System, method and computer program product for remote rootkit detection
View Patent ↗A security system may detect a rootkit by detecting a filesystem configuration of the first system and comparing the filesystem configuration to a known valid filesystem configuration of a second system. The known valid filesystem configuration may be the filesystem configuration of a protected second system, or may be stored in a protected area of the second system. The first and second system may be part of a single device. The filesystem configuration of the first system and the known valid filesystem configuration are compared and differences are analyzed to determine if they are indicative of a rootkit. If a rootkit is detected, some embodiments may provide tools to clean, delete, or quarantine the rootkit. The second system may be provided by a security provider.
1. A method, comprising:
identifying a file system configuration of a first computer system and a second computer system, comprising:
receiving a request to inspect the second computer system by the first computer system;
identifying a first configuration of a file system of the second computer system using resources of the first computer system;
initiating a remote session on the second computer system from the first computer system; and
identifying a second configuration of the file system of the second computer system using resources of the second computer system;
detecting a rootkit on the second computer system, comprising;
comparing the first configuration and the second configuration; and
performing an action with respect to the detected rootkit in response to a predefined policy,
wherein the first computer system is a write-protected system.
2. The method of claim 1 , wherein the file system is a virtual file system.
3. The method of claim 1 , wherein the file system is a network file system.
4. The method of claim 1 , wherein the act of initiating a remote session on the second computer system from the first computer system utilizes a network coupled between the first system and the second system.
5. The method of claim 1 , wherein the act of identifying a first configuration of a file system of the second computer system is performed upon receiving the request to inspect at the first system.
6. The method of claim 1 , wherein the act of comparing the first configuration and the second configuration comprises:
generating a first table from the first configuration;
generating a second table from the second configuration; and
comparing the first table and the second table.
7. The method of claim 1 , wherein the second configuration identifies at least one of directories, files, processes, registry entries, and applications associated with the second system.
8. The method of claim 6 , wherein the first table and the second table are each in a form of a list.
9. The method of claim 6 ,
wherein the act of generating a first table from the first configuration is performed by the first computer system, wherein the act of generating a second table from the second configuration is performed by the second computer,
further comprising: sending the second table to a secure area of the first computer system by the second computer system.
10. The method of claim 1 , wherein the resources of the second computer system include software installed on the second computer system.
11. The method of claim 1 , wherein the act of receiving a request to inspect the second computer system by the first computer system comprises:
receiving a request to inspect the second computer system from an administrator located remotely from the first system.
12. A non-transitory computer readable medium on which is stored a computer program product, comprising:
computer code for identifying a file system configuration, comprising
computer code for receiving a request to inspect a second computer system by a first computer system;
computer code for identifying a first configuration of a file system of the second computer system using resources of the first computer system;
computer code for initiating a remote session on the second computer system from the first computer system; and
computer code for identifying a second configuration of the file system of the second computer system using resources of the second computer system;
computer code for detecting a rootkit on the second computer system, comprising;
comparing the first configuration and the second configuration,
computer code for performing an action with respect to the detected rootkit in response to a predefined policy,
wherein the first computer system is a write-protected system.
13. A system, comprising:
a first computer, comprising:
a first processor;
a second computer in communication with the first computer, comprising
a second processor; and
a file system, coupled to the second processor; and
a first software, comprising instructions that when executed cause the first processor to performs actions comprising:
receiving a request to inspect the second computer by the first computer;
identifying a first configuration of the file system using resources of the first computer;
initiating a remote session on the second computer from the first computer; and
identifying a second configuration of the file system using resources of the second computer;
detecting a rootkit on the second computer by comparing the first configuration and the second configuration; and
performing an action with respect to the detected rootkit in response to a predefined policy,
wherein the first computer is write-protected.
14. The system of claim 13 , wherein the file system is a virtual file system.
15. The system of claim 13 , wherein the action of comparing the first configuration and the second configuration comprises:
generating a first table from the first configuration;
generating a second table from the second configuration; and
comparing the first table and the second table.
16. The system of claim 13 , wherein the second configuration identifies at least one of directories, files, processes, registry entries, and applications associated with the second computer.