It took some time but now x64 Windows operating systems are
officially the new target of rootkits.
We talked about TDL3 rootkit
some months ago as
the most advanced rootkit ever seen in the wild. Well, the last version of TDL3 was released months ago and documented as build 3.273. After that, no updates have been released to the rootkit driver. This was pretty suspicious, more so if you've been used to seeing rebuild versions of TDL3 rootkit every few days to defeat security software.
Obviously, the rootkit was stable and it is currently running without any major bug on every 32 bit Windows operating system. Still though, the dropper needed administrator rights to install the infection in the system. Anyway, the team behind TDL3 rootkit was
just too quiet to not expect something new.
They actually built a nice gift for every security vendor, because TDL3 has been updated and this time this is a major update; the rootkit is
now able to infect 64 bit versions of Microsoft Windows operating system.
Why this is a worrying and important news? x64 versions of Windows are considered much more secure than their respective 32 bit versions because of some advanced security features which are intended to make it more difficult getting into kernel mode and hooking the Windows's kernel.
Windows Vista 64 bit and Windows 7 64 don't allow every driver to get into kernel memory region due to
a very strict digital signature check. If the driver has not been digitally signed, Windows
won't allow it to be loaded. This first technique allowed Windows to block every kernel mode rootkit from being loaded, because malwares aren't usually signed - at least, they shouldn't be.
The second technique used by Microsoft Windows to prevent kernel mode drivers from alterating Windows kernel behavior is the infamous
Kernel Patch Protection, also known as
PatchGuard. This security routine blocks every kernel mode driver from alterating sensitive areas of the Windows kernel - e.g. SSDT, IDT, kernel code.
