WEBVTT

1
00:00:00.080 --> 00:00:03.919
<v Speaker 1>Welcome back everybody. Today, we're doing a deep dive on

2
00:00:04.000 --> 00:00:08.759
<v Speaker 1>something that's honestly kind of creepy. No, root kits. We're

3
00:00:08.759 --> 00:00:11.199
<v Speaker 1>going to really try to get into like how they work,

4
00:00:11.759 --> 00:00:14.080
<v Speaker 1>why they're so dangerous, and if there's any hope of

5
00:00:14.160 --> 00:00:15.519
<v Speaker 1>like detecting them.

6
00:00:15.759 --> 00:00:16.399
<v Speaker 2>Yeah.

7
00:00:16.480 --> 00:00:20.440
<v Speaker 1>Our sources this time are excerpts from a from the

8
00:00:20.440 --> 00:00:24.519
<v Speaker 1>book root Kits Subverting the Windows Colonel, written by Greg

9
00:00:24.559 --> 00:00:26.440
<v Speaker 1>Hogland and James Butler.

10
00:00:26.640 --> 00:00:28.359
<v Speaker 2>Oh wow, now these.

11
00:00:28.280 --> 00:00:30.719
<v Speaker 1>Guys are the real deal. They actually teach a black

12
00:00:30.760 --> 00:00:31.879
<v Speaker 1>hat course on this stuff.

13
00:00:31.960 --> 00:00:32.640
<v Speaker 2>So oh wow.

14
00:00:32.759 --> 00:00:35.159
<v Speaker 1>Okay, yeah, so buckle up because we're about to get

15
00:00:35.159 --> 00:00:38.240
<v Speaker 1>into some serious hacker secrets here.

16
00:00:38.520 --> 00:00:41.399
<v Speaker 2>It's interesting you say the word creepy. Yeah, there's a

17
00:00:41.439 --> 00:00:43.759
<v Speaker 2>line in the book that just stuck with me.

18
00:00:44.039 --> 00:00:44.359
<v Speaker 1>Yeah.

19
00:00:44.399 --> 00:00:47.799
<v Speaker 2>It says the attacker is the master of his enemy's fate.

20
00:00:48.039 --> 00:00:48.479
<v Speaker 1>Whoa.

21
00:00:49.439 --> 00:00:51.799
<v Speaker 2>That's what's so unsettlingly about root kits. You know, they

22
00:00:51.799 --> 00:00:54.280
<v Speaker 2>give attackers this power to operate in the shadows and

23
00:00:54.280 --> 00:00:55.880
<v Speaker 2>control your system without you even knowing.

24
00:00:55.960 --> 00:00:57.039
<v Speaker 1>Okay, that's a little chilling.

25
00:00:57.240 --> 00:00:58.439
<v Speaker 2>Yeah, so let's back up.

26
00:00:58.560 --> 00:01:01.079
<v Speaker 1>Okay, what exactly is a root cat? Okay, I mean,

27
00:01:01.079 --> 00:01:03.320
<v Speaker 1>we all know it's bad news, but like, how does

28
00:01:03.359 --> 00:01:04.280
<v Speaker 1>it actually work.

29
00:01:05.079 --> 00:01:08.680
<v Speaker 2>So, at its core, a root kit is all about modification.

30
00:01:10.439 --> 00:01:14.400
<v Speaker 2>It basically tricks the software on your computer into making

31
00:01:14.480 --> 00:01:19.239
<v Speaker 2>bad decisions by changing code or data. So imagine you're

32
00:01:19.319 --> 00:01:21.920
<v Speaker 2>driving down a road and all of a sudden, all

33
00:01:21.959 --> 00:01:24.120
<v Speaker 2>the signs have been changed to point you in the

34
00:01:24.120 --> 00:01:27.840
<v Speaker 2>wrong direction. Oh, that's kind of what a root kit

35
00:01:27.840 --> 00:01:29.159
<v Speaker 2>does to your system. Wow.

36
00:01:29.519 --> 00:01:32.959
<v Speaker 1>Yeah, So it's not just sneaking malware in, it's like

37
00:01:33.239 --> 00:01:35.599
<v Speaker 1>manipulating what's already there exactly.

38
00:01:35.680 --> 00:01:38.319
<v Speaker 2>And they can manipulate a lot. They can hide files,

39
00:01:38.799 --> 00:01:42.640
<v Speaker 2>they can hide processes, network activity. They can even make

40
00:01:42.920 --> 00:01:46.319
<v Speaker 2>like forensic analysis tools like the tools designed to catch

41
00:01:46.359 --> 00:01:48.040
<v Speaker 2>them give false readings.

42
00:01:48.040 --> 00:01:50.120
<v Speaker 1>Hold on, even the tools that are designed to catch

43
00:01:50.159 --> 00:01:51.200
<v Speaker 1>them can be fooled.

44
00:01:51.280 --> 00:01:54.760
<v Speaker 2>Yeah, that's it's a little unnervous, making me nervous.

