Ukuthola ama-rootkits nge-RootkitRevealer: Umhlahlandlela osebenzayo nophelele

Ama-Rootkit, ngokwencazelo, ayacasula kakhulu: afihla ngaphakathi ohlelweni lwakho futhi akhohlise amathuluzi akho ukuthi acabange ukuthi konke kuhamba kahle uma kungenjalo. Ukwazi ukuthi ungawathola kanjani ngethuluzi elifana ne-RootkitRevealer kubalulekile ekutholeni kabusha ukulawula. Kulo mhlahlandlela, ngizochaza, isinyathelo ngesinyathelo, ukuthi ungayiqonda kanjani imiphumela, ukuthi kusho ukuthini ukungafani, nokuthi ungenza kanjani ngaphandle kokushesha noma ukuphula noma yini endleleni, njalo ngeseluleko esisebenzayo kanye nendlela yokuzivikela eyi-100%.

Nakuba i-RootkitRevealer iyithuluzi elidala, ifilosofi yayo isafundisa okuningi mayelana nendlela ama-rootkit afihla ngayo nokuthi ungaqhathanisa kanjani "lokho okushiwo yi-Windows" nokuthi "lokho okukudiski ngempela." Uzobona ukuthi yini eyitholayo kahle, lokho engayitholi, ukuthi ungazenza kanjani izikena ngokuzenzakalela, nokuthi ungahumusha kanjani izimo ezijwayelekile ezifana namafayela e-metadata e-NTFS, okhiye bokubhalisa abane -NULLs efakiwe , noma umehluko wosayizi/uhlobo phakathi kwe-API nedatha eluhlaza.

Iyini i-rootkit futhi kungani kunzima kangaka ukuyibona?

Uma sikhuluma ngama-rootkit, sibhekisela kumasu e-malware kanye nezingxenye (amagciwane, i-spyware, noma ama-Trojans) aklanyelwe ukufihla ubukhona bawo ohlelweni kanye namathuluzi alo okuphepha. Leli khono lokuzifihla yilona elenza kube nzima ukuwabona nokuwasusa.

Ngokusekelwe ekuqhubekeni kwawo, sihlukanisa phakathi kwama-rootkit asinda ekuqaliseni kabusha (okuqhubekayo) nalawo ahlala kwimemori kuphela (okungaphili). Ama-rootkit aphikelelayo agcina izingxenye ku-Registry noma ohlelweni lwamafayela futhi asebenza ngokuzenzakalelayo lapho ikhompyutha iqala, kuyilapho ama-rootkit ememori kuphela enyamalala ngemva kokuqala kabusha.

Ngokusekelwe endleleni yokusebenza kwazo, zihlukaniswa njengemodi yomsebenzisi noma imodi ye-kernel. Izinhlelo zemodi yomsebenzisi ziphazamisa imisebenzi ye-Windows API (i-FindFirstFile/FindNextFile, ukubalwa kwenqubo, noma i-Registry) ukuze zihlunge izinto ezizoveza ubukhona bazo. Izinhlelo zemodi ye-Kernel ziya phambili futhi zilawula izingcingo zomdabu noma izakhiwo zesistimu yangaphakathi, zize zifinyelele ngisho nasekufihleni izinqubo ohlwini lwenqubo esebenzayo ye-kernel.

Empeleni, uzohlangana neminye imindeni namasu: i-kernel, uhlelo lokusebenza, inkumbulo, ama-bootkit (athinta i -boot loader ), ama-rootkit omtapo wolwazi, kanye nama-rootkit e-firmware. Ama-Firmware nama-bootkit ayinkinga kakhulu ngoba alayisha ngaphambi kwesistimu yokusebenza futhi angasinda ekufakweni kabusha.

