BREAKING IN AND KEEPING OUT

Of all the most devilish creations in the history of cyber crime, the rootkit is perhaps the most ingenious. A rootkit is a bundle of tools for the network intruder. An attacker who gains access to a computer can upload the rootkit and use the tools to gain control of the system. One interesting aspect of a rootkit is its ability to cover the intruder’s tracks. Doctored-up versions of common monitoring utilities such as netstat and ps hide any sign of the attack. Many, many rootkits were copied onto many computers around the world. But eventually, developers and security specialists grew wise to the ways of user space rootkits. Experts learned to detect the intruder’s presence by looking behind the standard Unix tools for evidence of changes. But rather than giving up, the intruders went on to something new. The kernel rootkit is a new generation of intrusion tool that weaves itself into the Linux system at a very deep level – below the reach of any userland detection tools. Armed with the kernel rootkit, the intruders again gained the upper hand – at least temporarily.