45
00:01:55.040 --> 00:01:58.319
<v Speaker 1>And what makes root kits even more dangerous is that

46
00:01:58.319 --> 00:02:01.159
<v Speaker 1>they're often used for long term intelligence gathering.

47
00:02:01.439 --> 00:02:04.719
<v Speaker 2>So imagine like someone having access to everything you type, Yeah,

48
00:02:04.840 --> 00:02:08.639
<v Speaker 2>every file you access for months or even years without

49
00:02:08.680 --> 00:02:11.719
<v Speaker 2>you ever suspecting a thing. Oh gosh, that's the level

50
00:02:11.719 --> 00:02:12.840
<v Speaker 2>of stealth we're talking about here.

51
00:02:12.879 --> 00:02:15.039
<v Speaker 1>Okay, now I see why this is such a big deal.

52
00:02:15.479 --> 00:02:19.240
<v Speaker 1>But how how do these attackers even get these rootkits

53
00:02:19.319 --> 00:02:20.960
<v Speaker 1>on our systems in the first place.

54
00:02:21.479 --> 00:02:25.360
<v Speaker 2>So think of your computer system like a fortress. Okay,

55
00:02:25.599 --> 00:02:31.879
<v Speaker 2>it's got walls, guards, defenses, but attackers they only need

56
00:02:31.919 --> 00:02:36.280
<v Speaker 2>to find one single week spot to get in. And

57
00:02:36.319 --> 00:02:39.280
<v Speaker 2>these week spots are often like software exploits. Okay, and

58
00:02:39.319 --> 00:02:42.520
<v Speaker 2>one of those is called a buffer overflow buffer overflows.

59
00:02:42.599 --> 00:02:43.919
<v Speaker 1>Yeah, that sounds familiar.

60
00:02:44.000 --> 00:02:45.280
<v Speaker 2>Yeah, you've probably heard that before.

61
00:02:45.280 --> 00:02:47.240
<v Speaker 1>It is not like a coding error, it is.

62
00:02:47.319 --> 00:02:50.759
<v Speaker 2>Yeah, it's a vulnerability that occurs in certain programming languages

63
00:02:50.800 --> 00:02:54.000
<v Speaker 2>like C or C plus plus. And the scary part is,

64
00:02:54.120 --> 00:02:57.520
<v Speaker 2>even if a vulnerability is known, yeah, and a patch

65
00:02:57.599 --> 00:03:01.400
<v Speaker 2>is available, it often takes a long time for like

66
00:03:01.520 --> 00:03:05.560
<v Speaker 2>everyone to update their systems, So these exploits, they can

67
00:03:05.599 --> 00:03:07.960
<v Speaker 2>remain a threat for quite a while. Yeah, and that

68
00:03:08.000 --> 00:03:10.039
<v Speaker 2>gives attackers plenty of opportunity.

69
00:03:10.319 --> 00:03:12.879
<v Speaker 1>Oh gosh, they're just kind of like waiting for us

70
00:03:12.919 --> 00:03:14.639
<v Speaker 1>to slip up in a wait.

71
00:03:14.719 --> 00:03:18.080
<v Speaker 2>Yeah, and there's this thing called a silently patched bug.

72
00:03:18.240 --> 00:03:19.879
<v Speaker 1>A silently patched.

73
00:03:19.680 --> 00:03:24.319
<v Speaker 2>Bug, Yeah, imagine a flaw being fixed without any public announcement.

74
00:03:25.280 --> 00:03:28.639
<v Speaker 2>So even like security experts might not know about it. Whoa,

75
00:03:29.599 --> 00:03:31.840
<v Speaker 2>and that leaves systems vulnerable.

76
00:03:31.479 --> 00:03:36.560
<v Speaker 1>So vulnerabilities can be fixed without anybody knowing. That seems counterintuitive. Yeah,

77
00:03:36.599 --> 00:03:38.680
<v Speaker 1>if we don't know about a flaw, how are we

78
00:03:38.680 --> 00:03:40.639
<v Speaker 1>supposed to protect ourselves from it.

79
00:03:40.639 --> 00:03:41.680
<v Speaker 2>It's a tricky balance.

80
00:03:41.960 --> 00:03:42.439
<v Speaker 1>Yeah.

81
00:03:42.479 --> 00:03:46.039
<v Speaker 2>Sometimes, like revealing a vulnerability can make it easier for

82
00:03:46.080 --> 00:03:49.759
<v Speaker 2>attackers to exploit it before a patch is widely deployed,

83
00:03:50.039 --> 00:03:51.280
<v Speaker 2>so it's like a race against time.

84
00:03:51.560 --> 00:03:54.159
<v Speaker 1>Okay, I'm starting to see the complexities here. Yeah, but

85
00:03:54.240 --> 00:03:56.840
<v Speaker 1>let's shift gears a bit. Okay, how do these root

86
00:03:56.960 --> 00:04:01.240
<v Speaker 1>kits manage to stay hidden once the inside? How do

87
00:04:01.240 --> 00:04:02.159
<v Speaker 1>they avoid detection?

