Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

KERNEL MODE ROOTKITS161Tibetan Government in Exile (see Chapter 7), Duqu (and later Flame and Gauss) wasdesigned to harvest information for a long period of time undetected.In this chapter, we take a detailed look at the Duqu platform and how it relates to thegreater landscape of the related malware, specifically describing kernel-mode rootkits,operating system vulnerabilities that Duqu and others exploit, and the use of stolen keyingmaterial to add an element of stealth to the information harvesting. We also look at whereDuqu was found, how it relates to other pieces of malware such as Stuxnet and TDL3. Wefurther examine the more recent discoveries of Flame and Gauss and how they compareand relate to Duqu.KERNEL MODE ROOTKITSThe operating system kernel represents the highest level of privilege in a modern generalpurpose computer. The kernel arbitrates access to protected hardware and controls how limitedresources such as running time on the CPU and physical memory pages are used by processeson the system. When a process on the system wants to access files, the network, or viewconfiguration data, the kernel is the piece of software with ultimate authority both for determiningif it is appropriate for the process to take these actions, and also for carrying out thoseactions.Since computers have been compromised, attackers have sought means to conceal theirpresence on compromised systems from the users and administrators of those systems.The term “root kit” refers to a collection of tools, or kit, which can be employed to retain accessto the root (administrative) account of a system. Rootkits that modify system software can bedetected with the cooperation of the operating system kernel, so the logical next step forrootkit developers and computer attackers is to compromise the operating system kernel.A compromised operating system kernel can deceive other programs, the users, and theadministrators of that computer system in difficult to detect ways. A kernel-mode rootkitis extremely attractive as it allows complete access to all files and all processes on a computer.Since the operating system kernel is the logical central unit of the operating system, it mightbe reasoned that kernel-mode rootkits represent a high degree of sophistication. While thismight have been true at one point, there are many factors now that work against this hypothesis.“Cookbooks” for creating kernel-mode rootkits and understanding the concepts behindcompromising an operating system kernel are available both freely on the Internet and forpurchase from bookstores.The creation of kernel-mode rootkits has become somewhat commercialized as many maliciousactors on the Internet are willing to pay for a kernel-mode rootkit as a component ofmalicious software. Also, while the operating system kernel might seem complicated, thefunction and design of operating system kernels is well covered in many undergraduatecurriculums and information about their function is freely available on the Internet.Duqu included a kernel-mode component that was responsible for coordinating many ofthe actions of the malware as a whole. Typically, kernel-mode drivers can be used to take bodiesof code that perform logical actions and inject those bodies of code into already-runningprocesses. In the Windows operating system, processes are containers for units of execution