Tool Release: ProcL - Detect Hidden Process
Pallav Khandhar <[email protected]> Fri, 1 Aug 2008 12:30:38 +0530
| Newsgroups | gmane.comp.security.full-disclosure,gmane.comp.security.bugtraq,gmane.comp.security.basics,gmane.comp.security.penetration,gmane.comp.security.vulnerabilities |
|---|---|
| Message-ID | <[email protected]> |
--===============0251994624== Content-Type: multipart/alternative; boundary=Apple-Mail-4-896153950 --Apple-Mail-4-896153950 Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Greetings, I am glad to release ProcL v1.0. ProcL employs many different methods to detect hidden processes. Essentially, ProcL detailed and implemented a mechanism to embed all these different approaches in one tool to detect hidden processes. Our methods of detecting hidden processes requires the examination of each kernel object - EPROCESS, ETHREADS, HANDLES, JOBS. Therefore, we believe, ProcL would defeat process concealment from one certain method. Hiding a process is particularly threatening because it represents some malicious code running on your system that you are completely unaware of. Process hiding has a significant effect. Many of the trojan, virus, spyware, rootkit writers use similar techniques to hide themselves and stay undetected as long as possible on target machines. Finding all the ways a rootkit might hide a process is just the first step in defending against the rootkits. Detecting hidden objects is a promising new area in rootkit detection. For more information on the tool http://www.scanit.net/rd/tools/03 Download the tool http://www.scanit.net/files/tools/ProcL.zip Cheers, Pallav Khandhar Sr. Security Researcher Scanit R&D Lab --Apple-Mail-4-896153950 Content-Type: text/html; charset=US-ASCII Content-Transfer-Encoding: quoted-printable <html><body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; = -webkit-line-break: after-white-space; "><font class=3D"Apple-style-span" = size=3D"3"><span class=3D"Apple-style-span" style=3D"font-size: = 11px;">Greetings,</span></font><div><font class=3D"Apple-style-span" = size=3D"3"><span class=3D"Apple-style-span" style=3D"font-size: = 11px;"><br></span></font></div><div><font class=3D"Apple-style-span" = size=3D"3"><span class=3D"Apple-style-span" style=3D"font-size: 11px;">I = am glad to release ProcL v1.0. </span></font><span = class=3D"Apple-style-span" style=3D"font-family: Verdana; "><font = class=3D"Apple-style-span" size=3D"3"><span class=3D"Apple-style-span" = style=3D"font-size: 11px;"> ProcL employs many different methods to = detect hidden processes. Essentially, ProcL detailed and = implemented a mechanism to embed all these different approaches in one = tool to detect hidden processes. Our methods of detecting hidden = processes requires the examination of each kernel object = - EPROCESS, ETHREADS, HANDLES, JOBS. Therefore, we believe, = ProcL would defeat process concealment from one certain = method.</span></font></span></div><div><font class=3D"Apple-style-span" = face=3D"Verdana"><font class=3D"Apple-style-span" size=3D"3"><span = class=3D"Apple-style-span" style=3D"font-size: = 11px;"><br></span></font></font></div><div><font = class=3D"Apple-style-span" face=3D"Verdana"><div style=3D"margin-top: = 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: = normal normal normal 8.5px/normal Verdana; "><font = class=3D"Apple-style-span" size=3D"3"><span class=3D"Apple-style-span" = style=3D"font-size: 11px;">Hiding a process is particularly threatening = because it represents some malicious code running on your system = that you are completely unaware of. Process hiding has a significant = effect. Many of the trojan, virus, spyware, rootkit writers use = similar techniques to hide themselves and stay undetected as = long as possible on target machines. Finding all the ways a rootkit = might hide a process is just the first step in defending against = the rootkits. Detecting hidden objects is a promising new area in = rootkit detection.</span></font></div></font></div><div><font = class=3D"Apple-style-span" face=3D"Verdana"><font = class=3D"Apple-style-span" size=3D"3"><span class=3D"Apple-style-span" = style=3D"font-size: 11px;"><br></span></font></font></div><div><font = class=3D"Apple-style-span" face=3D"Verdana"><font = class=3D"Apple-style-span" size=3D"3"><span class=3D"Apple-style-span" = style=3D"font-size: 11px;">For more information on the = tool</span></font></font></div><div><font class=3D"Apple-style-span" = face=3D"Verdana"><font class=3D"Apple-style-span" size=3D"3"><span = class=3D"Apple-style-span" style=3D"font-size: 11px;"><a = href=3D"http://www.scanit.net/rd/tools/03">http://www.scanit.net/rd/tools/= 03</a></span></font></font></div><div><font class=3D"Apple-style-span" = face=3D"Verdana"><font class=3D"Apple-style-span" size=3D"3"><span = class=3D"Apple-style-span" style=3D"font-size: = 11px;"><br></span></font></font></div><div><font = class=3D"Apple-style-span" face=3D"Verdana"><font = class=3D"Apple-style-span" size=3D"3"><span class=3D"Apple-style-span" = style=3D"font-size: 11px;">Download the = tool</span></font></font></div><div><font class=3D"Apple-style-span" = face=3D"Verdana"><font class=3D"Apple-style-span" size=3D"3"><span = class=3D"Apple-style-span" style=3D"font-size: 11px;"><a = href=3D"http://www.scanit.net/files/tools/ProcL.zip">http://www.scanit.net= /files/tools/ProcL.zip</a></span></font></font></div><div><font = class=3D"Apple-style-span" size=3D"3"><span class=3D"Apple-style-span" = style=3D"font-size: 11px;"><br></span></font></div><div><font = class=3D"Apple-style-span" size=3D"3"><span class=3D"Apple-style-span" = style=3D"font-size: 11px;">Cheers,</span></font></div><div><font = class=3D"Apple-style-span" size=3D"3"><span class=3D"Apple-style-span" = style=3D"font-size: 11px;">Pallav Khandhar</span></font></div><div><font = class=3D"Apple-style-span" size=3D"3"><span class=3D"Apple-style-span" = style=3D"font-size: 11px;">Sr. Security = Researcher</span></font></div><div><font class=3D"Apple-style-span" = size=3D"3"><span class=3D"Apple-style-span" style=3D"font-size: = 11px;">Scanit R&D Lab</span></font></div></body></html>= --Apple-Mail-4-896153950-- --===============0251994624== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ --===============0251994624==--