88
00:04:02.599 --> 00:04:06.800
<v Speaker 2>So to understand that, you got to talk about rings rings. Yeah,

89
00:04:06.800 --> 00:04:10.120
<v Speaker 2>in computer architecture, you could picture it like a hierarchy

90
00:04:10.159 --> 00:04:13.759
<v Speaker 2>of access. So like ring zero is the most privileged level.

91
00:04:14.000 --> 00:04:16.879
<v Speaker 2>It's called the kernel level. That's where the operating system

92
00:04:16.920 --> 00:04:21.639
<v Speaker 2>has ultimate control. Gotcha, And that's where rootkits aim to operate.

93
00:04:21.959 --> 00:04:24.519
<v Speaker 2>Oh wow, above most security tools.

94
00:04:24.639 --> 00:04:26.600
<v Speaker 1>So they're trying to get like top secret clearance.

95
00:04:26.759 --> 00:04:30.040
<v Speaker 2>Yeah. Basically they're trying to get the highest level of clearance. Yeah,

96
00:04:30.079 --> 00:04:34.240
<v Speaker 2>which makes them almost invisible and really difficult to remove.

97
00:04:34.560 --> 00:04:36.000
<v Speaker 1>Okay, Yeah, from.

98
00:04:35.920 --> 00:04:39.519
<v Speaker 2>Ring zero, they can manipulate the Windows kernel in very

99
00:04:39.560 --> 00:04:43.000
<v Speaker 2>sophisticated ways. Okay, they're two main techniques we got to

100
00:04:43.000 --> 00:04:45.959
<v Speaker 2>talk about, Okay, hooking and DKO.

101
00:04:45.879 --> 00:04:49.199
<v Speaker 1>Hooking and DKO DKO Okay, those sound like they're out

102
00:04:49.199 --> 00:04:52.279
<v Speaker 1>of a spy movie. Yeah right, yeah, break it down

103
00:04:52.360 --> 00:04:52.600
<v Speaker 1>for me.

104
00:04:53.279 --> 00:04:57.920
<v Speaker 2>So imagine intercepting a phone call, okay, listening in on

105
00:04:57.959 --> 00:05:03.079
<v Speaker 2>the conversation and potentially even altering what's being said. Oh wow,

106
00:05:03.199 --> 00:05:06.319
<v Speaker 2>that's essentially what hooking does. It allows a root kit

107
00:05:06.959 --> 00:05:10.720
<v Speaker 2>to intercept system calls. Those are those requests that are

108
00:05:10.720 --> 00:05:13.360
<v Speaker 2>made to the operating system, so it can filter information,

109
00:05:13.439 --> 00:05:17.319
<v Speaker 2>redirect actions, basically control what the system's doing. Wow.

110
00:05:17.839 --> 00:05:20.120
<v Speaker 1>Yeah, that's incredibly sneaky.

111
00:05:20.480 --> 00:05:23.800
<v Speaker 2>Yeah it is. What about DECO, So DECOM stands for

112
00:05:24.040 --> 00:05:25.839
<v Speaker 2>direct kernel object manipulation.

113
00:05:26.519 --> 00:05:27.040
<v Speaker 1>Geez.

114
00:05:27.439 --> 00:05:31.319
<v Speaker 2>It's about going behind the scenes, changing the script. The

115
00:05:31.399 --> 00:05:35.279
<v Speaker 2>Windows kernel uses these data structures called objects to manage

116
00:05:35.319 --> 00:05:40.160
<v Speaker 2>things like okay, processes, drivers, and other resources.

117
00:05:40.240 --> 00:05:43.560
<v Speaker 1>So these objects are like blueprints for the operating system.

118
00:05:43.639 --> 00:05:45.519
<v Speaker 2>That's a great way to put it, Okay. Yeah, and

119
00:05:45.600 --> 00:05:50.480
<v Speaker 2>DKOM allows root kits to directly modify these kernel objects,

120
00:05:51.319 --> 00:05:55.000
<v Speaker 2>essentially like rewriting the blueprint, so they can hide processes

121
00:05:55.079 --> 00:05:58.240
<v Speaker 2>from the task manager. They can elevate their own privileges

122
00:05:58.600 --> 00:06:01.759
<v Speaker 2>or even falsify information that's recorded in event logs.

123
00:06:02.120 --> 00:06:05.240
<v Speaker 1>So with DKOM, they're not just spying on the system,

124
00:06:05.279 --> 00:06:08.079
<v Speaker 1>they're like changing it at a fundamental level, covering their

125
00:06:08.120 --> 00:06:12.720
<v Speaker 1>tracks actively and making it look like nothing suspicious ever happen. Right,

126
00:06:12.959 --> 00:06:14.160
<v Speaker 1>that's just mind blowing.