Isebenza kanjani i-RootkitRevealer: iqhathanisa ukubuka kweWindows nedatha yangempela

I-RootkitRevealer yakhelwe ukuthola ama-rootkit alawula ama-API. Icebo layo ukuqhathanisa "umbono wezinga eliphezulu" (i-Windows API) "nombono wezinga eliphansi" (ukufundwa okungahleliwe kwamavolumu e-NTFS/FAT kanye nezihlahlana zeRegistry). Uma kukhona okuboniswa nge-API kodwa hhayi kudatha eluhlaza, noma okuphambene nalokho, kukhona ukungafani okudingeka kuphenywe.

Ngenxa yale ndlela, iRootkitRevealer yake yabamba izinsongo eziqhubekayo ezidumile njenge-AFX, iVanquish, kanye neHackerDefender. Kodwa-ke, ayimbozi konke: isibonelo, ayiklanyelwe ukuthola ama-rootkit angazami ukufihla amafayela noma okhiye beRegistry (njenge-Fu), ngakho-ke ukusebenza kwayo kugxile kulawo "afihla" izibalo.

Ingabe ama-rootkit angayikhohlisa? Ngokwethiyori, yebo: kuzodingeka abambe ukufundwa okungavuthiwe okuvela kuma-hives e-Registry noma idatha yediski bese ekushintsha "ngokushesha" ngaphandle kokwephula ukuvumelana kwe-NTFS/FAT noma ifomethi ye-subtree ye-Registry. Lokhu kuyinkimbinkimbi kukhona ezimweni ezithuthukisiwe, kodwa akulula ukukusebenzisa ngaphandle kokushiya umkhondo.

Kubalulekile ukukhumbula umkhawulo oyisisekelo: ngaphakathi kohlelo oluvele luthintekile yi-rootkit ye-kernel, azikho iziqinisekiso eziphelele. Umhlaseli onokulawula i-kernel angalawula noma iyiphi i-API, ngisho naleyo esetshenziswa yi-RootkitRevealer. Ngakho-ke, noma nini lapho kungenzeka, kuyalulekwa ukuqhathanisa ukuskena okuku-inthanethi nokungaxhunyiwe ku-inthanethi.

Izidingo kanye nemikhuba ehamba phambili ngaphambi kokuskena

Ukuze i-RootkitRevealer isebenze kahle, i-akhawunti eyisebenzisayo kumele ibe namalungelo okuthi "Yenza isipele samafayela nezinhlu zemibhalo," "Layisha abashayeli," kanye nokuthi "Yenza imisebenzi yokulungisa ivolumu." Ku-Windows XP nakamuva, iqembu labaphathi selivele linalezi zimvume, ngakho-ke qala ithuluzi kusuka ku-akhawunti enamalungelo aphezulu.

Nciphisa imiphumela engamanga: vala zonke izinhlelo zokusebenza bese ushiya ikhompyutha ingasebenzi ngangokunokwenzeka ngesikhathi sokuskena. Ukugwema izinguquko kumafayela nezinkinobho ngenkathi kuskenwa kunciphisa ukungafani "okungekuhle" (isibonelo, ilogi ejikelezayo noma ukhiye obuyekeza isitembu sayo sesikhathi njalo ngemizuzwana embalwa).

Inothi eliwusizo: inguqulo yomyalo oqondile yayekwa eminyakeni edlule ngoba i-malware yayifuna i-executable ngegama. I-utility manje iqala ikhophi enegama elingahleliwe futhi isebenza njengesevisi, yize igcina amapharamitha okuzenzakalelayo kwenqubo nokugcina imiphumela kufayela.

Uma kuphakama ukungabaza mayelana nokusetshenziswa noma ukuhumusha, ukubuyekeza izinkundla zobuchwepheshe ze-Sysinternals kunganikeza izinkomba mayelana namacala angempela kanye nemiphumela emihle engavamile, ikakhulukazi ngokufaka "okungajwayelekile" kweRegistry, ukusakazwa kwedatha ehlukile, noma imethadatha ye-NTFS.

