Rootkits: The Hacker's Tool of Deceipt

     Botnets burst into notoriety over the past couple years with the discovery of a Trojan named Peacomm and nicknamed Storm by the research community. The Trojan was nicknamed Storm because of a common theme of the subject header contained in the e-mail that delivers the Trojan: "230 dead as storm batters Europe" (Hidalgo, 2007). Why is there so much concern over a simple e-mail?

Defining Rootkits

     The term rootkit is derived from the UNIX operating system, in which root is either the highest access privilege or directory level, depending on the context of use. When used in the context of a rootkit, root refers to the highest level of access to the system.

A rootkit is a set of software tools, originally recompiled UNIX tools, used by an intruder after gaining access to a computer system. It is used to conceal the processes, files or system data. This helps the intruder maintain access or maintain a ‘root’ to the system without being detected by the user or owner of the compromised system. Rootkits can be used effectively on many operating systems including Windows, Linux and Solaris. (Dowada, 2006).

In layman’s terms, a rootkit is a module injected into an operating system by a third party to take over specific tasks of the operating system and is not necessarily malicious in nature. The threat that rootkits pose is determined by the intentions of the hackers who use them. There are two basic types of rootkits: persistent and non-persistent rootkits. The difference between the two is that persistent rootkits have the ability to load and run following a system reboot whereas non-persistent rootkits do not. For the discussion of the threat of botnets, rootkits are assumed to be of the persistent type.