Rootkit

Description

A rootkit is defined by persistence and invisibility. It gives the attacker privileged access while concealing malicious processes, files and connections from security tools. The deeper it sits, the harder it is to remove: a rootkit in firmware or in the boot phase survives a reinstall of the operating system, because it lives in a lower layer of execution.

Because they do not operate in the same layer, a classic antivirus is a poor opponent. Detection is possible; removal is much harder. It is found by comparison against a trusted reference, by checking the integrity of the boot process, and by system behavior that does not match what the tools report. When a rootkit is suspected, the only reliable cleaning is a hard reset to factory settings, and in the worse cases replacing the hardware.

Examples

• In 2005 Sony BMG shipped music discs carrying a rootkit that installed itself and hid from the user. Its purpose was copy protection, but it took very little for attackers to catch the scent and turn it to their own use.
• LoJax was the first rootkit seen in practice to settle into UEFI firmware — it survived both a disk replacement and a system reinstall.
• A kernel rootkit hides the attacker's processes and network connections, so the administrator looks at a clean system while the malware operates beneath the security tools.

Notes

• A rootkit differs from a backdoor in that it actively hides its own presence and works from a layer ordinary protection mostly cannot reach.
• If the rootkit is in firmware or in the boot phase, reinstalling the system achieves nothing. Sometimes only replacing the hardware restores trust in the machine.