Microsoft GhostBuster spyware detection program

[Flash00]

Here's something from Bruce Schneier's monthly "crypto-gram" that I thought belonged in this forum.

** *** ***** ******* *********** *************

GhostBuster



Microsoft Research has developed something called GhostBuster, a
prototype program detecting arbitrary persistent and stealthy software,
such as rootkits, Trojans, and software keyloggers. It's a really
elegant idea, based on a simple observation: the rootkit must exist on
disk to be persistent, but must lie to programs running within the
infected OS in order to hide.

Here's how it works: The user has the GhostBuster program on a CD. He
sticks the CD in the drive, and from within the (possibly corrupted)
OS, the checker program runs: stopping all other user programs,
flushing the caches, and then doing a complete checksum of all files on
the disk and a scan of any registry keys that could autostart the
system, writing out the results to a file on the hard drive.

Then the user is instructed to press the reset button, the CD boots its
own OS, and the scan is repeated. Any differences indicate a rootkit
or other stealth software, without the need for knowing what particular
rootkits are or the proper checksums for the programs installed on
disk.

Simple. Clever. Elegant.

In order to fool GhostBuster, the rootkit must 1) detect that such a
checking program is running and either not lie to it or change the
output as it's written to disk (in the limit this becomes the halting
problem for the rootkit designer), 2) integrate into the BIOS rather
than the OS (tricky, platform specific, and not always possible), or 3)
give up on either being persistent or stealthy. Thus this doesn't
eliminate rootkits entirely, but is a pretty mortal blow to persistent
rootkits.

Of course, the concept could be adopted for any other operating system
as well.

This is a great idea, but there's a huge problem. GhostBuster is only
a research prototype, so you can't get a copy. And, even worse,
Microsoft has no plans to turn it into a commercial tool.

This is too good an idea to abandon. Microsoft, if you're listening,
you should release this tool to the world. Make it public domain. Make
it open source, even. It's a great idea, and you deserve credit for
coming up with it.

Any other security companies listening? Make and sell one of these.
Anyone out there looking for an open source project? Here's a really
good one.

Note: I have no idea if Microsoft patented this idea. If they did and
they don't release it, shame on them. If they didn't, good for them.


Technical Report:
<http://research.microsoft.com/resear...e=Technical%20
Report&id=775> or <http://makeashorterlink.com/?H3BC12CAA>


** *** ***** ******* *********** *************

[monckywrench]

That sort of program would lend itself to a BartPE or WinPE bootable CD better than Knoppix.
I'm sure Winternals will come out with something similar, given their success with ERD Commander.