

Here you see that they mention the root access happening prior to the
FTPing of the "kit" - and also they mention earlier " I'd classify this
attack as a simple rootkit style attack with a DoS payload." so the
payload here isn't furthur rooting of more machines.

[snip]

i'm sorry but your analysis has missed the mark... the context is
clearly about penetration of the machine, not persistence on the
machine... his use of rootkit in that context implies that rootkits are
generally used in the penetration phase (although not in his specific
case)...

Not really, the context (concerning his use of the word) is a
disparaging remark - putting down users of kits of any kind because they
often are using the kit without nearly the skill level of one who writes
kits. His point is that his attacker is no script kiddy toolkit user but
instead is a skilled intruder. He "did it the hard way" refers to his
beleif that the intruder wrote his own exploits rather than using
available kits written by others.

then i suggest you go back and re-read... those exploiters are what *he*
refers to when he says "steenking rootkit toolbox stuff"...

Yes, but again his intention seems to be to belittle the kiddies who use
kits written by others, not to use the term in its most correct form.

[snip]

Again, to me "exploit root access" in this context means exploiting
(leveraging) the fact of root access.

that's all well and nice... but what it means to you is irrelevant as
they specify an example of what they meant and the example was the
toolkit known as "rootkit", whose properties and functions are well
documented...

A "rootkit" and a program calling itself "rootkit" are not the same
thing. The program calling itself rootkit does also happen to be one,
but that program and "all" of its functions are not what defines a
rootkit.

Again in this document
https://tms.symantec.com/members/AnalystReports/030929-Analysis-SHV4Rootkit.pdf
the access (via exploit of a vulnerability) come prior to, and apart
from, the installation of the rootkit. The rootkit itself does not
contain the means to obtain root access.

they meant tools like "rootkit"... it was designed to sniff passwords so
as to allow you to gain root on machines other than the one it was
installed on...

But that was not the defining feature.

can i be blunt (or perhaps just curt)?... don't you think we're past the
point in the discussion where you tell me what you *feel* a rootkit

is?

Absolutely, since you won't listen. I'll agree to disagree and will not
discuss it further since no-one else in these groups seem interested.

 

[Roger Wilco]

...says the guy who plays with the trolls... my killfile is now several
orders of magnitude larger than it was before thanks to you...
)

Speaking of ignorance... yet you fail to realize that my view isn't at
all what you suggest it is.

Kurt is of the opinion that the word "root" in rootkit is there because
rootkits are designed to "get root" either on the current machine or on
subsequent machines. On the other hand my opinion is that the word is
there because that privilege level is required prior to attempting to
implement installation of the kit.

We both agree (I think) that the current usage (with regard to this
thread) is somewhat inappropriate because "stealthware" is only a part
of what a rootkit is. Kurt is a tenacious debater and very difficult to
persuade, and I will not continue to try.

even when the principals in a discussion make no headway, the gallery
can still be better off for knowing more than it did before...

Agreed!

Thanks for the discussion anyway.

 

[Roger Wilco]

I'll agree to disagree and will not discuss it further since no-one

else in these groups seem interested.

But in case they are, here is some more reading material:

http://staff.washington.edu/dittrich/misc/faqs/rootkits.faq
http://project.honeynet.org/papers/enemy3/
http://www.cs.wright.edu/people/faculty/pmateti/Courses/499/Fortification/obrien.html
http://www.linuxgazette.com/issue36/kuethe.html

 

[Dustin Cook]

...says the guy who plays with the trolls... my killfile is now several
orders of magnitude larger than it was before thanks to you...

Awe.. Sorry. I'm not feeding them right now. The SATA controller
discussion was just too amusing for me. It's pointless.

Besides, The new BugHunter build is taking alot of time. Tons of new
samples, new layout, full recursive scanning. Bye bye lame browser
hijackers. hehehe.

even when the principals in a discussion make no headway, the gallery
can still be better off for knowing more than it did before...

Yes... I think we've both done enough attempted education of the
gallery. If you can't educate the trolls, what makes you think your
going to do any education with this rootkit nonsense? Just face the
fact (sad as it is) that various individuals/companies knowingly
improperly used the term, and there's no going back now.

The original author who made the discovery shouldn't have been so quick
to call it a rootkit. He has so much coding skill, yet... so little
brains with naming things.

It's a lost cause kurt, people will refer to this POS software now as
rootkits, just as many are now claiming all sorts of things fall under
the umbrella "Malware". Such a vague description.

Regards,
Dustin Cook
http://bughunter.atspace.org

 

[Dustin Cook]

Speaking of ignorance... yet you fail to realize that my view isn't at
all what you suggest it is.

Kurt is of the opinion that the word "root" in rootkit is there because
rootkits are designed to "get root" either on the current machine or on
subsequent machines. On the other hand my opinion is that the word is
there because that privilege level is required prior to attempting to
implement installation of the kit.

We both agree (I think) that the current usage (with regard to this
thread) is somewhat inappropriate because "stealthware" is only a part
of what a rootkit is. Kurt is a tenacious debater and very difficult to
persuade, and I will not continue to try.

Agreed. For different reasons. In all fairness Roger, I wasn't
claiming you were ignorant per say. Just thought I'd let you know.

We'll just have to agree to disagree with regard to this rootkit
nonsense. The end users don't even understand what you guys have been
going back and forth over anyhow.

Agreed!

Assuming the gallery hasn't had an information overload.

