Rootkits

My name is John Sheesley. I'm senior editor for TechProGuild, and today I'm going to be talking to you about rootkits. It's hard enough as it is to deal with viruses and spyware, and all the other security threats on your network, but at least the anti-spyware and anti-virus software that we're using can detect and defeat them.

The whole idea behind rootkits is the fact that it is completely invisible to those countermeasures. Rootkits began on the Unix operating system, and then quickly moved over the Linux operating system. That wouldn't be so bad because these operating systems don't have a very large market share, but now hackers have pointed their rootkits to Windows. That means that just about anybody who's running Windows, which is about 99% of people on the Internet, are now vulnerable to rootkits.

So, how does a rootkit work? A rootkit integrates itself deep within your operating system, taking over bits and pieces of the operating system, and then hiding from anything which is trying to detect it. So, let's say that you have something on your operating system, like command.com, just a regular operating system file. The rootkit will go ahead and infect the file, and become part of it. If you go ahead and try and use some anti-virus software, or anti-spyware software against it, the rootkit does like kind of a little of a Jedi mind trick, telling the anti-virus, anti-spyware software, there are no droids here, move along. And the anti-virus and the anti-spyware software go, 'Okay.' In essence, what happens is a rootkit, much like this piece of paper, is completely invisible and no longer detected.

So, what do you do about rootkits? Fortunately, several vendors have created rootkit detectors. Some of the most popular rootkit detectors include Rootkit Revealer, Ghostbuster, and BlackLight. The way the detectors work is actually kind of ironic. They use the same tricks that rootkits do to hide from any virus and anti-software programs. But instead, they use those tricks against the rootkit itself. They hide themselves from the rootkit, so whenever the rootkit goes out to see if there is any detectors, it can't see them.

Now of course, rootkit hackers don't like that idea. They want to make sure that the rootkit can do its job, so they change the rootkits in order to be able to detect the rootkit detector. The detector software companies change their programs so they can detect the rootkits again. So you wind up in an ever-escalating arms race as the two fight each other in order to make sure that they gain superiority. That means it's very important that if you're using a rootkit detector that you have to have the most latest updates on your system, or else the rootkit just can't be seen.

Rootkits are going to be an increasing problem as we go forward. Because of the very nature of being invisible, it makes it difficult to make sure whether a problem that you're having is hardware, software or hidden rootkit. One of the most important things to remember is, is that just because you can't see a problem it doesn't mean that the problem doesn't exist.