Detecting Stealth Software
My blog content mole pointed me to this report which has just been released .
Detecting Stealth Software with Strider GhostBuster
Yi-Min Wang; Doug Beck; Binh Vo; Roussi Roussev; Chad Verbowski
February 2005
Stealth malware programs that silently infect enterprise and consumer machines are becoming a major threat to the future of the Internet. Resource hiding is a powerful stealth technique commonly used by malware to evade detection by computer users and anti-malware scanners. In this paper, we focus on a subclass of malware, termed “ghostware”, which hide files, configuration settings, processes, and loaded modules from the operating system’s query and enumeration Application Programming Interfaces (APIs). Instead of targeting individual stealth implementations, we describe a systematic framework for detecting multiple types of hidden resources by leveraging the hiding behavior as a detection mechanism. Specifically, we adopt a cross-view diff-based approach to ghostware detection by comparing a high-level infected scan with a low-level clean scan and alternatively comparing an inside-the-box infected scan with an outside-the-box clean scan. We describe the design and implementation of the Strider GhostBuster tool and demonstrate its efficiency and effectiveness in detecting resources hidden by real-world malware such as rootkits, Trojans, and key-loggers.
There are some evocative ghostware names arent there? Urbin, Mersting, Vanquish, Hacker (original eh?) Aphex, Defender and ProbotSE, Darkside and Synapsis (for UNIX and Linux) but it's nice that AskStrider can sort out these guys hiding inside your machine. Mind you, I've always known that there were scary things hiding in here, moving my files when I wanted them and making the PC misbehave. I always thought that they were just gremlins - but GhostBuster (who ya gonna call?) gets rid of those too.
Have a read of the document - it's interesting although a little bit intimidating, and it makes you realize how scarily clever these guys at Microsoft research are...