Ukusetshenziswa ngesandla kwe-RootkitRevealer

Ukusetshenziswa okuyisisekelo kulula: vula uhlelo lokusebenza bese uthinta okuthi “Skena.” Uzobona intuthuko yakho phansi, futhi uma usuqedile, uhlu lokungafani. Izinketho ezimbili ezibalulekile ongazivumela/ungazikhubaza zithinta lokho okuboniswayo nokuqoshwe ngesikhathi sokuhlolwa :

• Fihla amafayela emethadatha e-NTFS: Inikwe amandla ngokuzenzakalela. Ivimbela ukubonakala kwamafayela e-NTFS angaphakathi (afana ne-$MFT noma i-$Secure) angavezwanga yi-Windows API kodwa akhona kudiski.
• Irekhodi lokuhlolwa: futhi inikwe amandla ngokuzenzakalela. Uma uyisusa, i-RootkitRevealer ngeke iskene i-Registry, ekhawulela ububanzi bokuqhathanisa nesistimu. amafayela kuphela.

Khumbula: I-metadata ye-NTFS iyahlukahluka kuye ngenguqulo kanye nezici ezivuliwe (ukubhala, ama-quota, izinto, njll.). Uma ungawafihli lawa mafayela, uzobona ukungafani okuningi "Okufihliwe yi-Windows API" kumavolumu e-NTFS, futhi lokhu kungafani akusho ukuthi kukhona ukutheleleka.

Ukuhlaziya okuzenzakalelayo nezinketho zomugqa womyalo

I-RootkitRevealer ikuvumela ukuthi uskene ngokuzenzakalelayo futhi uthumele imiphumela kufayela lendawo. I-syntax ilandelayo, iwusizo ekuhleleni noma uma ufuna ukufaka imiphumela kudathabheyisi :

Isibonelo: rootkitrevealer outputfile]

• -a: ihlaziya futhi iphume ngokuzenzakalelayo lapho iqedile.
• -c: Ifometha okukhiphayo njenge-CSV (ilungele ukungenisa).
• -m: Ibonisa imethadatha ye-NTFS (ayiyifihli).
• -r: Ikhubaza ukuskena Kwerejista (amafayela kuphela).

Okubalulekile: Ifayela lokukhipha kumele lihlale kuvolumu yendawo. Uma uvumela i-`-c` , inqubekela phambili ngeke iboniswe futhi ukungafani kuzogcinwa ngqo kufayela le-CSV. Kumishini ekude, ungasebenzisa i-Sysinternals' PsExec ngomugqa onjengalona:

Isibonelo esikude: psexec \\remote -c rootkitrevealer.exe -a c:\windows\system32\rootkit.log

Le ndlela iwusizo ekuhlaziyeni okukhulu noma lapho udinga ukuqoqa ubufakazi obuvela emishinini eminingi ngaphandle kokuxhuma iseshini yedeskithophu ekude.

Ukutolika imiphumela: ukungezwani okujwayelekile nokuthi isho ukuthini

Inzuzo yangempela ye-RootkitRevealer itholakala endleleni ochaza ngayo okutholakele. Ayikho indlela ephelele yokuthi "konke noma akukho lutho": kufanele ubuyekeze okufakiwe ngakunye bese uzibuza ukuthi kunengqondo yini. Ngezansi kunezigaba namathiphu avame kakhulu okugwema imiphumela engemihle :

Kufihliwe ku-Windows API . Lokhu kungumehluko ojwayelekile. Uma ungayifihli imethadatha ye-NTFS, uzobona okufakiwe okuningi kwamafayela angaphakathi njenge-$MFT noma i-$Secure uhlelo oluyifihla ku-API. Ezinye izinhlelo ze-antivirus zigcina idatha emifudlaneni yedatha ehlukile (i-ADS) futhi "ziyifihle" zisebenzisa amasu afanayo, ngakho-ke izobonakala ifihliwe ku- Windows API.

