A notorious rootkit that for years has ravaged 32-bit versions of Windows has begun claiming 64-bit versions of the Microsoft operating system as well. The ability of TDL, aka Alureon, to infect 64-bit versions of Windows 7 is something of a coup for its creators, because Microsoft endowed the OS with enhanced security safeguards that were intended to block such attacks.
According to research published on Monday by GFI Software, the latest TDL4 installation penetrates 64-bit versions of Windows by bypassing the OS's kernel mode code signing policy, which is designed to allow drivers to be installed only when they have been digitally signed by a trusted source.
The rootkit achieves this feat by attaching itself to the master boot record in a hard drive's bowels and changing the machine's boot options. According to researchers at Prevx, TDL is the most advanced rootkit ever seen in the wild. It is used as a backdoor to install and update keyloggers and other types of malware on infected machines.
Once installed it is undetectable by most antimalware programs. [Date: 16 November 2010; Source: http://www.theregister.co.uk/2010/11/16/tdl_rootkit_does_64_bit_windows/]
No comments:
Post a Comment