Rooting Out Rootkits

You have deployed every security solution imaginable. You leverage defense in depth. You update and patch regularly. You have built a fortress with a moat. But deep below all your tools is a rootkit saying “everything is ok” while secretly monitoring everything the system is doing and silently extracting data. How can this happen?

What should really concern us is the growing presence of rootkits also known as stealth malware and the zero-day exploits used to deploy them. The current McAfee Labs Threat Report revealed that malware surpassed the company’s estimate of 75 million unique malware samples last year and that rootkits were a contributing factor to this rise 

A rootkit is a specific type of malware that gains privileged access to a system while actively hiding its presence from users and security tools. Rootkits typically provide a remote user access to all resources on the system on which the rootkit is installed. They often join the compromised system to other “rooted” systems as part of a larger botnet.

Rootkits are also hard to defeat because they are well disguised. Building a piece of code that can inject itself into the kernel space and maintain a low profile while sending out sensitive information takes a strong understanding of the operating system and how it deals with device drivers and memory. When a developer has this level of understanding, the developer can also find ways around current security tools, evading or disabling them. 

Traditional security solutions work at the application layer, using hooks into the underlying OS. Rootkits are playing unfair, going below the operating system for their nefarious deeds. To protect against these stealth threats, McAfee has jointly developed technology with Intel to operate beyond the OS to get a new vantage point on security, closer to the hardware. 

McAfee DeepSAFE

DeepSAFE is a platform built to take advantage of the Intel Virtualization Technology (VT) available on Intel Core i3, i5, and i7 processors. DeepSAFE provides a hook between the physical hardware and the OS. From this trusted location outside the OS, DeepSAFE can monitor and protect system resources. Think of DeepSAFE as a new security layer that other security technologies can use to gain an accurate and uncompromised view of the operating system as well as everything running on the system.

McAfee Deep Defender

McAfee Deep Defender integrates with the DeepSAFE technology to get beneath the operating system and do some unique things. First, by tapping into DeepSAFE, Deep Defender gains access to a trusted view of the operating system. This low-level vantage point allows Deep Defender to spot the evasive techniques used by rootkits and enables configurable block or deny actions. Deep Defender can stop a rootkit before it has a chance to embed itself in the OS, kernel, or memory.

So if you think you’ve deployed all the right security tools but haven’t considered rootkit protection then think again.

Tags: Deep Defender, DeepSAFE, Endpoint Protection, intel, Rookits