Uhlu lwemethadatha ye-NTFS (Windows Server 2003) ongahlangabezana nayo ngaphandle kokuthi kube uhlelo olungayilungele ikhompyutha: $AttrDef, $BadClus, $BadClus:$Kubi, $BitMap, $Isiqalo, $LogFile, $Mft, $MftMirr, $Secure, $UpCase, $Ivolumu, $Extend, $Extend\$Reparse, $Extend\$ObjId, $Extend\$UsnJrnl, $Extend\$UsnJrnl:$Max, $Extend\$Quota. Lezi zehlakalo zivamile ku-NTFS futhi, ngokwazo, azikhombi ku-a rootkit.

Ukufinyelela kwenqatshiwe . Ngaphansi kwezimo ezivamile, i-RootkitRevealer akufanele ibike ukuthi "Ukufinyelela kwenqatshiwe" ngoba isebenzisa izindlela zokusekela ukuvula konke. Uma uyibona, kufanelekile ukuyibuka okwesibili, yize kungenzeka futhi ukuthi ifayela likhiyiwe ngesikhathi esithile noma isilawuli sokufinyelela sangaphandle esivimbela okwesikhashana ukufundwa kwefayela.

Kubonakala ku-Windows API / MFT / inkomba yesiqondisi . Kunezinhlanganisela eziningana: “Kubonakala ku-API, kodwa hhayi ku-MFT noma kunkomba”, “Kubonakala ku-API kanye nenkomba, kodwa hhayi ku-MFT”, “Kubonakala kunkomba, kodwa hhayi ku-API noma ku-MFT”… Incazelo evame kakhulu ifayela elidalwa noma elisuswayo ngesikhathi sokuskena. Isibonelo esijwayelekile:

C:\newfile.txt

Usuku lwehora

Amabhayithi we-8

Kubonakala ku-Windows API, kodwa hhayi kunkomba yemibhalo noma i-MFT.

Ubude ngokwe-Windows API abufani nedatha ye-subtree . Lokhu kungenzeka uma i-rootkit izama ukufihla okuqukethwe "ngokwenza" usayizi ohlukile, noma uma inani lishintsha ngenkathi lifundwa. Noma yiliphi inani elinjalo lidinga ukunakwa okukhethekile, ikakhulukazi uma ungalindele ukuthi lishintshe ngesikhathi sokwenziwa.

Ukungafani kohlobo phakathi kwe-Windows API kanye ne-subtree engahluziwe . Amanani okubhalisa anezinhlobo (REG_SZ, REG_DWORD, REG_BINARY, njll.). Ukungafani kubonisa ukuthi uhlobo olubonwa yi-API alufani nohlobo olusesidlekeni. Lokhu kungasetshenziswa ukufihla idatha (isb., ukugcina idatha enambambili ngokuyidlulisa njengentambo eno-zero ohamba phambili). Kunconywa ukuqinisekisa ukuthi isemthethweni.

Igama lesihluthulelo liqukethe ama-NULL afakiwe . I-Windows iphatha amagama ayisihluthulelo njengezintambo eziqediwe yi-NULL, kuyilapho i-kernel isebenzisa izintambo ezibaliwe. Lokhu kuvumela ukudalwa kwezinkinobho "ezingabonakali kancane" zamathuluzi afana ne -Regedit . Kuyindlela ebhalwe phansi esetshenziswa yi-malware. Ukuze iwasuse, i-Sysinternals ine -RegDelNull.

Umehluko wedatha phakathi kwe-API kanye ne-subtree engakavuthwa . Lokhu kuvame ukukhombisa inani elibuyekezwa ngesikhathi sokuskena. Izibonelo ezijwayelekile zifaka phakathi izikhathi zokuvuselelwa kwesevisi (njenge-SQL Server) noma amanani "okuskena kokugcina". Kodwa-ke, kubalulekile ukuqinisekisa ngokwesimo ngasinye ukuthi inani lingelohlelo lokusebenza olusemthethweni hhayi ingxenye esolisayo.

