Stealthy Rootkit Slides Further Under the Radar
April 15, 2009 – 12:06 PMThousands of Web sites have been rigged to deliver a powerful piece of malicious software that many security products may be unprepared to handle.
The malicious software is a new variant of Mebroot, a program known as a “rootkit” for the stealthy way it hides deep in the Windows operating system, said Jacques Erasmus, director of research for the security company Prevx.
An earlier version of Mebroot, which is what Symantec named it, first appeared around December 2007 and used a well-known technique to stay hidden. It infects a computer’s Master Boot Record (MBR). It’s the first code a computer looks for when booting the operating system after the BIOS runs.
If the MBR is under a hacker’s control, so is the entire computer and any data that’s on it or transmitted via the Internet, Erasmus said.
Since Mebroot appeared, security vendors have refined their software to detect it. But the latest version uses much more sophisticated techniques to stay hidden, Erasmus said.
Mebroot inserts program hooks into various functions of the kernel, or the operating system’s core code. Once Mebroot has taken hold, the malware then makes it appear that the MBR hasn’t been tampered with.
You must be logged in to post a comment.