Home Networking Kits

A rootkit is a set of software tools intended to conceal running processes, files or system data from the operating system. more...

Home
Cables, Connectors
Filers, Load Balancers
Home Networking, Cable & DSL
Cable & DSL Routers,...
Cable Modems
DSL Modems
Home Networking Kits
Phoneline Networking Kits
Powerline Networking Kits
Other Home Networking
Hubs
KVM Switch Boxes, Cables
Mainframe, DEC, VAX, AS/400
Network Interface Cards,...
Networking, Telecom Tools
Other Networking Equipment
Print Servers, Wired
Racks, Mounts & Patch Panels
Router Components, Memory
Routers, Wired
Security, Firewall, VPN
Server Components, Memory
Servers
Software
Software, Operating Systems
Storage Equipment, NAS, SAN
Switch Components, Memory
Switches
Telephone Systems, Telecom
UPS, Power Protection, APC
Wholesale Lots
Wireless Networking, WiFi
Workstation Components,...
Workstations, Terminals

Rootkits have their origin in relatively benign applications, but in recent years have been used increasingly by malware to help intruders maintain access to systems while avoiding detection. Rootkits exist for a variety of operating systems, such as Linux, Solaris and versions of Microsoft Windows. Rootkits often modify parts of the operating system or install themselves as drivers or kernel modules.

The word "rootkit" came to general public awareness in the 2005 Sony BMG CD copy protection scandal, in which Sony BMG music CDs surreptitiously placed a rootkit on Microsoft Windows PCs when the CD was played on the computer. Sony provided no mention of this on the CD or its packaging, referring only to security rights management measures.

Origins

The term "rootkit" (also written as "root kit") originally referred to a set of recompiled Unix tools such as "ps", "netstat", "w" and "passwd" that would carefully hide any trace of the intruder that those commands would normally display, thus allowing the intruders to maintain "root" on the system without the system administrator even seeing them.

Generally now the term is not restricted to Unix-based operating systems, as tools that perform a similar set of tasks now exist for non-Unix operating systems such as Microsoft Windows, regardless of the existence (or lack of existence) of a "root" in the operating system.

Common use

A rootkit's only purpose is to hide files, network connections, memory addresses, or registry entries from other programs. However, a rootkit may be incorporated with other files which have other purposes. It is important to note that the utilities bundled with the rootkit may be malicious in intent, but a rootkit is essentially a technology; it may be used for both productive and destructive purposes.

A rootkit is often used to hide utilities. These are often used to abuse a compromised system, include so-called "backdoors" to help the attacker subsequently access the system more easily. For example, the rootkit may hide an application that spawns a shell when the attacker connects to a particular network port on the system. Kernel rootkits may include similar functionality. A backdoor may also allow processes started by a non-privileged user to execute functions normally reserved for the superuser. All sorts of other tools useful for abuse can be hidden using rootkits. This includes tools for further attacks against computer systems which the compromised system communicates with, such as sniffers and keyloggers. A possible abuse is to use a compromised computer as a staging ground for further abuse (see zombie computer). This is often done to make the abuse appear to originate from the compromised system or network instead of the attacker. Tools for this can include denial-of-service attack tools, tools to relay chat sessions, and e-mail spam attacks. A major use for rootkits is allowing the programmer of the rootkit to see and access user names and log-in information for sites that require them. The programmer of the rootkit can store unique sets of log-in information from many different computers. This makes the rootkits extremely hazardous, as it allows trojans to access this personal information while the rootkit covers it up.

Read more at Wikipedia.org