Rootkit
Set of malicious software designed to implant itself at the deepest level of a system, conceal its presence from detection tools and maintain persistent access without the knowledge of the user or operating system.
In June 2010, the Belarusian security firm VirusBlokAda flagged Stuxnet. Its Windows kernel drivers had been signed with certificates stolen from Realtek, then from JMicron, and it targeted the Siemens S7 PLCs driving the Iranian centrifuges at Natanz. The term rootkit combines root, the supreme administrator account on Unix systems, and kit, a toolset. It appeared in security literature in the early 1990s to describe collections of programs that let an attacker who already had root privileges hide their presence by modifying system commands. Rootkits grew more sophisticated in layers. User-space rootkits, which hijack system libraries, gave way to kernel rootkits. These run at the same trust level as the core of the operating system and are therefore invisible to any tool running on it. More dangerous still, bootkits write themselves into the UEFI firmware or the disk boot sector. Their code loads before the operating system takes control, and they survive even a complete reinstall. Hypervisor rootkits slip a malicious hypervisor beneath the target operating system, which then runs as a virtual machine without knowing it; Blue Pill, presented by Joanna Rutkowska at Black Hat in August 2006 on AMD virtualization, remains the reference proof of concept. For cyber insurers, remediation becomes a severe problem. Can a system compromised by a firmware-level rootkit ever be considered clean? The question is technically open. It can lead to demands for complete hardware replacement and to coverage disputes over the definition of a restored system. Rootkits are frequently associated with state-sponsored APT groups, which raises war exclusion questions.
In 2010, the Stuxnet rootkit used drivers signed with certificates stolen from Realtek and JMicron to install itself at Windows kernel level, then targeted the Siemens S7 PLCs of Iranian centrifuges. It is widely ascribed to the United States and Israel, though neither has ever acknowledged it. Its discovery redefined the boundary between cyberattack and act of war, and directly fueled the debate on war exclusions in cyber policies throughout the following decade.
- eWeek, "'Blue Pill' Prototype Creates 100% Undetectable Malware", June 2006 (announcing Joanna Rutkowska's demonstration at Black Hat, Las Vegas, August 3, 2006)
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.