127
00:06:14.279 --> 00:06:18.639
<v Speaker 2>It's definitely a testament to the ingenuity, albeit malicious, of

128
00:06:18.680 --> 00:06:22.920
<v Speaker 2>these rootkit developers. Yeah, and we've only just scratched the

129
00:06:22.959 --> 00:06:26.800
<v Speaker 2>surface here. Oh no, there are even more sophisticated techniques,

130
00:06:27.000 --> 00:06:30.279
<v Speaker 2>okay that they use, and we'll delve into those next.

131
00:06:30.360 --> 00:06:35.120
<v Speaker 1>All right, my mind is officially blown. DKOM hooking, manipulating

132
00:06:35.279 --> 00:06:41.000
<v Speaker 1>kernel objects like these root kits are playing puppet master

133
00:06:41.120 --> 00:06:42.279
<v Speaker 1>with our entile system.

134
00:06:42.399 --> 00:06:43.360
<v Speaker 2>It is pretty amazing.

135
00:06:43.680 --> 00:06:45.959
<v Speaker 1>But you mentioned that there are even more techniques, and

136
00:06:46.000 --> 00:06:49.000
<v Speaker 1>I have to admit I'm both terrified and like morbidly

137
00:06:49.079 --> 00:06:51.600
<v Speaker 1>curious to hear more. What else do they have up

138
00:06:51.600 --> 00:06:52.199
<v Speaker 1>their sleeves?

139
00:06:52.600 --> 00:06:56.040
<v Speaker 2>So remember how we talked about root kits potentially disguising

140
00:06:56.079 --> 00:07:00.360
<v Speaker 2>themselves as legitimate drivers, right right, that's a technique called

141
00:07:00.480 --> 00:07:01.439
<v Speaker 2>layered drivers.

142
00:07:01.680 --> 00:07:02.639
<v Speaker 1>Layered drivers.

143
00:07:02.800 --> 00:07:08.079
<v Speaker 2>Yeah, so imagine a root kitkay, masquerading as like a

144
00:07:08.120 --> 00:07:11.519
<v Speaker 2>harmless driver, hm, like one that controls your keyboard. It

145
00:07:11.680 --> 00:07:14.959
<v Speaker 2>sits there silently recording every single keystroke you make.

146
00:07:15.040 --> 00:07:17.160
<v Speaker 1>Oh gosh, so it's like a wolf in sheep's clothing.

147
00:07:17.319 --> 00:07:17.839
<v Speaker 2>Exactly.

148
00:07:18.000 --> 00:07:22.839
<v Speaker 1>It looks totally innocent, but it's secretly carrying out malicious

149
00:07:22.879 --> 00:07:24.000
<v Speaker 1>activities exactly.

150
00:07:24.040 --> 00:07:27.360
<v Speaker 2>And these layered drivers can intercept all sorts of requests,

151
00:07:27.360 --> 00:07:31.000
<v Speaker 2>not just keystrokes. Wow, they can capture sensitive data, oh,

152
00:07:31.279 --> 00:07:35.480
<v Speaker 2>manipulate network traffic, even control other devices connected to your system.

153
00:07:35.680 --> 00:07:38.600
<v Speaker 1>It's amazing how they can twist something that's supposed to

154
00:07:38.639 --> 00:07:42.040
<v Speaker 1>be helpful, like a driver, and into something so malicious

155
00:07:42.240 --> 00:07:44.879
<v Speaker 1>it is. Yeah, but you also mentioned that some root

156
00:07:44.959 --> 00:07:49.120
<v Speaker 1>kits can even manipulate the hardware itself. That sounds almost impossible.

157
00:07:49.279 --> 00:07:52.439
<v Speaker 2>Yeah, it's not as common as software based attacks, okay,

158
00:07:52.680 --> 00:07:56.560
<v Speaker 2>but skilled attackers can take advantage of vulnerabilities in the

159
00:07:56.600 --> 00:07:59.920
<v Speaker 2>hardware or the firmware. Remember how we talked about the BIOS.

160
00:07:59.720 --> 00:08:01.680
<v Speaker 1>Right basic input output system.

161
00:08:01.759 --> 00:08:04.839
<v Speaker 2>Yeah, that controls the hardware during the boot process. Well,

162
00:08:04.920 --> 00:08:08.360
<v Speaker 2>imagine a root kit infecting the BIOS itself. Oh wow,

163
00:08:08.480 --> 00:08:13.279
<v Speaker 2>it could execute malicious code before the operating system even starts, jeez,

164
00:08:13.319 --> 00:08:16.720
<v Speaker 2>give it complete control over the system. Wow, and make

165
00:08:16.759 --> 00:08:19.680
<v Speaker 2>it incredibly difficult to detect or remove.

166
00:08:19.920 --> 00:08:23.199
<v Speaker 1>Hold on you're saying, even if you completely wipe your

167
00:08:23.240 --> 00:08:27.959
<v Speaker 1>hard drive right and reinstall your operating system like from scratch,

168
00:08:28.720 --> 00:08:31.839
<v Speaker 1>the root kit could still be there potentially. Yeah, hiding

169
00:08:31.879 --> 00:08:32.600
<v Speaker 1>in the bios.

