Rootkit detection system and method
A rootkit detection method includes obtaining, from a target system, first data comprising raw data stored in a data block of a storage drive, checking the first data for known malware, and generating a first alert if known malware is detected. The drive may include a public key, the first data may include a digital signature based on the key, and checking the first data may include validating the signature. The method may be performed by a system management resource that sends a management request for a particular data block. Second data, corresponding to an operating system access of the particular data block, may be obtained and compared to the first data. Responsive to detecting a discrepancy, generating a second alert. The system management resource may be a cloud based server, a premise installed appliance, premise installed security server, or a management controller of the target system.
1. A rootkit detection method comprising:
obtaining, from a storage subsystem of a target information handling system, first data comprising raw data stored in a particular data block of a storage drive within the storage subsystem, wherein obtaining the first data includes sending, by a system management resource, a management request for the particular data block;
checking the first data for known malware; and
responsive to detecting known malware in the first data, generating a malware alert;
obtaining host configuration information from the target information handling system, wherein the host configuration information includes storage configuration information indicating storage controllers and storage drives associated with the target information handling system;
comparing a current storage configuration of the target information handling system to a previous storage configuration and, responsive to detecting a discrepancy, generating a storage configuration alert.
2. The method of claim 1 , wherein the storage drive includes a public-key certificate, signed by a trusted authority, indicative of a unique identifier of the storage drive and wherein the first data includes a digital signature in accordance with the raw data and the public-key certificate and wherein checking the first data includes verifying the digital signature.
3. The method of claim 1 , further comprising:
obtaining second data comprising data corresponding to an operating system access of the particular data block;
comparing the first data to the second data, and
responsive to detecting a discrepancy, generating a second alert.
4. The method of claim 1 , wherein the system management resource comprises a rootkit detection system implemented as a system selected from:
a cloud based server;
a premise installed appliance;
a premise installed security server; and
a management controller of the target information handling system.
5. The method of claim 1 , wherein the target information handling system includes a secure storage drive coupled to a managed host and wherein the managed host is configured to respond to the management request by returning raw data stored in the particular data block.
6. The method of claim 5 , wherein the raw data comprises encrypted raw data and wherein the method includes:
requesting a decryption key from the target information handling system; and
responsive to receiving the decryption key, decrypting the encrypted raw data to obtain decrypted data, wherein checking the first data comprises scanning the decrypted data.
7. The method of claim 1 , wherein the raw data comprises one or more files necessary to load an operating system hosted by a file system.
8. The method of claim 7 , wherein checking the first data comprises comparing each of the one or more files necessary to load the operating system against at least one of:
an expected value; and
a verified digital signature.
9. The method of claim 7 , further comprising:
emulating at least a portion of a boot process;
identifying accessed files comprising files accessed during the portion of the boot process; and
checking the accessed files for known malware.
10. The method of claim 9 , wherein emulating at least a portion of the boot process comprises emulating the boot process for a particular interval following an initiation of system boot and wherein the accessed files comprises files accessed by the boot process within the particular interval.
11. The method of claim 7 , wherein the target information handling system comprises:
a file system hosting a hypervisor; and
nested file systems comprising data files representing storage of guest operating systems and wherein the raw data comprises files necessary to load the guest operating systems.
12. A rootkit detection method comprising:
obtaining, from a storage subsystem of a target information handling system, first data comprising raw data stored in a data block of a storage drive within the storage subsystem, wherein the target information handling system comprises a managed host system configured to respond to a management request for host configuration information by returning configuration lists indicating storage controllers and storage drives associated with the target information handling system;
checking the first data for known malware;
responsive to detecting known malware in the first data, generating a malware alert;
sending a management request for current host configuration information for the target information handling system; and
comparing a current storage configuration of the target information handling system to a previous storage configuration and, responsive to detecting a discrepancy, generating a storage configuration alert.
13. The method of claim 12 , further comprising:
obtaining from the storage subsystem of the target information handling system, unallocated data comprising raw data stored in an unallocated data block of the storage drive within the storage subsystem;
scanning the unallocated data for known malware; and
responsive to detecting known malware in the unallocated data, generating a unallocated access alert.
14. The method of claim 12 , wherein the target information handling system is further configured to respond to management requests for a block of system RAM by returning digitally signed data corresponding to raw data in the block of system RAM.
15. The method of claim 12 , wherein comparing the current storage configuration information includes:
retrieving as-built configuration information, indicative of an original configuration of the storage controllers and storage drives attached to the target information handling system; and
comparing the as-built configuration information to the current configuration information.
16. The method of claim 12 , wherein the target information handling system is further configured to respond to management requests for host information by returning configuration lists indicating at least one of: hypervisors and operating systems of the target information handling system.
17. The method of claim 12 , wherein the storage drive includes a public-key certificate, signed by a trusted authority, indicative of a unique identifier of the storage drive and wherein the first data includes a digital signature in accordance with the raw data and the public-key certificate and wherein checking the first data includes verifying the digital signature.
18. The method of claim 12 , wherein the target information handling system is further configured to respond to management requests for a block of system RAM by returning digitally signed data corresponding to raw data in the block of system RAM.
19. The method of claim 12 , further comprising:
obtaining, from the storage subsystem of the target information handling system, unallocated data comprising raw data stored in an unallocated data block of the storage drive within the storage subsystem;
scanning the unallocated data for known malware; and
responsive to detecting known malware in the unallocated data, generating a fourth alert.