Detecting user-mode rootkits
A method and system for determining whether resources of a computer system are being hidden is provided. The security system invokes a high-level function of user mode that is intercepted and filtered by the malware to identify resources. The security system also directly invokes a low-level function of kernel mode that is not intercepted and filtered by the malware to identify resources. After invoking the high-level function and the low-level function, the security system compares the identified resources. If the low-level function identified a resource that was not identified by the high-level function, then the security system may consider the resource to be hidden.
1. A method in a computer system with a processor and a memory for determining whether a process being hidden is a root process of malware, a root process being a process of the malware whose access to system resources is not filtered by the malware, the method comprising:
determining whether a process that is executing code is hidden;
after determining that the process is hidden, injecting code into malware code executed by the hidden process, the injected code for determining whether a resource is hidden from a process that is executing the malware code;
after injecting the code,
launching execution of the malware code as a process; and
during execution of the injected code within the launched process, determining whether a resource is hidden from the launched process by generating a lie list and a truth list of resources and determining that no resource is hidden when the generated lie list and truth list are the same; and
upon determining that no resource is hidden from the launched process, marking the hidden process as a root process.
2. The method of claim 1 wherein the resources are processes.
3. The method of claim 1 wherein the resources are registry entries.
4. The method of claim 1 wherein the lie list is generated by invoking a high-level function of an operating system and the truth list is generated by invoking a low-level function of the operating system.
5. The method of claim 1 including upon determining that a resource is hidden from the launched process, indicating that the hidden process is not a root process.
6. The method of claim 1 wherein the determining of whether a process is hidden includes generating a lie list of processes by invoking a high-level operating system function, generating a truth list of processes by invoking a low-level operating system function, and identifying process as being hidden when the process is in the truth list but not in the lie list.
7. The method of claim 1 wherein a hidden process has an associated executable file with a name and after indicating that the hidden process is a root process, renaming another executable file to have the same name as the executable file associated with the hidden process so that malware will not hide resources from a process associated with the renamed executable code.
8. A computer-readable storage device containing computer-executable instructions for controlling a computing device to identify a root process of malware without rebooting the computing device by a method comprising:
determining whether a process is hidden;
after determining that a process is hidden,
injecting code into code of the hidden process, the injected code for collecting information to determine whether a resource is hidden when the code executes as a process;
launching execution of the code of the hidden process with the injected code; and
during execution of the injected code, collecting information to determine whether a resource is hidden from the injected code by generating a lie list and a truth list of resources and determining that no resource is hidden when the generated lie list and truth list are the same; and
after determining based on the collected information that no resource is hidden from the injected code, indicating that the hidden process is a root process so that a root process can be identified without having to reboot the computing device.
9. The computer-readable storage device of claim 8 wherein the lie list is generated by invoking a high-level function of an operating system and the truth list is generated by invoking a low-level function of the operating system.
10. The computer-readable storage device of claim 8 including after determining that a resource is hidden from the injected code, indicating that the hidden process is not a root process.
11. The computer-readable storage device of claim 8 where the determining of whether a process is hidden includes generating a lie list of processes by invoking a high-level operating system function, generating a truth list of processes by invoking a low-level operating system function, and identifying process as being hidden when the process is in the truth list but not in the lie list.
12. The computer-readable storage device of claim 8 wherein a hidden process has an associated executable file with a name and after indicating that the hidden process is a root process, renaming another executable file to have the same name as the executable file associated with the hidden process so that malware will not hide resources from a process associated with the renamed executable code.
13. A computing device for identifying a root process of malware comprising:
a memory storing an identification of a process that is hidden and storing computer-executable instructions of
a component that after the process is identified as a hidden process, injects code into code of the process;
a component that launches a hidden process to execute the code along with the injected code; and
a component that, during execution of the injected code of the hidden process, collects information to determine whether a resource is hidden from the hidden process, the collected information including a lie list and a truth list of resources wherein no resource is hidden when the lie list and truth list are the same; and
a component that, after determining based on the collected information that no resource is hidden from the hidden process, marks that the hidden process is a root process; and
a processor for executing the computer-executable instructions stored in the memory.
14. The computing device of claim 13 wherein the lie list is generated by invoking a high-level function of an operating system and the truth list is generated by invoking a low-level function of the operating system.
15. The computing device of claim 13 including a component that, after determining that a resource is hidden from the hidden process, indicates that the hidden process is not a root process.
16. The computing device of claim 13 wherein including a component that determines whether a process is hidden by generating a lie list of processes by invoking a high-level operating system function, generates a truth list of processes by invoking a low-level operating system function, and identifies a process as being hidden when the process is in the truth list but not in the lie list.
17. The computing device of claim 13 wherein a hidden process has an associated executable file with a name and a component that, after indicating that the hidden process is a root process, renames another executable file to have the same name as the executable file associated with the hidden process so that malware will not hide resources from a process associated with the renamed executable code.