Yini i-rootkit engayenza nendlela yokubona izimpawu zayo

Uma i-rootkit ithola amalungelo aphezulu, umhlaseli angafaka i-backdoor, engeze i-malware eyengeziwe (ama-keylogger, i-spyware, ama-bots), afunde, akopishe, futhi ashintshe amafayela, futhi ashintshe izilungiselelo zesistimu ngokuthanda kwakhe. Izophinde irekhode iziqinisekiso futhi, kwezinye izimo, ikhubaze i-antivirus kanye nesofthiwe ye-firewall.

Izimpawu zesixwayiso zifaka phakathi ukwehla okungachazeki, izinqubo ezingaziwa , ukwanda kwethrafikhi yenethiwekhi ngaphandle kokuvulwa kwezinhlelo zokusebenza, amafayela anyamalalayo noma onakele, amaphutha angavamile noma izikrini eziluhlaza okwesibhakabhaka, kanye nezinguquko zokucushwa ezingacelwanga. Nakuba kungekho kulokhu okuqinisekisa inkinga ngokwayo, konke lokhu kuyizinkomba zokuyekethisa.

Inothi lomlando lokuqonda umthelela walo: amacala afana ne-Stuxnet (ukubhujiswa kwezimboni), i-scandal ye-rootkit ye-Sony BMG efakwe kuma-CD abasebenzisi, noma i-rootkit ye-UEFI LoJax esindayo ekufomethweni, abonisa ukuthi ukuphikelela kungahamba ibanga elingakanani.

Khumbula ukuthi kunezindlela ezifana nama-bootkits (MBR/UEFI) noma i-firmware elayisha ngaphambi kwesistimu yokusebenza futhi ingaphinde ivele ngemva kokufakwa kabusha. Ezindaweni zanamuhla, i-Secure Boot kanye ne -TPM ziyasiza ekunciphiseni lolu hlobo lwezenzo.

Amathuluzi ahambisanayo kanye nokusabela ekuthelelekeni

Uma usola ukuthi kukhona ukutheleleka, isinyathelo sokuqala ukunqamula ukuxhumana nomhlaseli. Nqamula ikhompyutha kunethiwekhi (i-Ethernet/Wi-Fi/Bluetooth) futhi ugweme ukufaka noma yimaphi amadrayivu e-USB angaskeniwe. Ukusuka lapho, nquma ukuthi uzoskena yini kumodi ephephile noma, okungcono nakakhulu, kusuka kudrayivu yangaphandle ebhuthwayo.

• I-GMER: Ithola izinqubo ezifihliwe, izingwegwe ze-kernel, nezinguqulo ezisolisayo.
• Kaspersky TDSSKiller: iwusizo kakhulu nge-kernel bootkits/rootkits.
• I-Malwarebytes Anti-Rootkit: Ukuhlanza okugxile ku-Windows.
• Windows Defender Okungaxhunyiwe ku-inthanethi: Skena ngaphambi kwamabhuthi esistimu.
• RogueKiller: ukubuyekezwa kwenqubo, MBR kanye nokhiye wokubhalisa.
• Idiski Lokusinda laseKaspersky: Imidiya yokuhlenga ye-BIOS/UEFI nemikhakha yokuqalisa.
• I-Autoruns kanye ne-Process Monitor (Sysinternals): ukubona ukuthi inqubo ngayinye iqala futhi yenzani.

Uma inkinga ikhomba ukuqalisa noma i-firmware, cabanga ukubuyisela i-MBR nge bootrec /fixmbr ku-Windows futhi, uma kunesidingo, khanyisa i-BIOS/UEFI ngenguqulo ehlanzekile evela kumenzi. Ngemva kokuhlanza, vula Secure Boot kanye TPM ku-UEFI ukuvikela i-boot.

