Staying one step ahead of the intruders
After detecting a rootkit, the only thing that really helps is to completely reinstall the infected system – the malicious software digs far too deep into a system to let you remove it with any degree of certainty. In this light, it makes sense to do everything you can to prevent a rootkit from compromising your system. Prevention is the only real answer – particularly, installing security patches. To prevent malware exploiting them, you need to make sure that you close all known vulnerabilities.
Latest and Greatest
The principle of using the latest software also applies to rootkit scanners. Zeppoo  is almost two years old, for example, and fails to detect any of the current crop of rootkits due to total ignorance of their approaches. It is probably best to leave Zeppoo where it is on SourceForge.
The next best obstacle is a firewall, preferably one that controls network traffic in all layers of the TCP/IP stack. For servers in hostile environments, the use of a static kernel and an intrusion detection tool such as OSSEC.
Keep in mind, however, that humans are possibly the biggest attack vector for rootkits. If a user is enticed by phishing mails or enlargement offers, the best security mechanisms are no doubt doomed to failure.
- Blue Pill: http://en.wikipedia.org/wiki/Blue_Pill%28malware%29
- Chkrootkit: http://www.chkrootkit.org
- Rootkit Hunter: http://htp://rkhunter.sf.net
- OSSEC: http://www.ossec.net
- Rootcheck signatures: http://www.ossec.net/rootkits
- RK Profiler LX: http://www.trapkit.de/research/rkprofiler/index.html
- Zeppoo: http://sourceforge.net/projects/zeppoo
Buy this article as PDF
Linux users can now download and install the Windows code editor
New initiative will address security and interoperability concerns around container technology.
Developers can use RHEL as a development platform without a subscription fee.
Windows users will soon have native access to the Bash shell.
Improvements to SMTP will provide better guarantee of confidentiality
Graphics vendor embraces new reality in Linux graphics
Pioneer Ray Tomlinson bequeathed the @ sign to billions of Internet users
Redmond says its classic database tool will run without Windows
New intrusion technique affects most non-Bluetooth wireless mice
GENIVI Alliance announces the release of the first beta of the GENIVI Demo Platform ivi9.