How to Use Trend Micro's Rootkit Remover to Install a Rootkit

https://d4stiny.github.io/How-to-use-Trend-Micro-Rootkit-Remover-to-Install-a-Rootkit/

by MikusR • 6 years ago

170 15 6 years ago

d4stiny.github.io

MikusR• 6 years ago

The main thing is that Trend Micro is basically doing the same thing volkswagen did. Cheating in tests to get certified.

codezero• 6 years ago

In this case, the regulatory board is Microsoft, and there’s nothing telling us (yet) that there isn’t a partnership in which they gave them certification knowing about some of their dirty tricks.

guardiangod• 6 years ago

the Bruteforcing Processes code doesn’t make sense, are Trend Micro developers not aware of enumerating processes via ZwQuerySystemInformation?

As someone whose work involves screwing around with Windows' internal, whenever I see codes like this, I immediately think that the developer doesn't trust Windows' API. I guess that Trend Micro believes there's a chance that ZwQuerySystemInformation has been hooked by a malicious process and its data is unreliable, and they would rather retrieve the information themselves by scanning the memory manually.

jeffmcjunkin• 6 years ago

Exactly this. Much like the Volatility Framework's psscan[1] module.

[1] https://github.com/volatilityfoundation/volatility/wiki/Comm...

dmitrygr• 6 years ago

It is a tool to detect rootkits

A good rootkit would certainly exclude itself from the info returned by ZwQuerySystemInformation

anotherepisode• 6 years ago

That's exactly the reason.

GordonS• 6 years ago

Cheating in a driver qualification test is not a good look.

Surely Trend Micro should be penalised in some way by Microsoft?

Stierlitz• 6 years ago

“Most of the driver feels like proof-of-concept garbage that is held together by duck tape.”

Oouch!

ngcc_hk• 6 years ago

Seems the installation still going without one agreeing to the license is very odd

Semaphor• 6 years ago

Maybe they thought that, as it’s essentially unenforceable in EU anyway, they might as well not bother? ;)

justinclift2• 6 years ago

It's probably just them forgetting some to add a test for the scenario of "user doesn't accept agreement". :/

The comment about the end, about the code looking like Proof of Concept garbage would be in line with that. ;)

yborg• 6 years ago

So Trend Micro cheats to get Microsoft certified, and my employer then uses Trend Micro virus scanning to get certified for HITRUST. It's turtles all the way down.

maxmalysh• 6 years ago

It always amazes me how using Windows never feels safe. It is literally a sieve in terms of security.

justinclift2• 6 years ago

In the early screenshot where it shows the directory listing for "%TEMP%\RootKitBuster", three entries jump out (to me) as immediately interesting:

  * sqlite3.dll
  * scan_db.sql
  * DB <-- a folder name

That scan_db.sql is likely full of SQL statements.

And SQLite can have user defined C functions added.

Depending on when those SQL statements are run (just for initial DB creation? during every run? etc), it could be a cheap and easy way to get your code running in a high privilege context. :)

fomine3• 6 years ago

TrendMicro does too many BS things in Japan. Many devs getting recognizing it but still their products are adopted many places.

How to Use Trend Micro's Rootkit Remover to Install a Rootkit

Related Stories