Uma amathuluzi ehluleka ukuyiqeda, indlela ephephile yokwenza iwukudala isipele esingaxhunyiwe ku-inthanethi, ukukhipha uhlelo ngokuphelele, bese ulufaka kabusha usebenzisa izindlela ezisemthethweni. Yisisombululo esinzima kakhulu, kodwa ukuphela kwaso esiqinisekisa ukuthi akukho malware eqhubekayo ehlala ohlelweni.

Ukuvimbela kanye "nokuhlanzeka": ukuqina okuyisisekelo (isimiso samalungelo aphansi), ukugcina izibuyekezo zesistimu kanye nezinhlelo zokusebenza zisesikhathini, ukugwema isofthiwe ebanjwe ngobugebengu , ukukhubaza i-USB autorun , ukwenza amakhophi avamile angaxhunyiwe ku-inthanethi, kanye nokuqapha ukungalingani ngezixazululo ze-SIEM ezindaweni zezinkampani.

Izimiso zokuziphatha, okusemthethweni kanye nezindawo zokuhlola

Ukuphenya ama-rootkit ngaphandle kwemvume akuvumelekile futhi kuyingozi. Uma wenza izivivinyo, kwenze lokho ezindaweni ezikude: imishini ebonakalayo engenawo ukufinyelela kwe-inthanethi noma amanethiwekhi aklanyelwe ngqo le njongo. Ngaphambi kokwenza noma yiziphi izinguquko endaweni yokukhiqiza, qiniseka ukuthi unama-backups akamuva kanye nohlelo lokubuyisela emuva.

Khumbula ukuthi amanye ama-rootkit azama ukuthola amathuluzi afana ne-RootkitRevealer bese "emisa" ukucasha kwawo ngesikhathi sokuskena ukuze angatholakali. Yingakho ukuhlanganisa ukuskena okubukhoma nokuskena okungaxhunyiwe ku-inthanethi nokuqhathanisa okutholakele nemithombo ethembekile kubaluleke kakhulu.

Amacala kanye nezinsiza ukuze ujule

Amacala adumile: I-Stuxnet ibonise ukuthi i-rootkit ingalimaza izinhlelo zezimboni ngaphandle kokuphakamisa izinsolo; i-Sony BMG ifake i-rootkit yokuvikela ubugebengu kuma-PC abasebenzisi; i-LoJax yaqala inkathi yama-rootkit asendle e-UEFI; kanti i-TDL-4/Alureon yasebenzisa izinqubo zokuqalisa ukuze iqhubeke . Imikhankaso efana ne-"Greek Watergate," i-Flame, ne-Scranos, egxile ekuhloleni nasekutholeni imali, nayo ibhaliwe.

Ukufundwa kanye nezinsiza: izihloko zobuchwepheshe ezivela ku-Sysinternals/Windows IT Pro, incwadi ethi “Rootkits: Subverting the Windows Kernel” (Hoglund & Butler), iqoqo le-Phrack, kanye ne-Windows Internals ukuze kuqondwe ukwakheka okuyisisekelo. Ukuze uhlanze okhiye “abangavamile”, khumbula amathuluzi afana ne -RegDelNull.

Umongo Wethuluzi: I-RootkitRevealer yasungulwa ekuqaleni kwe-Windows XP/Server 2003 (32-bit) futhi manje isiyisisetshenziswa semfundo sokuqonda indlela yokuqhathanisa "i-API vs. eluhlaza". Ezinhlelweni zesimanje, ihlanganisa izimiso zayo eziyinhloko namathuluzi okutakula abuyekeziwe kanye nokuzivikela kwepulatifomu njenge- Secure Boot.

Uma ususa into eyodwa, makube yile: njalo qhathanisa okushiwo yi-API nalokho okuku-disk/Registry, qonda ukuthi kungani kuvela ukungafani (akuwona wonke ama-malware), thembela kumathuluzi okusindisa uma usola ukulawula okuphansi, bese uqinisekisa inqubo yokuqalisa ngezilinganiso zepulatifomu; lokhu kuzosika amaphiko e- malware efihliwe.