In this lesson,
we're going to discuss rootkits.
Now, a rootkit is a specific type of software
that's designed to gain administrative-level control,
over a given computer system without being detected.
Now, this is a really important concept
because if somebody can install a rootkit on your system,
they can gain root
or administrative-level permissions over that system.
And this is the highest level of permissions
that somebody can have on a given computer system or server.
So, if you're using a Windows machine, for example,
the account with the highest level of permission,
is called the administrator account.
That administrator account allows the person
to install programs, delete programs,
open ports, shut ports,
and do pretty much whatever it is they want to do
on that given system.
If the victim is using Unix, Linux or a Mac OS computer,
this type of administrator account,
is actually called the root account.
Either way, getting administrative
or root account access is a wonderful thing
for an attacker or threat actor,
but it is a horrible thing for you
and the security of your system.
So now that you have an understanding of what a rootkit is,
and the type of permissions it's seeking to gain,
let's take a moment to learn how a rootkit actually works.
Now, if you look at a computer system,
it has several different rings of permission used
throughout the system.
The outermost ring is called ring three,
and this is where the user permissions are going to be used.
So if you're logged as a standard or regular user,
you're mostly going to be operating in ring three.
Now, each program can be run in different security rings,
moving from ring three at the outermost level,
all the way down to ring zero at the innermost
or highest permission level in the system.
When you're operating in ring zero,
we call this the kernel mode.
The kernel mode allows the system to control access
to things like the device drivers, your sound card,
your video display or monitor, and other things like that.
Kernel mode or ring zero is not something you're going to log
into the system as, but instead it is the most trusted
and powerful ring inside the operating systems design.
Now, if you log in as the administrator
or route user on a system,
you're going to have route permission,
and you'll be operating at ring one of the operating system.
Now, this is closer to ring zero than ring three was,
so it's easier to do more damage on the system
from ring one than it would be from ring three.
Now, when a root kit is installed,
it tries to gain the highest levels of permission possible.
So any malicious code it's going to execute,
we'll operate in ring one, or if they're lucky,
even as low as ring zero.
Remember, the closer the malicious code is
to ring zero or the kernel,
the more permissions it's going to have
and the more damage it can do on your system.
Now, when a rootkit is installed on a system,
it tries to move itself from ring one to ring zero,
so it can hide from other functions
of your operating system as well to avoid detection.
In fact, rootkits are able to perform malicious operations
on a target computer at any date they want
without the knowledge of the administrators or the users,
and even sometimes without the knowledge
of the operating system itself if they're properly coded.
Remember, a rootkit is designed to really dig
into your operating system deeply.
So your antivirus and anti-malware solutions,
have a really really hard time detecting them.
Now, one technique that's used by rootkits
to gain this deeper level of access is known
as a DLL injection.
Now, a DLL injection is a technique used
to run arbitrary code within the address space
of another process by forcing it
to load a dynamic-link library.
A dynamic-link library, also known as a DLL,
is simply a collection of code and data
that can be used by multiple programs simultaneously
to allow for code reuse and modularization
in software development.
And these DLLs are often provided
by default inside of the Windows operating system.
With a DLL injection,
the malicious code is going to be inserted
into a running process on a Windows machine
by taking advantage of those dynamic-link libraries
that are being loaded up at runtime.
This means that the Windows system,
doesn't even understand the fact
that it has a rootkit installed inside of one of those DLLs
that is then designed
to load every time you boot up a Windows machine.
This kind of DLL injection is going to work
by using what is known as a shim.
Now, a shim is simply a piece of software code
that's placed between two components,
and it intercepts the calls between those two components
and then it can redirect those calls.
So the rootkit will intercept the communications,
between the Windows operating system
and the dynamic-link library,
and then it redirects that call once it's embedded
into some kind of malicious code
that's being embedded inside of it.
Now, these rootkits are extremely powerful,
and they're also very difficult to detect
because the operating system is essentially blinded to them.
To detect them, the best way is to boot
from an external device
and then scan the internal hard disk drive
or solid state device
to ensure you can detect those rootkits,
using a good anti-malware scanning solution
from a live boot Linux distribution.
So remember, a rootkit is a piece of malicious software
that's designed to infiltrate a computer system
at the highest administrative permission level
while remaining undetected.
Rootkits aim to gain access
as close to ring zero as possible,
and they'll start out at ring three,
the user-level permission ring,
and work their way down all the way to ring zero,
the kernel mode permission ring,
where they can wreak the most havoc.
A rootkit's primary objective is
to seamlessly embedded itself into the operating system,
and this is often done
by exploiting the system's inherent trust
in the dynamic link library system or DLL system,
using a DLL injection, and the use of a shim technique.
Because of the deep rooted nature of a rootkit
and its ability to hide itself from the operating system,
traditional antivirus and anti-malware solutions,
will often fail to detect rootkits.
Therefore, the most effective method
for rootkit detection removal is going
to be to conduct an external system scan.
Remember, guarding yourself against rootkits,
does require continuous vigilance
and the implementation of robust security measures,
across your entire enterprise systems.