Speaker 1: Brought to you by the reinvented two thousand twelve camera.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech Stuff from how stuff works dot com. Hello again, everyone,
Speaker 1: and welcome to tech Stuff. My name is Chris Poulette.
Speaker 1: I'm an editor at how stuff Works dot com. And
Speaker 1: as usual, the person sitting across to me at this
Speaker 1: table while we do this thing as senior writer Jonathan Strickland.
Speaker 1: The world isn't run by weapons anymore, or energy or money.
Speaker 1: It's run by little ones and zeros, little bits of data.
Speaker 1: It's all just electrons. Today, we're going to start off
Speaker 1: with a little Facebook feedback. This comes from j B
Speaker 1: and j B says, Hey, guys, I just heard you
Speaker 1: mentioned something called a root kit or something like that
Speaker 1: on the back end of your podcast on piracy. I'd
Speaker 1: really love to hear all about all the nasty little
Speaker 1: digital bacteria and viry floating around on the web, perculating
Speaker 1: in the minds of hackers like the mouth of a
Speaker 1: Komodo dragon. Thanks for the greatly entertaining and interesting podcast.
Speaker 1: Cheers and happy holidays. Wow that's a greatly entertaining Yeah.
Speaker 1: I have to point out jb um komodo dragon's mouth
Speaker 1: actually don't percolate. I heard they're cleaner than humans mouth.
Speaker 1: I'm sorry, I think you have another animal. I'm pretty
Speaker 1: sure if a komodo dragon bites me, the bacteria would
Speaker 1: be worse than than your general human I'm not saying
Speaker 1: that there aren't humans out there who could give a
Speaker 1: komodo dragon a run for the money in the bacteria department.
Speaker 1: But how about we get this back on track. Okay,
Speaker 1: so we're gonna talk about root kits now. We've already
Speaker 1: talked about various kinds of worms and viruses in previous episodes,
Speaker 1: but we never really got into root kits. Um And Uh,
Speaker 1: it's interesting because a root kit on its own by itself,
Speaker 1: I mean, really, you could say this about just about anything, right,
Speaker 1: But it's just a tool. It's not necessarily m malicious.
Speaker 1: It doesn't have to be malicious, but I think it's
Speaker 1: probably more than not used as a tool to take
Speaker 1: control of a computer or infect it so thoroughly with
Speaker 1: some kind of malware that it is virtually, if not completely, undetectable. Right,
Speaker 1: let's let's let's try and break this down a bit
Speaker 1: so root kit if you want to be perfectly technical
Speaker 1: about the the definition. A root kit on its own
Speaker 1: does not take control of a computer. Know what it
Speaker 1: does is it allows you to maintain control over a
Speaker 1: computer you've already compromised, but you do it in a
Speaker 1: way that gets shielded from the victims computer. Well, not
Speaker 1: the original the first root kits weren't necessarily that great
Speaker 1: at shielding themselves. But well we can get into that.
Speaker 1: I mean just but yeah, keep going. Okay, So, so
Speaker 1: rooting is kind of going back to Unix terminology. Yeah,
Speaker 1: I mean, hackers of all stripes, good and bad, uh
Speaker 1: frequently referred to the root user, the person who has
Speaker 1: all the administrative rights to the machine right the fewest,
Speaker 1: the fewest restrictions are placed upon the root user. So
Speaker 1: fear me for I am root. Yeah. You can think
Speaker 1: of you can think of different um uh levels of user.
Speaker 1: You know, you've got your your general user, You've got
Speaker 1: your administrator, who usually has greater access than you know,
Speaker 1: your regular user. And then you've got the root user,
Speaker 1: which is usually like a system administrator, who might even
Speaker 1: be able to access things that the administrator can't access.
Speaker 1: It's one of my friends, purposefully with this in mind,
Speaker 1: named his computer all evil. Oh, it's the root of
Speaker 1: all evil. Yes, got you. I thought that was the
Speaker 1: love of money. But at any rate, is apparently this
Speaker 1: person and his or watched out. Um, so yeah, it's
Speaker 1: it's uh too. To root a computer is to get
Speaker 1: that level of access. And you can even do that,
Speaker 1: not just by you know, stealing a password or hacking
Speaker 1: a password or whatever. You can infect a system level
Speaker 1: operation and get system level access to a machine. Now,
Speaker 1: system level access and root access are more or less
Speaker 1: the same thing, but a system there are hackers who
Speaker 1: will tell you system level access is the way to
Speaker 1: go because this is where there are practically no restrictions whatsoever,
Speaker 1: and you can do anything to the core of that
Speaker 1: machine that you want. That's really the goal of the
Speaker 1: root kits is to get control of the core of
Speaker 1: the machine and then to hold onto that as long
Speaker 1: as possible. And while the early root kits didn't necessarily
Speaker 1: shield uh the the invasion from prying eyes so that
Speaker 1: the victim would remain unaware, since then that's pretty much
Speaker 1: the way to go because if you want to have
Speaker 1: if you want to maintain control, it's best if the
Speaker 1: victim never even knows that there, that they are a victim. Right.
Speaker 1: In doing some research, A consulted one of my favorite
Speaker 1: UH tech research sites, tech target UM and the first
Speaker 1: root kits started showing up on networks in the early
Speaker 1: UM and at that point we weren't talking about, you know,
Speaker 1: rooting Windows or Mac machines. They were looking at Sun
Speaker 1: and Linux based operating systems. UM. But now, of course UM,
Speaker 1: things have changed some wide and you could find root
Speaker 1: kits for pretty much every operating system. UM. I've never
Speaker 1: really heard of one for Mac os, but with its
Speaker 1: roots in BSD, I wouldn't be a bit surprised. I
Speaker 1: did come across one while I was researching. So, I mean,
Speaker 1: the concept itself is platform agnostic. It doesn't matter what
Speaker 1: platform we're talking about ways to break into a system
Speaker 1: and get that level of access, that deep level of access.
Speaker 1: And when you're really talking about things like the you're
Speaker 1: talking about things that are are integral to the way
Speaker 1: the computer operates, and in a way, there's it's gonna
Speaker 1: be really difficult to ever prevent root kits from happening
Speaker 1: or or rooting a computer from happening, UM, just because
Speaker 1: as long as you understand how the computer works, you
Speaker 1: have to be able to get to that that core
Speaker 1: of the computer. I mean if you if you weren't,
Speaker 1: then these applications that you build on top of the
Speaker 1: computer would never work because they have to refer back
Speaker 1: to the core to get things like instructions and um
Speaker 1: and what. We can talk a little bit about the
Speaker 1: sort of stuff that that the core does. When I'm
Speaker 1: talking about the core, I'm really I'm talking about the
Speaker 1: kernel of the operating system. Yeah, or talking the very
Speaker 1: I mean the kernel. If you think about a kernel
Speaker 1: of corn or seed. That's really what we're talking about,
Speaker 1: is the the core of the operating It's it's really
Speaker 1: a foundation that everything else is built upon. So this
Speaker 1: is kind of getting to the point of an operating
Speaker 1: system that interacts with the hardware on a machine. So
Speaker 1: this is the This is the layer of programming of
Speaker 1: coding that allows the hardware and the software to work
Speaker 1: with one another. Without this, the hardware wouldn't be able
Speaker 1: to software wouldn't be able to interact with the hardware
Speaker 1: at all. It would just be you know, gobbledygook. So
Speaker 1: the sort of stuff that the colonel does, UM, it's
Speaker 1: in charge of process management. So we've talked a little
Speaker 1: bit about clock cycles. If you use working clock cycles,
Speaker 1: they have a certain number of clock cycles per second. Well,
Speaker 1: something has to assign those cycles to the various applications
Speaker 1: that are running on that machine. That's the colonel's job.
Speaker 1: And colonel, by the way, we're spelling it k E
Speaker 1: R in E L. We're not talking about Mr Sanders.
Speaker 1: So you know it's gonna say, you know, if the
Speaker 1: colonel does a good enough job ed it, it could
Speaker 1: it could receive our promotion. Yeah. And if otherwise, it's
Speaker 1: just fingerlicking good yes. But then if you then you
Speaker 1: end up with the possibility of a general fault in
Speaker 1: which case and then that's a major disaster. But I
Speaker 1: think that's better to kept private. Uh ouch. So anyway,
Speaker 1: we're gonna leave behind the horrible military puns military computing puns,
Speaker 1: which is anyway, So you've got the process management, where
Speaker 1: the kernel is deciding which which processes are getting, how
Speaker 1: many clock cycles per second? Um. Then you also have
Speaker 1: things like file access. The kernels in charge of ultimately
Speaker 1: how how programs access files and how the files are organized,
Speaker 1: and it has to provide sort of a consistent logical
Speaker 1: interface for file systems. It's also in charge of security
Speaker 1: to some point. It's it's in charge of administering permission
Speaker 1: between the processes and memory allocation, so it's also in
Speaker 1: charge of memory UM. With these elements, if you fiddle
Speaker 1: with these elements at all, then you can create an
Speaker 1: environment where you can run secret process is and it
Speaker 1: doesn't appear to the user at all. Yeah, I think
Speaker 1: I think it would be safe to say, I mean,
Speaker 1: based on my understanding of this, that we're talking about
Speaker 1: stuff that's sort of in between the operating system, almost
Speaker 1: like the layer the operating system that you see and
Speaker 1: the computer itself. So it's it's basically buried under anything
Speaker 1: that you're going to be able to to see visually.
Speaker 1: You can't go in there and go, wait a minute,
Speaker 1: what's that program? UM, which may be talking about a
Speaker 1: deeper level than that. Yeah, Now, I mean I was
Speaker 1: reading up on it at a Computer World and Paul
Speaker 1: Roberts said that for early root kits, what you would
Speaker 1: be able to do is look at the way the
Speaker 1: computer is using memory, UM, whether there are any communications
Speaker 1: going on back and forth between the computer and a
Speaker 1: network of you know whatever kind UM. Basically those are
Speaker 1: clues to tell you that something is going on. If
Speaker 1: you can't attribute those processes to something that is already
Speaker 1: running on that machine, there may be a root kit installed.
Speaker 1: And that's one way that for earlier root kits, um
Speaker 1: you would be able to tell that something strange was
Speaker 1: going on. Right, Yeah, These these levels of root kits
Speaker 1: we would probably call user level. Yeah, so your user
Speaker 1: level root kit is existing on top of the operating system.
Speaker 1: It's actually kind of running like an additional application, right Like,
Speaker 1: So it's so you might be running maybe three applications
Speaker 1: on your computer, and this would be a fourth mysterious application,
Speaker 1: um where if you if you were careful enough and
Speaker 1: looked around, you would be able to see evidence of
Speaker 1: it running, and therefore you would know that possibly something
Speaker 1: was wrong. So user level user um level root kits
Speaker 1: are not the most um secure for the hacker. Right now,
Speaker 1: there's a chance the hacker will be found out, or
Speaker 1: at least the hackers work will be found out. Right,
Speaker 1: and of course he or she whomever it was that
Speaker 1: that put it in place, you know, the point is
Speaker 1: to keep it on there as long as possible. So
Speaker 1: they got more ingenious with ways to find to hide
Speaker 1: it machine. And and then we're getting into kernel level
Speaker 1: root kits, and these are the nasty ones. This is
Speaker 1: insidious stuff here, because you're talking about messing with the
Speaker 1: very core of the computer. And it's kind of like
Speaker 1: if you could imagine someone being able to invade your
Speaker 1: mind and change your way of thinking in such a
Speaker 1: way that you couldn't tell that there was someone messing
Speaker 1: with you. I mean, it's it's it's that kind of
Speaker 1: level of of sneakiness. Yeah. Roberts's article said that the
Speaker 1: more modern kernel level root kits can basically go in
Speaker 1: and erase their tracks. They shut down any sign of
Speaker 1: whatever it is that they're doing in there. They can
Speaker 1: encrypt communication between the computer and the network so that
Speaker 1: even if you could tell what's going on, you couldn't.
Speaker 1: You can't tell what's going on, right, Yeah, it'll it'll
Speaker 1: do stuff like essentially, it'll it'll fiddle with the memory
Speaker 1: so that it looks like it's not using any memory.
Speaker 1: It'll fiddle with um the kernel's ability to manage processes
Speaker 1: so it looks like there are no additional processes running.
Speaker 1: It's when you're again, when you have access to that
Speaker 1: level of the operating system, you can really manipulate it.
Speaker 1: In such a way that no one can tell that
Speaker 1: that there's something hinky going on, and and that encryption
Speaker 1: is a really tricky part two, because there are files
Speaker 1: associated with these root kits. I mean, the way this
Speaker 1: works is the hacker first has to get access to
Speaker 1: your machine, right and either they're going to do that
Speaker 1: by using social engineering and fulling you into into revealing
Speaker 1: your password, or they're going to the hacket. They're going
Speaker 1: to brute force it where they just guess it the
Speaker 1: password until it works. Once they have access to your
Speaker 1: machine and they install these files, they have to have
Speaker 1: it disguised in such a way so that you you
Speaker 1: don't just uncover it immediately and say, oh, well, here's
Speaker 1: the problem. There these files on my machine that don't
Speaker 1: belong here. By encrypting it, they've they've given it kind
Speaker 1: of a disguise. And they've also been known to layer
Speaker 1: traffic on traffic from another legitimate program going through an
Speaker 1: open port that is available for that program to access.
Speaker 1: So basically any communication is hidden along with sort of
Speaker 1: like putting something in the prison mail and in the
Speaker 1: laundry to smuggle it outside. It's it's hiding it in
Speaker 1: something else that's legitimately supposed to be there, and that
Speaker 1: makes it extremely hard to detect. Yeah, and you may
Speaker 1: wonder like, well, how how can you get kernel access
Speaker 1: to you know? But one of the ways is UM
Speaker 1: using device drivers. Device drivers, Yes, because these device drivers,
Speaker 1: these are the this is what allows again your computer
Speaker 1: to interact with devices that you hooked up to it.
Speaker 1: So like a printer driver for example, UM, you can
Speaker 1: you can infect a or you can create a device
Speaker 1: driver that is actually a root kit. And by the
Speaker 1: very nature of the drivers, they have to have access
Speaker 1: to the kernel in order for them to work. So
Speaker 1: your computer just says, oh, well, this is a legitimate,
Speaker 1: you know, piece of code here that I need to incorporate,
Speaker 1: and in reality, it's this root kit that's hiding the
Speaker 1: activity of the hacker. UM, we haven't really I'm sorry
Speaker 1: you were about to say something to go ahead, but
Speaker 1: we haven't really talked about why anyone would install a
Speaker 1: root kit. UM. There are a lot of different reasons
Speaker 1: that hackers might want to do it. One is if
Speaker 1: a hacker is is essentially a spam farm. If a
Speaker 1: hacker is making money by sending spam out to various recipients,
Speaker 1: they they don't want to send spam out from their
Speaker 1: own machine because if you do that, then you can
Speaker 1: be tracked down and caught. Now, we talked about and
Speaker 1: there's another reason to we We talked about this on
Speaker 1: a on a podcast a long time ago. UM distributed computing.
Speaker 1: The the using distributing computing to spread out processors are
Speaker 1: spread out a task among multiple processors. Now there's only
Speaker 1: so much one computer could do. Now the hacker could
Speaker 1: buy a lot of computers and have them all send
Speaker 1: out spam, or they could write a piece of software
Speaker 1: that other people could put on their computers, either willingly
Speaker 1: or if you can manage it unwillingly very sneakily. Um.
Speaker 1: And uh, you know, have all these people do it
Speaker 1: for you. Um. And that's that's the tricky part. But
Speaker 1: that's that's one of the reasons why they would do it,
Speaker 1: is to spread out that work over multiple computers without
Speaker 1: having to work over the money for lots of computers.
Speaker 1: It also makes you more detectable if all the traffic
Speaker 1: is coming from you. Yeah, so uh yeah, you can
Speaker 1: create an exploit to give you the access to the computer.
Speaker 1: And that exploit is is the that's that's kind of
Speaker 1: like kicking the door in the root kit part is like, uh,
Speaker 1: setting it all up so it looks like the door
Speaker 1: was never kicked in. You've erased you know, you've removed
Speaker 1: all your fingerprints, but you're still hiding in the house. Um.
Speaker 1: It also allows you to do things like spy on
Speaker 1: the person machine or all the traffic that goes through
Speaker 1: that machine. If it's the case of like a web server,
Speaker 1: that's true, they could be they could be looking at
Speaker 1: your passwords, they could be recording your key strokes. They
Speaker 1: could be packett sniffing to find out what kind of
Speaker 1: data you are sending across networks. Yeah, so that's of
Speaker 1: course a very dangerous thing if it's uh, if it's
Speaker 1: a machine that's in charge of passing along secure data,
Speaker 1: like you know, any kind of government machine or even
Speaker 1: a corporate machine, even personal machines. Really, I mean, when
Speaker 1: you get down to it, you don't want some unknown
Speaker 1: party to have access to all your information. Now should
Speaker 1: we should we mention a particular root kit? Are you
Speaker 1: thinking stucks net? I wasn't thinking stucks net, But actually
Speaker 1: I didn't know that stucks net was a root kit.
Speaker 1: I heard it referred to as something else. There's a
Speaker 1: root kit element to it, but refer to yours and
Speaker 1: then I'll talk about stucks net UM. Okay, Well, the
Speaker 1: one I was going to talk about is x cp UM.
Speaker 1: This is something that actually I think this is the
Speaker 1: one that we were referring to before. It's the one
Speaker 1: that security expert Mark Rassinovich of sis Internals found. He
Speaker 1: had popped to Sony Music CD into his computer and uh,
Speaker 1: now the memories coming back, yes, and it had a
Speaker 1: piece of copy protection. Again, you know, this is not
Speaker 1: something where Sony was trying to hack on into people's computers.
Speaker 1: But uh, that's effectively what they did. Do you know,
Speaker 1: it wasn't their intent. Yeah, they weren't trying to do
Speaker 1: anything nefarious, unless you consider protecting their intellectual what they
Speaker 1: considered their intellectual property, as nefarious, and some people do. UM.
Speaker 1: But uh, basically what he discovered, you know, being a
Speaker 1: security expert, he knew what he was looking for in
Speaker 1: terms of this. He discovered this root kit had been
Speaker 1: installed by a music CD. Now, there were dozens of
Speaker 1: CDs that Sony released with this UM, including Celine, Dion, Disks,
Speaker 1: Neil Diamond, Um, all kinds of other people. Uh, you
Speaker 1: just described half my music collection. Ricky Martin, there's the
Speaker 1: other I was looking for for great big names, but
Speaker 1: labels like Epic Columbia, UM, Epic Legacy, Columbia Legacy, and
Speaker 1: there were there were lots more. I just got that
Speaker 1: list actually from from the e f F, the Electronic
Speaker 1: Frontier Foundation. Yes, that's only a partial list. Um, so yeah,
Speaker 1: I mean they had basically there there there were tailtell
Speaker 1: signs in the outside packaging it says, uh, this is
Speaker 1: compatible with these different computers. Um, you know, why would
Speaker 1: a music CD need to have that on there? Well,
Speaker 1: it turns out the root kit is compatible with that. Now,
Speaker 1: if you play this on a Mac running Mac os ten,
Speaker 1: you can see the root kit file. But the root
Speaker 1: kit file does not work on a Mac. It's it's
Speaker 1: engineering for Windows PCs. That's a good point. Yeah. Root
Speaker 1: kits tend to work with specific uperating systems or specific
Speaker 1: families of operating systems. When you hear about Windows, root
Speaker 1: kits usually will only work on certain like you know,
Speaker 1: like Windows XP and a few other versions of Windows.
Speaker 1: But it won't work on all of them because not
Speaker 1: all of them are based on that same uh, that
Speaker 1: same code. Yeah, but In this case, Sony was basically
Speaker 1: trying to get access to the user's computer to protect
Speaker 1: the copies from being made of the music. Now it
Speaker 1: could actually sniff what stuff like what sites you visited
Speaker 1: and how you and what kind of files you were sending.
Speaker 1: So if you were theoretically trying to share the music
Speaker 1: across the network, it could detect that people had a
Speaker 1: problem with this. Yes, lots of people had a big
Speaker 1: problem with this, and corporate sponsored group kids are not
Speaker 1: good Sony. Uh, I think was was pretty embarrassed by
Speaker 1: the whole thing. They eventually, uh you know, discontinued this practice.
Speaker 1: They did apologize for it as well. Yeah, yeah, it was.
Speaker 1: It was a pretty uh, pretty serious deal there for
Speaker 1: a little while, and I think it's safe to say that,
Speaker 1: you know, people were weary of doing things that way. Now, Um,
Speaker 1: I totally lost my train of thought. Well, I can
Speaker 1: pick it up with stuck snet if you like. Yeah,
Speaker 1: I mean it's it's but it's just seems to me
Speaker 1: kind of heavy handed that they would have gone to
Speaker 1: that much trouble to to do to install that level
Speaker 1: it was. It was definitely going above and beyond the
Speaker 1: call of duty to protect your music. Yeah, so stucks
Speaker 1: net is this, Uh. I remember what I was gonna say,
Speaker 1: Go ahead, Oh if you wanted to do If you
Speaker 1: wanted to do this, to disable the root kid, all
Speaker 1: you had to do was turn off auto run, but
Speaker 1: then the CD would not play in your computer. So
Speaker 1: what you ended up having to do was to basically
Speaker 1: to rip the CD and listen to it that way
Speaker 1: to avoid having the root kit installed. That was the
Speaker 1: part of strip the music from the CD. Well you're not.
Speaker 1: That's music still on the CD, but you had to
Speaker 1: copy it essentially onto your computer to be able to
Speaker 1: listen to it, which is probably exactly what they were
Speaker 1: trying to prevent you from me the first place. So
Speaker 1: not only did they not prevent people from doing it,
Speaker 1: but they also infected all these computers with various of
Speaker 1: a root kit fantastic stuck yes, which I can finally
Speaker 1: talk about this um now, stucks net is a pretty
Speaker 1: nasty uh thing that's going around, a malware that's going around.
Speaker 1: This is pretty current as if when we're recording this,
Speaker 1: it it just sort of popped out in the I
Speaker 1: would say fall and it Uh. It targets Windows systems
Speaker 1: and it's looking for industrial control systems and not just
Speaker 1: any industrial control systems. Yeah, they there's a lot of
Speaker 1: people refer to them as scatter systems s C A,
Speaker 1: d A. Which really that's not that's not entirely accurate,
Speaker 1: but it's fair enough to call it that. It's we're
Speaker 1: talking about program programmable logic controllers UM that are those
Speaker 1: are like a computers essentially that can be programmed from
Speaker 1: a Windows system and they are running industrial processes. So
Speaker 1: this is the sort of stuff you might find in
Speaker 1: a plant or a factory or like a massive utility
Speaker 1: might have these kind of machines in them. Yes, so
Speaker 1: you might think, well, why would you want to infect these? Well,
Speaker 1: theoretically you could infect them and then cause the machinery
Speaker 1: to behave in such a way that it would destroy
Speaker 1: itself or it cause damage to UH an entire area.
Speaker 1: You could you know, shut off region's water supply, bring
Speaker 1: down a power grid. You could cause you could theoretically,
Speaker 1: if you set machines to a particular setting, you could
Speaker 1: cause um, a factory to catch fire or a nuclear
Speaker 1: power plant to you know that could you could have
Speaker 1: a little meltdown, you could, um, you could turn off
Speaker 1: the the safety valves on various devices so that people
Speaker 1: would not detect when there was a failure, and then
Speaker 1: you could cause a failure to happen. It's scary stuff
Speaker 1: and uh and part of the stucks net attack involves
Speaker 1: installing root kits on systems because of course, if you
Speaker 1: don't install the root kit, then people security experts can
Speaker 1: find out that this is going on and then address
Speaker 1: it and try to to remove the malware from the
Speaker 1: various systems. Root kits help make that a more difficult task.
Speaker 1: It's not necessarily impossible to discover that there's a root
Speaker 1: kit on your system, but if if the hacker has
Speaker 1: done a good job, if the root kit they're using
Speaker 1: is particularly um robust, it can be really really challenging.
Speaker 1: And again we're talking about the reason for that is
Speaker 1: because you go into that core of the computer. When
Speaker 1: you're messing with the core, you can just you know,
Speaker 1: the computers like malware. What malware In fact, that's that's
Speaker 1: a lot of these elements are built into various viruses
Speaker 1: and worms. Now as well, where you on the initial attack,
Speaker 1: you can't when you run your anti virus software, the
Speaker 1: virus or worm may have in it as part of
Speaker 1: it a root kit element so that it evades that
Speaker 1: anti virus software. The people who write root kits know
Speaker 1: what they're doing. Yeah, these it's not the work of
Speaker 1: script kitties. No, no, no, no. Script kitties might use
Speaker 1: a root kit after it's been made, but they're not
Speaker 1: the ones building it. No, And something like like stucks net.
Speaker 1: You know, a lot of people were a little nervous
Speaker 1: when they saw what it was and how how it
Speaker 1: could cause some serious damage because people started wondering what
Speaker 1: was behind it. As far as I know, nobody still
Speaker 1: knows exactly who is behind that particular UM yeah, you know,
Speaker 1: or when the trigger could be pulled on something like that.
Speaker 1: It is pretty terrifying. Uh. Other things that hackers may
Speaker 1: do with these UM devices that they've put a root
Speaker 1: kit on include the distributed denial of service attacks, which
Speaker 1: we've seen recently with the whole Wiki leaks fallout. We
Speaker 1: talked about that recently, where you would put a root
Speaker 1: kit in so that the victim would not know that
Speaker 1: his or her computer was being used to direct attacks
Speaker 1: against other machines on the Internet. And these attacks sometimes
Speaker 1: just take the four of sending millions and millions of
Speaker 1: messages UH like information requests to a server, often with
Speaker 1: a spoofed address, so that the servers trying to respond
Speaker 1: to UM an address that doesn't actually exist, and you
Speaker 1: just overwhelmed the server, or you may even have it
Speaker 1: where you crash it by sending responses to that server
Speaker 1: as if the server had had sent a ping out
Speaker 1: to the victims computer, so it's like you're answering a
Speaker 1: question that hasn't been asked yet and that can also
Speaker 1: overwhelm the server. Those are just two very simple versions
Speaker 1: of denial of service attacks and a distributed denial of
Speaker 1: service attacks when you're using an entire bot net to
Speaker 1: do it. Yeah, whole whole basically a series of computers
Speaker 1: that is under the control of uh, you know, the
Speaker 1: function is robots, that's why they call it. But yeah,
Speaker 1: it's it's a whole group of computers under the control
Speaker 1: of you know, a hacker, hacker organization UM And yeah,
Speaker 1: I mean talking about the level of sophistication necessary to this.
Speaker 1: Operating systems of all stripes have vulnerabilities in them, and
Speaker 1: it takes somebody who knows where to uh where the
Speaker 1: exploit can function for them and serve them to write
Speaker 1: the the the root kit or virus or trojan or whatever.
Speaker 1: To take advantage of those vulnerabilities, especially something kernel level,
Speaker 1: it takes a lot of sophistication, but um, they also
Speaker 1: it also does take, as as Jonathan mentioned earlier, some
Speaker 1: some social engineering because in a lot most I would
Speaker 1: say probably all cases, I say probably, I'm just hedging
Speaker 1: my bets there. But basically they have to convince you
Speaker 1: to install this. Sony convinced people to install the root
Speaker 1: kit by when you popped it in the CD, I'm
Speaker 1: you know, and asked you questions, you know, and you know,
Speaker 1: for mac os ten people complain about the viruses that
Speaker 1: people discover because um they say, well, you know, you
Speaker 1: still have to be convinced to install that. Well yeah,
Speaker 1: I mean in these cases to access that level. If
Speaker 1: you are the administrative user on that computer, something is
Speaker 1: going to ask you if you can install it, and
Speaker 1: it will probably say it's I don't know, an anti
Speaker 1: virus program or you know, hey, we're adding some sophisticated
Speaker 1: stuff so you can enjoy this media content even more richly.
Speaker 1: Wouldn't you like to have that? And okay, sure, and
Speaker 1: you can even have this happen if you're getting a
Speaker 1: legitimate program. There's there's no there's no nothing stopping a
Speaker 1: programmer from building a root kit in with any kind
Speaker 1: of program at all. I mean, maybe that the next
Speaker 1: video game you buy for your computer has a root
Speaker 1: kit in it because one of the programmers decided to
Speaker 1: include it. And uh, and I mean that can happen.
Speaker 1: In fact, you could argue that when we install programs
Speaker 1: on our machines were essentially taking it on faith that
Speaker 1: the programs did not put anything in there with the
Speaker 1: intent to take over our machine. That's it's and that's
Speaker 1: kind of scary when you think about it. And also
Speaker 1: it's a good reminder that the best way to UM
Speaker 1: to have to battle root kits is just to avoid
Speaker 1: getting hit by them. Don't and ston't click on weird links,
Speaker 1: don't open weird attachments from people you don't know. Don't
Speaker 1: run applications that you know you you aren't positive came
Speaker 1: from a legitimate source. Because even though, like I said,
Speaker 1: theoretically at kit could come from a legitimate source, after
Speaker 1: all the Sony one did, UM, the chances are of
Speaker 1: that happening are are lower than if you were just
Speaker 1: running any kind of application you came across in you know,
Speaker 1: in your worldwide web travels. Um, go ahead, you're saying something, well,
Speaker 1: I was going to say. Typically, in cases like this,
Speaker 1: we've said it's important for you to keep your anti
Speaker 1: virus software up to date. However, with more modern kernel
Speaker 1: level root kits, there's probably not a whole lot anti
Speaker 1: virus software is going to be able to do techt
Speaker 1: at all. Yeah, because essentially it's the root kit itself
Speaker 1: is telling the antivirus software I'm not I'm not dangerous. Yeah,
Speaker 1: I'm not malware, and the antivirus software is a yoke. Yeah,
Speaker 1: and it's got the root kid is installed at such
Speaker 1: a level that the antivirus software really can't you know,
Speaker 1: it can be fooled. One other interesting thing before we
Speaker 1: wrap up. I learned, um that multiple root kits on
Speaker 1: a single machine can cause stability issues. Yeah, so your
Speaker 1: machine could could crash because you've got two different root
Speaker 1: kits attempting to manipulate the kernel of your operating system.
Speaker 1: And that is a bad thing. Um. And that also,
Speaker 1: hackers don't necessarily checked to see if the machine they're
Speaker 1: about to infect already has a root kit on it. Yeah,
Speaker 1: it's just not one of the things they necessarily think
Speaker 1: of when they're doing it. So if if you happen
Speaker 1: to be kind of click happy and you're clicking lots
Speaker 1: of different applications, and you get two root kits on
Speaker 1: your machine, you could end up making it just a
Speaker 1: crash happy device. Um. When when we talked about the
Speaker 1: Wiki leaks thing, I talked about it is possible for
Speaker 1: a single computer to be controlled by both sides of
Speaker 1: a cyber war. That's still technically true, but it does
Speaker 1: create stability issues. So there's a chance that you know,
Speaker 1: you wouldn't really be launching any attacks with your machine necessarily,
Speaker 1: just because you wouldn't have it active long enough for
Speaker 1: it to do anything. Yeah, and um, there is one
Speaker 1: piece of advice of our typical advice that we can
Speaker 1: offer you. Um, it's still a good idea to back
Speaker 1: up your hard drive. And that's especially important because the
Speaker 1: only way to technically to completely wipe a root kid
Speaker 1: off your hard drive is to completely wipe it off
Speaker 1: and reinstall your operating system. And even then, there are
Speaker 1: some root kits that have been proven, at least in labs,
Speaker 1: to affect the bios, which is even worse. Yeah, when
Speaker 1: you affect the bios than even when you wipe the
Speaker 1: operating system completely out and reinstall it, it's still there.
Speaker 1: So in an absolute worst case scenario, you would need
Speaker 1: to get a new machine, but that still means back
Speaker 1: up your hard drive because otherwise you wouldn't be able
Speaker 1: to have transferred over to your new machine. UM there
Speaker 1: are a lot of great cloud based services now to
Speaker 1: where you can back up your your information to the cloud,
Speaker 1: so that way you don't have to worry about like
Speaker 1: if your machine is beyond saving, then you can still
Speaker 1: get to that data you with a new machine without
Speaker 1: having to hook up an external hard drive or something
Speaker 1: like that. UM Before, before I completely wrap this up,
Speaker 1: I just wanted to mention two books that I used
Speaker 1: while researching this that I think if you want to
Speaker 1: learn more about root kits UM it's written from two
Speaker 1: very different perspectives these two books. The first is root
Speaker 1: kits Subverting the Windows Kernel by Greg Hogland and James Butler.
Speaker 1: The second was written by a hacker, someone who someone
Speaker 1: who worked in UM computer security and now works in
Speaker 1: anti computer forensics. Yeah. Uh, that novel or that novel novel,
Speaker 1: it's a book so tired. The root kit Arsenal by
Speaker 1: the Reverend Bill Blunder. That's that's that's his handle. I'm
Speaker 1: actually at Bill Blunder's his name as far as I know,
Speaker 1: But the Reverend, I guess, is a handle that he uses.
Speaker 1: UM and UH, and both of those books have a
Speaker 1: fascinating discussion about what root kits are, what they are not,
Speaker 1: what they do and UM and why they would be useful.
Speaker 1: Keep in mind that there are governments that use these,
Speaker 1: there are companies that use these. If your computer is
Speaker 1: ever seized from you and searched by computer forensics experts,
Speaker 1: there's the possibility that when you get it back, it
Speaker 1: has one of these on it. Just say in behave
Speaker 1: That's what I'm saying. Okay, it would be nice. Yeah, yeah,
Speaker 1: or at least be aware. If you're not going to behave,
Speaker 1: be aware, but behave all. And so that wraps this up.
Speaker 1: If you have any suggestions for topics that we can
Speaker 1: address in the future, you can let us know via
Speaker 1: Twitter or Facebook. That handle is tech Stuff h s
Speaker 1: W or you can email us that address is tech
Speaker 1: stuff at how stuff works dot com. And Chris and
Speaker 1: I will talk to you again really soon for more
Speaker 1: on this and thousands of other topics. Visit how stuff
Speaker 1: Works dot com. So learn more about the podcast, click
Speaker 1: on the podcast icon in the upper right corner of
Speaker 1: our homepage. The How Stuff Works iPhone app has arrived.
Speaker 1: Download it today on iTunes. Brought to you by the
Speaker 1: reinvented two thousand twelve camera. It's ready, are you