Detecting rootkits over a storage area network
Embodiments of the invention improve the detection of malicious software applications, such as a rootkit, on hosts configured to access storage volumes over a storage area network (SAN). A rootkit detection program running on a switch may be configured to detect rootkits present on the storage volumes of the SAN. Because the switch may mount and access storage volumes independently from the (possibly comprised) hosts, the rootkit is not able to conceal itself from the rootkit detection program running on the switch.
1. A storage area network (SAN) routing device configured to provide one or more host systems with access to one or more storage volumes present on a storage device, comprising:
a processor;
a storage networking interface configured to manage read and write requests made by the host systems to access the one or more storage volumes, and wherein the SAN routing device provides the one or more host systems with access to the storage volumes such that a mounted storage volume appears to a host system as a storage device physically present on the host system; and
a memory that includes a program, wherein the program is configured to:
mount, by the routing device, one of the storage volumes present on the storage device,
retrieve a manifest specifying a list of files, wherein the list of files specifies a list of known rootkit signatures,
generate a file signature for each of one or more files on the mounted storage volume host system, and
compare each generated file signature with the list of known rootkit signatures to detect the presence of a rootkit active in a memory of one of the host systems.
2. The routing device of claim 1 , wherein the list of files specifies one or more file names, sizes, checksums, or time/date stamps of files that should be present on one of the host systems.
3. The routing device of claim 2 , wherein generating a file signature for each of the one or more files comprises generating a hash value for each of the one or more files, and wherein the list of known rootkit signatures includes a list of hash values associated with known rootkits.
4. The routing device of claim 1 , wherein the program is configured to automatically run at specified periodic intervals.
5. The routing device of claim 1 , wherein the program is further configured to run in response to being invoked by a user.
6. The routing device of claim 1 , wherein the program is further configured to notify a user that presence of a rootkit has been detected on the storage volume.
7. The routing device of claim 1 , wherein at least one of the storage volumes mounted by the routing device is a virtualized storage volume defined for one or more underlying physical storage devices.
8. A method, comprising:
periodically mounting, from a storage area network (SAN) routing device configured to connect a host system to one or more storage volumes present on a storage device, wherein the SAN routing device is configured to manage read and write requests made by the host systems to access the one or more storage volumes and wherein the SAN routing device provides the host system with access to the storage volumes such that a mounted storage volume appears to the host system as a storage device physically present on the host system;
identifying one or more files present on the mounted storage volume;
retrieving a manifest specifying a list of files, wherein the list of files specifies a list of known rootkit signatures;
generating a file signature for each of one or more files on the mounted storage volume host system;
comparing each generated file signature with the list of known rootkit signatures to detect the presence of a rootkit active in a memory of one of the host systems; and
upon detecting a presence of a rootkit in one of the identified files, adding an entry reflecting the presence of the rootkit active in the memory of the host system to a file log.
9. The method of claim 8 , wherein the list of files specifies one or more file names, sizes, checksums, or time/date stamps of files that should be present on the host system.
10. The method of claim 8 , wherein generating a file signature for each of the one or more files comprises generating a hash value for each of the one or more files, and wherein the list of known rootkit signatures includes a list of hash values associated with known rootkits.
11. The method of claim 8 , wherein at least one of the periodically mounted storage volumes is a virtualized storage volume defined for one or more underlying physical storage devices.
12. An apparatus, comprising
a means for connecting one or more host systems to one or more storage volumes present on a storage device such that a mounted storage volume appears to a host system as a storage device physically present on the host system;
a means to manage read and write requests made by the host systems to access the one or more storage volumes;
a means for mounting, from the apparatus, one of the storage volumes present on the storage device;
a file manifest identifying one or more files, wherein the list of files specifies a list of known rootkit signatures;
a means for:
mounting one of the storage volumes present on the storage device,
retrieving the file manifest specifying the list of known rootkit signatures,
generating a file signature for each of one or more files on the mounted storage volume host system, and
comparing each generated file signature with the list of known rootkit signatures to detect the presence of a rootkit active in a memory of one of the host systems.
13. The apparatus of claim 12 , wherein the list of files specifies one or more file names, sizes, checksums, or time/date stamps of files that should be present on the host system.
14. The apparatus of claim 12 , wherein generating a file signature for each of the one or more files comprises generating a hash value for each of the one or more files, and wherein the list of known rootkit signatures includes a list of hash values associated with known rootkit.
15. The apparatus of claim 12 , wherein at least one of the storage volumes mounted by the routing device is a virtualized storage volume defined for one or more underlying physical storage devices.