Regards,
Dustin Cook
http://bughunter.atspace.org

 

[Raving Loonie]

Do you hear it? It's the sound of a dead horse. This is truely a
lost cause Kurt. It's akin to playing with the trolls. If he feels a
rootkit is something that "hides" itself, leave him be. Ignorance
knows no bounds anyway, you should know this.

Regards,
Dustin Cook
http://bughunter.atspace.org

Ignorance knows no bounds ... anyway, you should know this.

===================================

Funny thing about that expression:

Ignorance knows no bounds

... it should be:

Ignorance only knows bounds.

I guess that I didn't know this. Does it mean that I am ignorant?

 

[Julie]

Awe.. Sorry. I'm not feeding them right now.

...because you got SPNAKED. Again, and again!

 

[kurt wismer]

Roger Wilco wrote:
[snip]

From: http://www.sans.org/y2k/TFN_toolkit.htm

"The Attack

The hackers are using buffer overflow exploits on rpc.ttdbserverd,
rpc.cmsd, sadmind, rpc.statd to gain root access to a machine. In some
cases, they use a variant of the /tmp/bob attack which is associated
with
the ffcore buffer overflow exploit. In any event, if they are successful
in gaining access, they ftp the toolkit into a directory on the machine
..."

Here you see that they mention the root access happening prior to the
FTPing of the "kit" - and also they mention earlier " I'd classify this
attack as a simple rootkit style attack with a DoS payload." so the
payload here isn't furthur rooting of more machines.

keep reading... it contains a sniffer (for getting passwords to other
systems) and multiple backdoors to allow the attacker to (re)gain root
access through other avenues after the rootkit is installed...

[snip]

Not really, the context (concerning his use of the word) is a
disparaging remark

apparently now we're going to have to have a debate about the meaning of
the word "context"... you've clearly captured the *connotation*, but the
*context* (the wider frame of reference in which the term was used, that
clarifies and disambiguates the author's meaning) has to do with
penetration...

he *was* talking about penetration, he did imply that most people would
have used a rootkit to achieve what the person in his example did
(penetrated his system)...

[snip]

A "rootkit" and a program calling itself "rootkit" are not the same
thing. The program calling itself rootkit does also happen to be one,
but that program and "all" of its functions are not what defines a
rootkit.

Again in this document
https://tms.symantec.com/members/AnalystReports/030929-Analysis-SHV4Rootkit.pdf
the access (via exploit of a vulnerability) come prior to, and apart
from, the installation of the rootkit. The rootkit itself does not
contain the means to obtain root access.

you need to read deeper... it contains it's own copy of the system
binary known as login, which can only be to steal passwords or allow
illegitimate root logins... it contains a trojanized version of ssh for
snatching passwords... it also contains a sniffer for grabbing passwords
and and a script for parsing the output of the sniffer...

But that was not the defining feature.

the defining feature is that they aid in gaining root access...

[snip]

Absolutely, since you won't listen. I'll agree to disagree and will not
discuss it further since no-one else in these groups seem interested.

oh, but i am listening... are you listening to yourself? have you
counted the number of times you've started off a rebuttal with the words
"to me a rootkit is" or "to me a rootkit could be" or some other
variation? unless you personally coined the term i'm afraid what the
term means *to you* doesn't really have that much weight...

[from the subsequent message]

> But in case they are, here is some more reading material:
>
> http://staff.washington.edu/dittrich/misc/faqs/rootkits.faq
> http://project.honeynet.org/papers/enemy3/
>http://www.cs.wright.edu/people/faculty/pmateti/Courses/499/Fortification/obrien.html
> http://www.linuxgazette.com/issue36/kuethe.html

what's interesting to me is that every single example you cite contains
a sniffer for getting passwords out of network traffic and at least one
(generally more than one) backdoor to gain root on the affected machine
through a more convenient avenue than was initially used during install
(in retrospect i suppose that *might* be what the anti-spyware coalition
meant by 'maintaining' root access, maybe)...

 

[Roger Wilco]

what's interesting to me is that every single example you cite contains
a sniffer for getting passwords out of network traffic and at least one
(generally more than one) backdoor to gain root on the affected machine
through a more convenient avenue than was initially used during install

Of course, it is a kit and contains programs useful to the intruder...

Like any toolkit, it has many tools the user wants to use. Having a screwdriver
does not make it a screwdriver kit any more than having a wrench makes it a
wrench kit. If the intruder only wants to cause an information leak on a target
machine (not some script kiddie collecting "rooted" machines so he can boast
about his collection being bigger than yours), his kit may not include the sniffer
or any other program that can be construed as an "aid in gaining root access".

It is a "root" kit because the attacker needs root access to use the programs in
the kit, and a kit because it usually contains more than one tool.

(in retrospect i suppose that *might* be what the anti-spyware coalition
meant by 'maintaining' root access, maybe)...

I suspect so, survivability of the compromise is probably the main underlying
theme rather than "rooting" of more machines. Stealth would be a great aid to
survivability as would creating other ways to get back in as root. No surprise
that most if not all kits had both tools. Also no surprise that the focus is now
on stealth as being the defining factor.

This seems to agree that survivability of root access compromise is paramount
and stealth is a major contributor toward achieving that end.

http://www.informit.com/articles/article.asp?p=408884&seqNum=2

No mention of machine collecting is made, only stealth aimed at local survivability
of root access (persistance). It also touches on the historical meaning of rootkit.

You could start at http://www.informit.com/articles/article.asp?p=408884&seqNum=1

But this part isn't just about rootkits.