Rootkit Overview

[tonybradley]

Rootkits, as we know them now, came into being sometime in the mid 1990s. At that time, Sun operating system UNIX system administrators started seeing strange server behavior, missing disk space, CPU cycles and network connections that strangely did not show up in command netstat. By implementation technology, three main classes of Rootkits are available today: binary kits, kernel kits and library kits. The first class achieves its goal by replacing certain system files with their Trojan counterparts. The second uses kernel components (also called modules) or Trojans, and the third employs system library Trojans. Rootkits found in the wild (such as captured on Honeypots), often combine Trojaned binaries with higher "security" provided by the kernel and library components.

MORE

The paper is from iDefense and gives a pretty good description of the different types of rootkits and how they work.

[bludgeon]

Don't know why you got negged, just finished reading the paper, good read, thanks.

[tonybradley]

I got negged for bumping the message up without cause. I am not sure who negged me though. It was purely accidental- mouse was pointing at the wrong spot when I accidentally clicked the button. I didn't even know what the Bump Up button did.

Antipoints come and antipoints go- c'est la vie!

[tampabay420]

nice read, thanx

[gypsygeek]

Excellent.........that is why I come to this site.
Share the knowledge

Peace

GG

[PuReExcTacy]

Very useful and informative paper, thanks for the post.


PuRe