Rootkits bundled with Adware (Suckage Squared.)

Phoenix

Bird of Fire

Team Member
Elite (7.5k+)

Posts: 8814

Rootkits bundled with Adware (Suckage Squared.)

« on: 2005-12-11, 13:43 »

http://www.foxnews.com/story/0,2933,178282,00.html

If you don't know what a rootkit is, you should. Imagine someone in your home, spying on you, possibly telling someone else everything you do, doing whatever they want, yet that person is completely invisible to you. You cannot see, hear, touch, or smell them. That's the equivalent of how a rootkit behaves on your computer. A rootkit is the mechanism by which some spyware, viruses, etc, can hide on your system without you being able to see them at all. They do this by sitting between the operating system and the user, telling the OS not to show certain files, processes, or system hooks to the user. They hide from anti-spyware applications in the same way. If you have them, you will NOT know they are there unless they exhibit some kind of behavior (like popping windows up). The nasty kind sit there in the background and silently lift passwords, bank account numbers, etc, for transmission to foreign servers (part of the reason Phoenix will never, ever use online banking services). It used to be that hackers, phishers, and other cyber-thieves were the primary users of rootkits. Now adware spammers are using them with increasing frequency. Even Sony/BMG got busted using a rootkit in a music CD copy protection scheme that actually resulted in several computers getting hacked since their wonderful, unannounced, poorly written, self-installing rootkit made the systems extremely vulnerable to the hackers. They got sued for it too.

So what can you do to avoid getting a rootkit? The "obvious" stuff, but my definition of obvious differs from some people's so here's my tips:

1) Ditch Internet Explorer. Use Mozilla or Firefox. Think of Internet Explorer as the "Windows Update Interface" and only use it for that.

2) Install the "Adblock" and "Noscript" plugins for Firefox. Set up some good filters for Adblock, and 99% of the internet's annoyances go away. Noscript kicks ass, it prevents javascript from running on pages unless you allow them, and it has a lot of control so you can enable it on sites you want. No java script, no flash, no infection. Very easy to use. Phoenix loves it because Phoenix distrusts javascript.

3) Don't open or forward "chainletter" emails.

4) Don't open suspicious emails. This includes from people you know and trust. They may not have an infection, but someone they've emailed might, and the virus/worm can be sending out emails with forged headers from this third party to any email address on the person's machine. It'll look like it came from someone you know, but the actual origin was someone you've never ever emailed. I've seen this happen a lot. I actually got several this week from Planetquake that got scrubbed on the way in. Slipgate - Exhausted

5) For God's sake, don't accept ANY "free" stuff tacked onto an email, especially if "Person you know recommends item whatever". Most of the crap I've cleaned off computers is from people downloading their "free smileys" and other stuff of that nature. You want free stuff? Watch where you go and what you get. The more enticing it looks, the more likely it's spiked with spyware/adware.

6) Use a GOOD antivirus program, like Symantec Corporate. Avoid McAfee and watch the freeware ones. I don't care what anyone else says, I've been using Norton's antivirus products for a long time, and to date I have had zero active virus infections on any of my PC's. I've seen what viruses have done to people using other stuff, including an active trojan infection that McAfee just sat there like a dumbass and wouldn't do anything about since it couldn't pick it up. Uninstalling McAfee and installing Norton resulted in an instant detection and removal. Symantec's program is just better. Trust the bird on this one, his record is flawless.

7) Filesharing: Bad idea. Public access FTP on your computer: Bad idea. Lots of infections result from this sort of thing. Don't share files with people you don't know, and scan any files you get immediately, even if you know the person. They might not be as cautious as you are.

Slipgate - Cool

Cracks/Warez: To be avoided. Besides being illegal, you know a lot of it is spiked with trojans. If you don't, well, you do now. I always advocate purchasing products legally whenever possible. Slipgate - Smile

9) Porn. No moral high-horse here, I look at bird porn and enjoy it as much as you humans enjoy porn of your own nature. Porn sites are also a nasty source of (digital) infections. They're a dime a dozen, often set up by some dolt who wants a quick buck and knows nothing about security, so guess where Joe Script Kiddie is going to try out his happy hacker skills and upload a trojan? Do what you want, but watch where you go on the net.

10) Got broadband? Use a router. Hardware firewall > all. Even if you're the only PC on your net connection, it's worth it. Sure, your ISP offers antivirus and anti-spyware protection, etc, but that cannot stop a port scan. A friend of mine tried setting up Windows 2000 on a machine without a router, and got the Code Red worm before she could even run a Windows Update to patch against it. A good router blocks damned near everything. I'm using a D-Link DI-604. I absolutely love it. It has all the control a power user wants, yet is simple enough out of the box that if you just want to "plug it in and go on the net" you can and still be secure. I'm not too thrilled with LinkSys since Cisco bought them. Their port forwarding doesn't work right on their BEFSR41v3 model, yet it worked right on the v2's. They're OK for just web surfing, but if you want to run a Quake server behind one and have it public or do anything else complicated, forget it. Go with the D-Link and learn how to program the ports if you need to run a server.

As for how to get rid of a rootkit, that's trickier. You need a program that is specifically designed to remove them. I've not really had to deal with active rootkit infections, but I do use a tool called Rootkit Revealer to look for them. You have to know your way around the system to really use something like this, so if you're not into "techie" stuff the best defense is to avoid getting one in the first place. Being aware that they exist, what they can do, and how they get on your machine is the first step to that. Hope this information comes in handy.


	Logged

I fly into the night, on wings of fire burning bright...

Arnie

Shambler

Posts: 101

	Author	Topic: Rootkits bundled with Adware (Suckage Squared.) (Read 12112 times)
0 Members and 1 Guest are viewing this topic.