Kernel-mode rootkits install themselves deep inside the operating system. They often use cloaking techniques to hide themselves and other malware to prevent detection or removal. The introduction of kernel patch protection in 64-bit Windows made it more difficult for kernel-mode rootkits to infect the operating system, but the threat has not been completely removed, and rootkits have already penetrated 64-bit Windows.
Running up-to-date anti-virus software, and keeping Windows and other software updated with all of the latest security patches, should prevent infection from most known malware threats. However, the risk of a zero-day attack that includes a kernel-mode rootkit continues to pose the most serious security threat. The ability of a zero-day rootkit to hide itself from security software can make subsequent detection and removal extremely difficult, often resulting in re-imaging of the operating system, assuming that it is even possible to detect the malware infection. The fact that a kernel-mode rootkit could go undetected makes it difficult to fully assess the true scale of the problem.
One important step that can be taken in the fight against zero-day rootkits is to ensure that users log on to their computers with a standard user account. Most kernel-mode rootkits will simply fail to install when the user is logged on with a non-administrator account, as the successful installation of the rootkit will require write access to a secured area of the HKLM hive of the registry. To install under a standard user account the malware would need to discover and then exploit one or more vulnerabilities in the operating system, in order to gain higher privilege levels, making it much more difficult for the malware to infect or spread.
Avecto Privilege Guard (Edit: now Defendpoint) enables organizations to implement least privilege, by ensuring users log on with standard user accounts and elevating the individual applications that require privileged access. Any zero-day attacks that are not detected by the anti-virus software will run with the user’s standard rights, making it difficult for the malware to compromise the kernel. Although least privilege can’t protect against all malware threats, it is an extremely effective line of defense against stealthy and persistent threats that attack deep inside the operating system.
On a final note, I would like to mention the innovative new technology that our partner McAfee launched at their Focus11 event in Las Vegas. McAfee DeepSAFE, which was jointly developed with Intel, enables McAfee to build hardware assisted security products. The DeepSAFE technology sits below the operating system, allowing it to detect hidden threats, such as stealth rootkits and Advanced Persistent Threats (APTs). McAfee Deep Defender is the first product to utilize the DeepSAFE technology and is managed with McAfee ePO software. McAfee Labs state that the stealthy malware threat is escalating and that they detect 110,000 new unique rootkits each quarter.
Here at Avecto we are delighted to be working closely with McAfee and we will soon be launching our ePO integrated version of Privilege Guard. I believe that the combination of least privilege with Privilege Guard and hardware-level protection with DeepSAFE, provides a major step forward in the fight against kernel-mode rootkits and other stealthy malware.