170
00:08:32.679 --> 00:08:35.080
<v Speaker 2>That's the scary part. Oh my gosh, it's like a

171
00:08:35.159 --> 00:08:38.480
<v Speaker 2>virus that infected like the foundation of your house. Wow.

172
00:08:38.720 --> 00:08:42.320
<v Speaker 2>And even less common, but equally troubling are attacks that

173
00:08:42.440 --> 00:08:46.159
<v Speaker 2>exploit like the physical quirks of the hardware itself.

174
00:08:46.200 --> 00:08:47.080
<v Speaker 1>Physical quirks.

175
00:08:47.120 --> 00:08:49.720
<v Speaker 2>Yeah, think of it like finding a secret compartment in

176
00:08:49.759 --> 00:08:53.360
<v Speaker 2>a piece of furniture. They can hide data or code

177
00:08:54.000 --> 00:08:57.399
<v Speaker 2>in a physical location within the hardware. Wow, making it

178
00:08:57.480 --> 00:09:00.480
<v Speaker 2>practically invisible to like software based secure tools.

179
00:09:00.639 --> 00:09:02.120
<v Speaker 1>Okay, now I'm officially creeped out.

180
00:09:02.279 --> 00:09:03.279
<v Speaker 2>Yeah, it's pretty well.

181
00:09:03.320 --> 00:09:05.600
<v Speaker 1>It's like they're finding ways to hide in the shadows,

182
00:09:05.919 --> 00:09:08.679
<v Speaker 1>places we don't even know to look exactly. But let's

183
00:09:08.679 --> 00:09:10.960
<v Speaker 1>shift gears for a second and talk about those covert

184
00:09:11.080 --> 00:09:15.120
<v Speaker 1>channels you mentioned earlier. You compared it to stiganography hiding

185
00:09:15.159 --> 00:09:17.799
<v Speaker 1>a message in plane sight. Can you give me some

186
00:09:17.879 --> 00:09:21.120
<v Speaker 1>concrete examples of how these covert channels work certainly.

187
00:09:21.200 --> 00:09:25.799
<v Speaker 2>So imagine a company that has a strict firewall that

188
00:09:25.840 --> 00:09:31.000
<v Speaker 2>blocks all out going traffic except for DNS requests. Okay,

189
00:09:31.159 --> 00:09:34.840
<v Speaker 2>those requests your computer makes to translate domain names into

190
00:09:35.240 --> 00:09:36.200
<v Speaker 2>IP addresses.

191
00:09:36.360 --> 00:09:39.360
<v Speaker 1>Okay, So the firewalls like a security guard exactly, only

192
00:09:39.440 --> 00:09:41.600
<v Speaker 1>letting certain traffic through the gate.

193
00:09:41.759 --> 00:09:47.399
<v Speaker 2>Exactly. Now, a root kit could manipulate those dnt's requests

194
00:09:47.919 --> 00:09:49.799
<v Speaker 2>to sneak data out of the network.

195
00:09:50.000 --> 00:09:50.639
<v Speaker 1>Wow.

196
00:09:50.840 --> 00:09:55.159
<v Speaker 2>It could embed hidden information within the domain names being requested.

197
00:09:55.240 --> 00:09:58.440
<v Speaker 2>Oh gosh, or like subtly alter the timing of those

198
00:09:58.480 --> 00:09:59.879
<v Speaker 2>requests to encode.

199
00:10:00.440 --> 00:10:04.120
<v Speaker 1>So they're hijacking legitimate traffic. This smuggle data out right

200
00:10:04.200 --> 00:10:05.279
<v Speaker 1>under the firewalls. Nose.

201
00:10:05.399 --> 00:10:07.519
<v Speaker 2>That's one way to do it. Yeah. Because DNS traffic

202
00:10:07.600 --> 00:10:10.559
<v Speaker 2>is typically allowed through firewalls, it can be an effective

203
00:10:10.600 --> 00:10:13.320
<v Speaker 2>way to bypass those security measures. Wow.

204
00:10:13.759 --> 00:10:17.879
<v Speaker 1>That's both incredibly clever and incredibly unsettling.

205
00:10:18.279 --> 00:10:18.679
<v Speaker 2>It is.

206
00:10:19.000 --> 00:10:21.759
<v Speaker 1>Are there any other covert channel tricks they use?

207
00:10:22.039 --> 00:10:25.960
<v Speaker 2>Oh yeah, there are many. They can manipulate the timing

208
00:10:26.039 --> 00:10:31.120
<v Speaker 2>of network packets, So imagine subtly delaying or speeding up

209
00:10:31.159 --> 00:10:36.120
<v Speaker 2>the transmission of packets to encode data. Wow, it's kind

210
00:10:36.120 --> 00:10:39.159
<v Speaker 2>of like setting a secret message in morse code using

211
00:10:39.200 --> 00:10:40.279
<v Speaker 2>the timing of those packets.

