Must Read: Mint 15: Today's best Linux desktop (Review)

Topic: Windows

Hackers "fix" XP BSoD rootkit

Summary: An update released by Microsoft this month (MS10-015) broke XP machines that were infected with the TDL3 rootkit (also known as TDSS and Tidserv and many other names).

Adrian Kingsley-Hughes

By for Hardware 2.0 |

An update released by Microsoft this month (MS10-015) broke XP machines that were infected with the TDL3 rootkit (also known as TDSS and Tidserv and many other names - more info here).

Well, a rootkit that causes crashes is bad for business, so the hackers had an update out in the matter of hours.

On last Tuesday Microsoft released a number of Windows updates, some of them critical because they fixed a 17 years old bug. After some users updated their Windows operating systems, they got a scaring and really annoying blue screen of death.

Most of those users were angry with Microsoft, but the problem this time is not related to Microsoft. Indeed a number of the users affected by this BSOD was infected by TDL3/TDSS rootkit.

More exactly, TDL3 rootkit looks incompatible with MS10-015 update. This is the cause of the BSOD. Problem resides in the lazyness of rootkit writers when writing the driver infection routine.

...

Good news is that TDL3 authors care about us and they released in a couple hours a new updated version of the rootkit compatible with the Microsoft patch.

It's one big cat and mouse game between the good guys and the bad guys.

Topics: Windows, Microsoft, Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

327 comments
Log in or register to join the discussion

  • What exactly does this rootkit do?

    I'd really like to know. Anyway, this is just another reason to GET OFF WINDOWS XP and move to Vista or 7..... these issues disappear on a SECURELY WRITTEN OS, which Windows 7 and Vista are.
    Lerianis10
    Reply Vote

    • More info on rootkit

      http://forum.sysinternals.com/forum_posts.asp?TID=21266
      Adrian Kingsley-Hughes
      Reply Vote

      • I don't..

        ..see "give people BSODs" in the feature list, so
        how can MS blame them on anyone but themselves? If
        they're going to wait until something is actively
        being used to take over systems before fixing it,
        they need to make sure their fix either removes
        the crap or at least doesn't bring the whole
        computer down with it. Is that really too much to
        ask from a company that grosses billions a year?
        AzuMao
        Reply Vote

        • Are you really that stupid?

          The BSOD is probably caused by Microsoft fixing the bug that the rootkit authors used to install and infect the computers. Fix the bug, the rootkit won't work any more, the computer has trouble booting because the rootkit won't work. See the chain there?

          It's NOT their responsibility to fix a problem they didn't cause before patching a bug, it's the user's responsibility to not get infected in the first place. Don't get infected and it won't BSOD with the bug fix.
          BrewmanNH
          Reply Vote

          • Are YOU really that clueless?

            First, it seems that the rootkit authors fixed the problem to keep the systems running, for their own reasons. They don't want your system to break, because it reveals their presence. If you'd paid attention to the article (even the title, no less!), you'd get that.

            And while I agree that it isn't automatically Microsoft's responsibility to fix a problem they didn't create, it's may be one they did create. Especially if it's the 17 year old bug mentioned that caused this.

            It isn't so easy to avoid rootkits as you imply. If you think it is, you need to educate yourself about them before you become another victim (if you aren't already).

            Rootkits, by their very nature, are difficult to detect. Sure, this one caused the computers to BSOD, but the whole point of them is to sit in the background and not be noticed. Even with a combination of the best-of-breed security software and good practices, you can still get hit.

            So stop looking at it as an either-or situation. There's more than enough blame to go around.
            mdsock@...
            Reply Vote

          • It's very easy.

            Simply use an OS where security is taken seriously, and the chances are instantly reduced by several orders of magnitude, if not eliminated entirely.
            AzuMao
            Reply Vote

          • Yes.....

            ...such as Vista/7.
            Lester Young
            Reply Vote

          • If by "such as" you mean "as opposed to".

            [b] [/b]
            AzuMao
            Reply Vote

          • No, I mean such as.

            http://talkback.zdnet.com/5208-12554-0.html?forumID=1&threadID=75321&messageID=1464942&tag=content;col1

            Read 'em and weep.
            Lester Young
            Reply Vote

          • @Lester Young

            I read 'em. Did you? They conclude that Linux is more secure than Windows.
            And that OSX leaves out parts of ASLR that programs can do themselves
            without help from the OS, such as moving themselves to another address at
            startup.


            What was your point again?
            AzuMao
            Reply Vote

          • Read what, and weep?

            [i]Windows Vista/7 is more than caught up with Linux/Mac security.[/i]

            The fact that Linux wasn't even tested at CanSecWest is your first [b]EPIC FAIL[/b] right there...

