English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

No rootkit in Kaspersky Anti-Virus

Eugene
Kaspersky Lab Expert
Posted January 13, 14:47  GMT
Tags: Antivirus Technologies, Rootkits
0.1
 

Mark Russinovich, who is well known as an IT security expert, and who was a major player in the Sony rootkit scandal, is now suggesting that we use 'rootkit' technology in our products. His comments have been picked up in a PCWorld article (http://www.pcworld.com/news/article/0,aid,124365,00.asp). He said that "the techniques used by ... Kaspersky's Anti-Virus products are rootkits, a term usually reserved for the techniques that malicious software uses to avoid detection on an infected PC".

Our products do use a technology called iStreams™, which is what Russinovich seems to be worried about. But this isn't a rootkit.

We started using iStreams™ technology a couple of years ago to improve scanning performance. Basically, this means that our products use NTFS Alternate Data Streams to hold checksum data about files on the user's system. If a checksum remains unchanged from one scan to another, KAV products know the file has not been tampered with and do not, therefore, require a repeat scan.

To view NTFS Alternate Data Streams you need special tools. When KAV is active it hides its streams because they are its internal data only. Just because you can't see them either automatically or with a special tool, it doesn't mean that they're malicious. It also doesn't mean that a product which uses and hides these streams is using rootkit technology.

We believe that this technology is not a rootkit and we do not believe hackers and/or malware can exploit it because:


  • If a KAV product is active, the streams are hidden and no processes (including system) have access to them.

  • If the product is disabled, the streams will be visible if viewed using the appropriate tools (standard for working with NTFS streams)

  • If a stream is re-written with some (possibly malicious) data or code (for example after rebooting in Safe Mode), when the system is next re-started, KAV will read the stream and not recognize the format. KAV will then begin to rebuild the checksum database - thus it will destroy the alien code/data.

The PCWorld article goes on to say: "While Russinovich agreed that the Symantec and Kaspersky cloaking techniques are not as dangerous as Sony's, which was ultimately exploited by virus writers, he said that all three vendors were engaging in a practice that was bad for users and IT professionals"

In short, there is no danger for KAV users at all because there is no way to misuse KAV streams. I think that when we talk about security we need to be clearer about the difference between malicious (or dangerous) rootkits and cloaking technologies, which can't be exploited by malware.

Our products use iStreams™ technology to speed up performance. The only downside is that it increases the time it takes to de-install the product, as it has to remove data from the streams. Because of this, and for no other reason, the next version of our product will use a different technology to offer the same benefits.

Russinovich is further quoted as saying "You don't want IT not knowing what's on the systems," he said. "Not being able to go to the system to do software inventory and disk space inventory, that's just not a good idea."

I say that there's no way to know everything that's on the system. The only way to do that is to format the disk. In this case you know for sure that there is nothing on the disk except boot sectors.

Different software products use different formats to store their data, including data compression and encryption. Thus the IT guys don't really know what's inside. I don't know what's in every single data file on my own computer, just I don't know all the facts in every single book in my home library.

To sum up: I think that the ”rootkit” problem is being over hyped. It is up to all of us in the security industry and press to be careful about how we use terms. Ordinary users, who can't analyze the situation themselves, shouldn't be misinformed.


1 comments

matthew paradise

2011 Apr 16, 07:43
0
 

well said

Eugene,
Thanks for the great, informative article. iStreams is a great example of a positive way to use NTFS ADS. It sounds like Russinovich just wants some drama and attention. If it is bad to use ADS, then why would M$ design NTFS to have them, and to make them so easy to use? Furthermore, ADS are just ways to store meta-data about a file. Just because an application uses them, doesn't mean they are rootkits. You have a found a great way to implement them--the perfect way to store a checksum of a file.

Keep up the great work! I'm a huge fan of Kaspersky and recommend it to all misinformed PC users out there!

Reply    
If you would like to comment on this article you must first
login


Bookmark and Share
Share

Analysis

Blog