Security Watch | Matt Hines » Rootkits taking hold

December 12, 2007 | Comments: (0)

Rootkits taking hold

TAGS: Security

Malware infections -- in particular insidious rootkit attacks -- continue to proliferate at a rapid pace, according to new figures released by security vendor Prevx.

Based on the latest results attained from over 725,000 endpoint systems tested using the company's Prevx CSI automated malware scanner, some 14 percent of the business-owned PCs involved had been exploited by one type of rootkit or another, the company said.

Rootkits -- which are loosely defined as sets of tools that give administrator-level access to a computer or network and often hide themselves as close to a machine's OS kernel as possible to evade detection -- are considered by many security experts as one of the most stealthy methods for infecting computers today, and are thus considered to be very dangerous.

[ For an in-depth look at rootkits in the enterprise, see "Rootkits: The next big enterprise threat?" ]

Overall, Prevx reported that the percentage of machines that it found to be loaded with some form of malware rose from 15 percent to 22 percent since late October, largely driven by the flood of new rootkit infections.

As reported by Prevx: "Rootkits are a major concern because while a user believes his or her computer is 'clean' from infection, he or she is exposing more and more information to criminals who can use this type of malware to gather personal information across the Web."

While rootkits are nothing new and have been in regular circulation for years, Prevx officials maintain that the "rise of rootkits" has begun as attackers have shifted their focus to the threats that attempt to evade detection at the hands of traditional anti-malware applications.

Even though most businesses are using commercial anti-virus tools, rootkits are still finding a way in the door, said officials with the scanning specialists.

"Many PCs may be infected even though users and businesses have up-to-date anti-virus and anti-spyware products," Mel Morris, Prevx' CEO, said in a research note.

"Users often don't realize something is amiss until they run a full anti-virus scan of their PCs with updated signatures. Even then, rootkits will often go undetected," he said. "Part of the problem is that anti-virus scans simply take too long and users just can't be bothered to wait."

Unsurprisingly, Prevx' technology promises to allow for less cumbersome malware scans.

Among the 1,678 rootkit-infected PCs scanned by Prevx since Oct. 22, the most prevalent attacks included NDT2.SYS (found on 121 machines), SROSA.SYS (90), UNPR.SYS (82), FMTR.SYS (82), and INDT2.SYS (78).

The company said that in the first 9 days of Dec., 93 individual companies used its malware scanning technology, with 68 of those organizations having one or more infected PCs, and 13 companies, or 14 percent, with one or more rootkit infections.

A free version of the company's CSI scanning application can be accessed here.

Posted by Matt Hines on December 12, 2007 01:16 PM

RATE THIS ARTICLE: