5 ms·
How to Use Trend Micro's Rootkit Remover to Install a Rootkit
- MikusR 6y agoThe main thing is that Trend Micro is basically doing the same thing volkswagen did. Cheating in tests to get certified.
- codezero 6y agoIn this case, the regulatory board is Microsoft, and there’s nothing telling us (yet) that there isn’t a partnership in which they gave them certification knowing about some of their dirty tricks.
- guardiangod 6y ago>the Bruteforcing Processes code doesn’t make sense, are Trend Micro developers not aware of enumerating processes via ZwQuerySystemInformation? As someone whose work involves screwing around with Windows' internal, whenever I see codes like this, I immediately think that the developer doesn't trust Windows' API. I guess that Trend Micro believes there's a chance that ZwQuerySystemInformation has been hooked by a malicious process and its data is unreliable, and they would rather retrieve the information themselves by scanning the memory manually.
- jeffmcjunkin 6y agoExactly this. Much like the Volatility Framework's psscan[1] module. [1] https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#psscan https://github.com/volatilityfoundation/volatility/wiki/Comm...
- dmitrygr 6y agoIt is a tool to detect rootkits A good rootkit would certainly exclude itself from the info returned by ZwQuerySystemInformation
- anotherepisode 6y agoThat's exactly the reason.
- GordonS 6y agoCheating in a driver qualification test is not a good look. Surely Trend Micro should be penalised in some way by Microsoft?
- gjs278 6y agodrivers should not even involve microsoft
- Stierlitz 6y ago“Most of the driver feels like proof-of-concept garbage that is held together by duck tape.” Oouch!
- ngcc_hk 6y agoSeems the installation still going without one agreeing to the license is very odd
- Semaphor 6y agoMaybe they thought that, as it’s essentially unenforceable in EU anyway, they might as well not bother? ;)
- justinclift 6y agoIt's probably just them forgetting some to add a test for the scenario of "user doesn't accept agreement". :/ The comment about the end, about the code looking like Proof of Concept garbage would be in line with that. ;)
- yborg 6y agoSo Trend Micro cheats to get Microsoft certified, and my employer then uses Trend Micro virus scanning to get certified for HITRUST. It's turtles all the way down.
- maxmalysh 6y agoIt always amazes me how using Windows never feels safe. It is literally a sieve in terms of security.
- justinclift 6y agoIn the early screenshot where it shows the directory listing for "%TEMP%\RootKitBuster", three entries jump out (to me) as immediately interesting: * sqlite3.dll * scan_db.sql * DB <-- a folder name That scan_db.sql is likely full of SQL statements. And SQLite can have user defined C functions added. Depending on when those SQL statements are run (just for initial DB creation? during every run? etc), it could be a cheap and easy way to get your code running in a high privilege context. :)
- deleted 6y ago[deleted]
- fomine3 6y agoTrendMicro does too many BS things in Japan. Many devs getting recognizing it but still their products are adopted many places.