212
00:10:40.279 --> 00:10:44.200
<v Speaker 1>It's fascinating how they can twist these like mundane technical

213
00:10:44.279 --> 00:10:49.120
<v Speaker 1>details it is, into tools for covert communication.

214
00:10:49.240 --> 00:10:51.879
<v Speaker 2>Yeah, it's like they're speaking a secret language. Yeah, that's

215
00:10:51.960 --> 00:10:53.919
<v Speaker 2>hidden within the normal flow of data.

216
00:10:53.960 --> 00:10:57.559
<v Speaker 1>And that's what makes covert channels so difficult to detect exactly.

217
00:10:57.639 --> 00:11:01.039
<v Speaker 2>They're designed to blend in to look like network activity.

218
00:11:01.120 --> 00:11:03.200
<v Speaker 1>Okay, I have to admit I'm starting to feel a

219
00:11:03.240 --> 00:11:06.159
<v Speaker 1>little overwhelmed by all of this. It's like we're dealing

220
00:11:06.200 --> 00:11:11.600
<v Speaker 1>with a phantom enemy, you know, constantly shifting, hiding, operating

221
00:11:11.639 --> 00:11:14.519
<v Speaker 1>in ways we can barely comprehend. Is there any hope

222
00:11:14.559 --> 00:11:17.759
<v Speaker 1>of detecting these things? Or are we just fighting a

223
00:11:17.840 --> 00:11:20.039
<v Speaker 1>losing battle. I don't know about you, but after all

224
00:11:20.039 --> 00:11:24.000
<v Speaker 1>that talk about you know, yeah, secret compartments and morse

225
00:11:24.080 --> 00:11:29.799
<v Speaker 1>code hidden in you know, network packets, I'm ready for

226
00:11:29.840 --> 00:11:30.519
<v Speaker 1>some good news.

227
00:11:30.639 --> 00:11:30.879
<v Speaker 2>Okay.

228
00:11:31.679 --> 00:11:34.960
<v Speaker 1>Is there any way to fight back against these phantom

229
00:11:35.159 --> 00:11:38.960
<v Speaker 1>root kits or are we doomed to live in a

230
00:11:39.000 --> 00:11:43.080
<v Speaker 1>world where, like our computers are secretly controlled by unseen forces.

231
00:11:43.159 --> 00:11:46.960
<v Speaker 2>It's not a hopeless situation, Okay, though I understand why

232
00:11:47.039 --> 00:11:49.600
<v Speaker 2>you might feel that way. Think of it like this. Okay,

233
00:11:49.679 --> 00:11:51.679
<v Speaker 2>we may not be able to see the wind, but

234
00:11:51.759 --> 00:11:54.799
<v Speaker 2>we can see the effects it has. Same with rude kits,

235
00:11:55.240 --> 00:11:58.679
<v Speaker 2>even if they're invisible, they leave traces, okay, and we've

236
00:11:58.720 --> 00:12:01.080
<v Speaker 2>gotten pretty good at spawting thes.

237
00:12:00.559 --> 00:12:02.759
<v Speaker 1>Okay, so what kind of traces are we talking about here?

238
00:12:02.799 --> 00:12:05.440
<v Speaker 2>So one powerful technique is called integrity checking.

239
00:12:05.600 --> 00:12:07.360
<v Speaker 1>Integrity checking, yeah, okay.

240
00:12:07.440 --> 00:12:09.600
<v Speaker 2>Imagine taking a snapshot of your system when you know

241
00:12:09.639 --> 00:12:14.360
<v Speaker 2>it's clean, according like key files, configurations, even the structure

242
00:12:14.399 --> 00:12:17.000
<v Speaker 2>of those critical data structures we talked about. Okay, Then

243
00:12:17.080 --> 00:12:20.159
<v Speaker 2>later you compare the current state of your system to

244
00:12:20.279 --> 00:12:21.519
<v Speaker 2>that pristine snapshot.

245
00:12:21.879 --> 00:12:25.840
<v Speaker 1>So any unexpected changes could be like a red flag, exact,

246
00:12:25.840 --> 00:12:28.440
<v Speaker 1>a sign that a rootkit might have like snuck in

247
00:12:28.519 --> 00:12:30.519
<v Speaker 1>and tampered with something exactly.

248
00:12:30.600 --> 00:12:34.039
<v Speaker 2>And the tools for doing this are getting incredibly sophisticated.

249
00:12:34.279 --> 00:12:34.879
<v Speaker 1>Wow.

250
00:12:35.360 --> 00:12:39.159
<v Speaker 2>They can detect even the tiniest modification, Okay, whether it's

251
00:12:39.159 --> 00:12:42.879
<v Speaker 2>a file being added, a ridgetry key being changed, or

252
00:12:42.919 --> 00:12:44.799
<v Speaker 2>even a single bit flipped in memory.

253
00:12:44.960 --> 00:12:48.080
<v Speaker 1>That's pretty impressive. Yeah, but I'm guessing these root kits

254
00:12:48.120 --> 00:12:51.559
<v Speaker 1>are designed to be like super stealthy, right, are there

255
00:12:51.600 --> 00:12:54.440
<v Speaker 1>ways that they can like bypass these integrity checks.

