System and method for bypassing a malware infected driver
Aspects of the present disclosure relate to setting up an alternate communication path to a device, resource, file, etc., in order to avoid a potentially infected driver. New drivers may be established as part of the alternate communications path, thereby providing access to a device, resource, etc. using drivers that are known to be clean or, in other words, not infected by a rootkit. In doing so, a rootkit hunter, e.g., antivirus software, antimalware software, etc., may access an infected device, resource, etc. without alerting a rootkit, thereby avoiding activation of the rootkit's defensive mechanisms. In one aspect, an I/O request may be serviced by using the new communications path bypassing any potentially infected drivers while another request may be serviced using a previously established communications path. The responses (e.g., data returned, action performed, etc.) of the requests may then be compared.
1. A method comprising:
determining a lowest level driver in a driver chain, wherein the driver chain comprises one or more drivers for communicating with a device;
locating a trusted copy of the lowest level driver, wherein the trusted copy is not infected by a rootkit;
establishing an alternate communication path to the device, wherein the alternate communication path includes the trusted copy of the lowest level driver;
submitting a first request via the alternate communication path;
receiving a first response to the first request via the alternate communication path; and
based upon the first response, determining that the driver chain is infected with a rootkit.
2. The method of claim 1 , further comprising submitting a second request via a previously established communication path, wherein the previously established communication path comprises the driver chain.
3. The method of claim 2 , further comprising receiving a second response to the second request via the previously established communication path.
4. The method of claim 3 , wherein determining that the driver chain is infected with a rootkit comprises comparing the first response to the second response.
5. The method of claim 4 , further comprising upon identifying a discrepancy between the first response and the second response, performing a countermeasure.
6. The method of claim 5 , wherein the countermeasure comprises at least one of:
redirecting requests to the alternate communication path; and
deleting the rootkit.
7. The method of claim 5 , wherein the countermeasure comprises overwriting a memory location with data from the second response.
8. The method of claim 1 , wherein the first request is an input/output (I/O) request.
9. A non-transitory computer storage medium encoding computer executable instructions that, when executed by at least one processor, perform a method comprising:
determining a lowest level driver in a driver chain, wherein the driver chain comprises one or more drivers for communicating with a device;
establishing an alternate communication path to the device, wherein the alternate communication path includes a trusted copy of the lowest level driver, wherein the trusted copy is not infected by a rootkit;
submitting a first input/output (I/O) request via the alternate communication path;
receiving a first response to the first I/O request via the alternate communication path; and
based upon the first response, determining that the driver chain is infected with a rootkit.
10. The non-transitory computer storage medium of claim 9 , wherein establishing the alternate communication path further comprises:
identifying one or more additional drivers in the driver chain;
locating one or more trusted copies of the one or more additional drivers; and
loading the one or more trusted copies of the one or more additional drivers.
11. The non-transitory computer storage medium of claim 9 , wherein the trusted copy of the lowest level driver is loaded in secure memory.
12. The non-transitory computer storage medium of claim 11 , wherein the secure memory is not accessible by the rootkit.
13. The non-transitory computer storage medium of claim 9 , wherein the method further comprises:
sending a second request via a previously established communication path, wherein the previously established communication path comprises the driver chain; and
receiving a second response to the second request via the previously established communication path.
14. The non-transitory computer storage medium of claim 13 , wherein determining that the driver chain is infected with a rootkit comprises comparing the first response to the second response.
15. The non-transitory computer storage medium of claim 14 , wherein the method further comprises:
identifying a discrepancy between the first response and the second response; and
upon identifying the discrepancy, performing a countermeasure.
16. The non-transitory computer storage medium of claim 15 , wherein the countermeasure comprises at least one of:
redirecting requests to the alternate communication path; and
deleting the rootkit.
17. The non-transitory computer storage medium of claim 15 , wherein the countermeasure comprises overwriting a memory location with data from the second response.
18. A system comprising:
at least one processor; and
memory encoding computer executable instructions that, when executed by the at least one processor, perform a method comprising:
determining a lowest level driver in a driver chain, wherein the driver chain comprises one or more drivers for communicating with a device;
establishing an alternate communication path to the device, wherein the alternate communication path includes a trusted copy of the lowest level driver, wherein the trusted copy is not infected by a rootkit;
submitting a first input/output (I/O) request via the alternate communication path;
receiving a first response to the first I/O request via the alternate communication path;
sending a second I/O request via a previously established communication path, wherein the previously established communication path comprises the driver chain;
receiving a second response to the second I/O request via the previously established communication path;
identifying a discrepancy between the first response and the second response; and
upon identifying the discrepancy, performing a countermeasure.
19. The system of claim 18 , wherein the countermeasure comprises at least one of:
redirecting requests to the alternate communication path; and
deleting the rootkit.
20. The system of claim 18 , wherein the countermeasure comprises overwriting a memory location with data from the second response.