            Your link http://www.scribd.com/doc/13450744/Dino-Dai-Zovi-Mac-OS-Xploitation looks like a link to a Russian hacker's website. Not a reputable place and I'd prolly run a malware scan after visiting it if I were running Winbloze.

            ~

            I seriously doubt we're all gonna run out and by a copy of Vista bloatware at this stage of the game. You're too little, too late, fanbui.
            Wintel_BSOD
            Reply Vote

          • @Wintel_BSOD That's mean!

            To the Russians.

            They helped so much with killing the Nazis.

            Why hate on Russians??
            AzuMao
            Reply Vote

          • Not as clueless as you

            I got it that they fixed it to keep the rootkit working, how did what I wrote make you think I didn't understand that?

            It's very easy to avoid rootkits. Don't go to sketchy sites, don't open email attachments you don't know about, avoid pirated software. Use a good AV software, not Norton's or McAfee. Seems simple to me.
            BrewmanNH
            Reply Vote

          • Did you read what I wrote before replying to it?

            I'm going to give you the benefit of the doubt instead of assuming that you're playing stupid to troll me, and humor you with a response.

            Since Microsoft refused to fix the problem before it was taken advantage of, a bunch of computers got taken over by this rootkit, and Microsoft should have taken this situation
            into consideration, by.. here it comes.. doing what I said they should have done, in the post you just replied to; "make sure their fix either removes
            the crap or at least doesn't bring the whole
            computer down with it"!
            AzuMao
            Reply Vote

          • Did Microsoft Know about the RootKit?

            Micrsoft often leaves off patching securit problems until a 'zero-day' exploit is out, so it's entirely possible that the patch was in response to these root kits.

            If Microsoft knew about these root kits when they came out with the patch, then they should have tested the result and designed things so that the patch -- even with the root kits installed -- wouldn't blue-screen your system.

            Either that, or they should have issued some sort of caution about a problem that [b]they were aware of[/b]. So that customers wouldn't get blind-sided.

            It's easy to say that customers shouldn't get root-kits installed on their machines.
            It's just as easy to say that MS should have solved the poblem before it was exploited.

            In this case, however, people are just saying that they would like to have been informed about a [b]KNOWN PROBLEM[/b]. I don't see that as being unreasonable given that Microsoft would have been the only people with knowledge of the problem at that point of time.
            darkonc
            Reply Vote

        • I don't...

          ... see how its is Microsoft's prpblem to be an antivirus author when there are many other Anti-virus programs out there, eg AVG, Norton, Avast... the list goes on.

          In this instance, it is the user's fault for not properly securing their pc.
          Yugatha
          Reply Vote

          • I don't...

            ...see how it is the user's fault, when Microsoft left the hole in for 17 years (during which time [i]there was no patch available for the user to apply[/i]). I do, however, see
            how it is Microsoft's fault for finally giving a patch after the vulnerability has been used to infect people's computers, that BSODs them! Do you know what a rootkit is? It
            operated within the kernel itself, meaning it can fully control everything, including AVs. Most rootkits nowadays either disable the most common AVs entirely or at least render
            themselves invisible to them.

            It is Microsoft's responsibility to make sure that their patches do not render their customers' systems inoperable. If that means including something in the patch to remove or at
            least work around the infection that happened as a result of them taking so long to provide a patch, tough sh[i][/i]it. Millions/billions of people are paying these clowns
            hundreds of dollars each, the least they can do is not hose their systems!
            AzuMao
            Reply Vote

          • The patch.....

            ....was not for the vulnerability exploited by the rootkit. The patch was for a privilege escalation vulnerability from the DOS emulator, which required physical access to the machine. Physical access vulnerabilities are pretty far down the list as far as vulnerabilities go, since if an attacker has physical/logon access there are much greater security issues. But the upshot is, all of your hoo-hah about Microsoft needing to correct the rootkit before patching an unrelated vulnerability is just so much nonsense.
            Lester Young
            Reply Vote

          • If that was the case..

            ..there wouldn't be BSODs.


            There would be rootkits unable to get the necessary privileges to install themselves (and thus unable to cause a BSOD) after the patch was applied, and there would be rootkits
            already embedded in the kernel and thus no longer needing to use an exploit to escalate and thus unaffected by the patch and thus wouldn't suddenly stop BSODing.


            So that's obviously [i]not[/i] the case. Try again.
            AzuMao
            Reply Vote

          • Wrong again.

            The patched vulnerability was from the DOS mode. The rootkit had nothing to do with DOS mode, it affected ATAPI.SYS. If you can't see the difference, you are hopeless.
            Lester Young
            Reply Vote
CNET Join | Log In | Privacy | Cookies Close