256
00:12:54.720 --> 00:12:57.720
<v Speaker 2>Yeah. So a sophisticated root kit, yeah, might try to

257
00:12:57.799 --> 00:13:01.639
<v Speaker 2>tamper with the snapshot itself ouck, or find clever ways

258
00:13:01.679 --> 00:13:05.240
<v Speaker 2>to like mask its modifications. It's a constant cat and

259
00:13:05.279 --> 00:13:08.080
<v Speaker 2>mouse game, of course. But we're not limited to just

260
00:13:08.120 --> 00:13:13.600
<v Speaker 2>looking at static snapshots. There's another powerful technique called behavioral analysis.

261
00:13:13.840 --> 00:13:18.120
<v Speaker 1>Behavioral analysis, okay, so instead of looking for specific changes,

262
00:13:18.639 --> 00:13:20.519
<v Speaker 1>we're looking at how the system is acting.

263
00:13:20.919 --> 00:13:23.919
<v Speaker 2>That's the gist of it, Okay, Yeah, imagine observing someone's

264
00:13:23.960 --> 00:13:27.759
<v Speaker 2>behavior to see if they're acting suspiciously. In the context

265
00:13:27.799 --> 00:13:31.799
<v Speaker 2>of rootkits, we're looking for unusual patterns of activity, like

266
00:13:31.919 --> 00:13:37.759
<v Speaker 2>unexpected network connections, processes hogging resources, or files being accessed

267
00:13:37.759 --> 00:13:38.600
<v Speaker 2>at odd times.

268
00:13:38.799 --> 00:13:41.720
<v Speaker 1>So if a program starts acting strange, it could be

269
00:13:41.759 --> 00:13:43.720
<v Speaker 1>a sign that, like a root kit is pulling the

270
00:13:43.759 --> 00:13:44.759
<v Speaker 1>strings exactly.

271
00:13:45.320 --> 00:13:49.159
<v Speaker 2>And we have these amazing behavioral analysis tools that can

272
00:13:49.240 --> 00:13:52.799
<v Speaker 2>learn what's normal for a system and then flag anything

273
00:13:52.840 --> 00:13:54.240
<v Speaker 2>that deviates from that baseline.

274
00:13:54.279 --> 00:13:57.080
<v Speaker 1>So it's like having a digital detective constantly watching for

275
00:13:57.120 --> 00:13:58.200
<v Speaker 1>suspicious activity.

276
00:13:58.320 --> 00:14:01.120
<v Speaker 2>I like that analogy. Yeah, of course, a really clever

277
00:14:01.200 --> 00:14:05.679
<v Speaker 2>root kit might try to mimic normal behavior or operate

278
00:14:05.759 --> 00:14:09.519
<v Speaker 2>so subtly that it doesn't trigger any alarms. That's why

279
00:14:09.519 --> 00:14:12.240
<v Speaker 2>we can't rely on any single technique.

280
00:14:12.279 --> 00:14:15.080
<v Speaker 1>You keep mentioning this cat and mouse game. It feels

281
00:14:15.120 --> 00:14:18.960
<v Speaker 1>a bit daunting, to be honest. Are we just constantly

282
00:14:19.000 --> 00:14:24.080
<v Speaker 1>reacting to whatever new trick the attackers come up with.

283
00:14:24.279 --> 00:14:27.440
<v Speaker 2>Well, there's always that element of reaction, but we're also

284
00:14:27.679 --> 00:14:31.000
<v Speaker 2>getting much better at proactive defense. One of the most

285
00:14:31.039 --> 00:14:35.039
<v Speaker 2>important things is keeping your systems up to date, patching

286
00:14:35.120 --> 00:14:38.159
<v Speaker 2>those vulnerabilities before attackers can exploit them.

287
00:14:38.279 --> 00:14:41.559
<v Speaker 1>Right, patching, but it seems like there's always a new update,

288
00:14:42.200 --> 00:14:44.799
<v Speaker 1>a new patch to install. Is it really worth the effort?

289
00:14:44.960 --> 00:14:48.480
<v Speaker 2>It's absolutely crucial. Think of it like locking your doors

290
00:14:48.480 --> 00:14:52.559
<v Speaker 2>and windows. Sure it's a bit of a chore, but

291
00:14:52.720 --> 00:14:55.720
<v Speaker 2>it makes it much harder for someone to break in. Okay,

292
00:14:55.919 --> 00:14:58.200
<v Speaker 2>And it's not just the operating system. You need to

293
00:14:58.279 --> 00:15:02.000
<v Speaker 2>keep all your applications plug in yea, browser, extensions, everything

294
00:15:02.080 --> 00:15:04.960
<v Speaker 2>up to date. Oh gosh, they can all be potential

295
00:15:05.120 --> 00:15:06.480
<v Speaker 2>entry points for attackers.

296
00:15:06.679 --> 00:15:09.519
<v Speaker 1>So patching is like building a strong foundation so that

297
00:15:09.559 --> 00:15:13.039
<v Speaker 1>those rootkits can't even get a foothold in the first place. Okay, cool,

298
00:15:13.120 --> 00:15:13.879
<v Speaker 1>What else can we do.

299
00:15:14.080 --> 00:15:18.919
<v Speaker 2>Another essential layer is having strong security software okay, particularly

300
00:15:19.039 --> 00:15:22.879
<v Speaker 2>endpoint detection and response solutions okay or EDRs.

301
00:15:23.200 --> 00:15:23.679
<v Speaker 1>EDRs.

302
00:15:24.080 --> 00:15:27.879
<v Speaker 2>These go beyond traditional antivirus okay. They monitor your system

303
00:15:27.919 --> 00:15:30.720
<v Speaker 2>in real time and use that behavioral analysis we talked

304
00:15:30.720 --> 00:15:33.799
<v Speaker 2>about to spot and block malicious activity.

305
00:15:34.039 --> 00:15:36.879
<v Speaker 1>So it's like having a security system with motion sensors

306
00:15:36.879 --> 00:15:40.399
<v Speaker 1>and alarms constantly on the lookout or anything suspicious.

307
00:15:40.440 --> 00:15:44.240
<v Speaker 2>And a good EDR can also help you remediate an attack. Okay,

308
00:15:44.399 --> 00:15:48.759
<v Speaker 2>So like isolating infected systems, cleaning up the malware, yeah,

309
00:15:48.799 --> 00:15:50.519
<v Speaker 2>and getting things back to a secure state.

310
00:15:50.600 --> 00:15:53.919
<v Speaker 1>That's good to hear. Yeah, so we've got patching security software.

311
00:15:54.200 --> 00:15:56.159
<v Speaker 1>Is there anything else we can do to protect ourselves?

312
00:15:56.320 --> 00:15:58.919
<v Speaker 1>Or are those kind of the main pillars of defense?

313
00:15:59.279 --> 00:16:02.639
<v Speaker 2>There is one, and it might be the most important

314
00:16:02.639 --> 00:16:04.679
<v Speaker 2>of all, user education.

315
00:16:05.039 --> 00:16:05.559
<v Speaker 1>Oh right.

316
00:16:06.279 --> 00:16:09.639
<v Speaker 2>Many root can infections start with social engineering tricks like

317
00:16:09.679 --> 00:16:14.879
<v Speaker 2>phishing emails, malicious links, downloads from shady websites. We need

318
00:16:14.919 --> 00:16:17.639
<v Speaker 2>to be smarter about what we click on and where

319
00:16:17.639 --> 00:16:18.759
<v Speaker 2>we download things from.

320
00:16:18.840 --> 00:16:22.159
<v Speaker 1>So it's not just about technology, it's about being aware,

321
00:16:23.159 --> 00:16:25.480
<v Speaker 1>being cautious, not falling.

322
00:16:25.120 --> 00:16:28.600
<v Speaker 2>For those tricks exactly. Educate yourself and your team about

323
00:16:29.039 --> 00:16:33.639
<v Speaker 2>common attack vectors and always be skeptical. If something seems

324
00:16:33.639 --> 00:16:35.559
<v Speaker 2>too good to be true, it probably is.

325
00:16:35.919 --> 00:16:39.600
<v Speaker 1>This has been an incredible journey, to say the least,

326
00:16:39.759 --> 00:16:40.120
<v Speaker 1>it has.

327
00:16:40.240 --> 00:16:40.480
<v Speaker 2>Yeah.

328
00:16:40.639 --> 00:16:43.960
<v Speaker 1>Root kits are terrifying. Yeah, but now I feel like

329
00:16:44.000 --> 00:16:47.759
<v Speaker 1>I have a better understanding of the threat and what

330
00:16:47.799 --> 00:16:48.919
<v Speaker 1>we can do to fight back.

331
00:16:49.120 --> 00:16:51.759
<v Speaker 2>Good. I'm glad to hear that. Yeah. Remember, it's an

332
00:16:51.799 --> 00:16:56.960
<v Speaker 2>ongoing challenge. The cybersecurity landscape is constantly changing. But by

333
00:16:57.000 --> 00:17:01.759
<v Speaker 2>staying informed, yeah, keeping our defenses strong, and never letting

334
00:17:01.799 --> 00:17:04.359
<v Speaker 2>our guard down, we can stay ahead of the curve.

335
00:17:04.599 --> 00:17:07.839
<v Speaker 1>Well said. Yeah, and to all of our listeners out there,

336
00:17:08.039 --> 00:17:10.880
<v Speaker 1>thanks for joining us on this deep dive into the

337
00:17:10.920 --> 00:17:12.000
<v Speaker 1>world of root kits.

338
00:17:12.279 --> 00:17:12.920
<v Speaker 2>Thanks for listening.

339
00:17:13.000 --> 00:17:17.039
<v Speaker 1>Everybody, Stay safe, stay vigilant, and keep those systems patched.