A rootkit is a collection of typically malicious computer software designed to enable access to a computer or to part of its software that would not otherwise be allowed (for example, by an unauthorized user). Rootkits often mask their presence or that of other software. The term rootkit is a compound of "root" (the traditional name of the privileged account on Unix-like operating systems) and the word "kit" (which refers to the software components that implement the tool). The term "rootkit" has negative connotations through its association with malware. Rootkit installation can be automated, or an attacker can install rootkit after having obtained root or administrator access. Obtaining this access is a result of direct attack on a system, i.e., exploiting a vulnerability (such as privilege escalation) or a password (obtained by cracking or social engineering tactics like "phishing"). Once installed, it becomes possible to hide the intrusion as well as to maintain privileged access. Full control over a system means that existing software can be modified, including software that might otherwise be used to detect or circumvent it. Rootkit detection is difficult because a rootkit may be able to subvert the software that is intended to find it. Detection methods include using an alternative and trusted operating system, behavior-based methods, signature scanning, difference scanning, and memory dump analysis. Removal can be complicated, especially in cases where the rootkit resides in the kernel; reinstallation of the operating system may be the only available solution to the problem. When dealing with firmware rootkits, removal may require hardware replacement, or specialized equipment.
History The term rootkit, rkit, or root kit originally referred to a maliciously modified set of administrative tools for a Unix-like operating system that granted "root" access. If an intruder could replace the standard administrative tools on a system with a rootkit, the intruder could obtain root access over the system whilst simultaneously concealing these activities from the legitimate system administrator. These first-generation rootkits were trivial to detect by using tools such as Tripwire that had not been compromised to access the same information. Lane Davis and Steven Dake wrote the earliest known rootkit in 1990 for Sun Microsystems' SunOS UNIX operating system. In the lecture he gave upon receiving the Turing Award in 1983, Ken Thompson of Bell Labs, one of the creators of Unix, theorized about subverting the C compiler in a Unix distribution and discussed the exploit. The modified compiler would detect attempts to compile the Unix login command and generate altered code that would accept not only the user's correct password, but an additional "backdoor" password known to the attacker. Additionally, the compiler would detect attempts to compile a new version of the compiler, and would insert the same exploits into the new compiler. A review of the source code for the login command or the updated compiler would not reveal any malicious code. This exploit was equivalent to a rootkit. The first documented computer virus to target the personal computer, discovered in 1986, used Helix Cloaking techniques to hide itself: the Brain virus intercepted attempts to read the boot sector, and redirected these to elsewhere on the disk, where a copy of the original boot sector was kept. Over time, DOS-virus cloaking methods became more sophisticated. Advanced techniques included hooking low-level disk INT 13H BIOS interrupt calls to hide unauthorized modifications to files. The first malicious rootkit for the Windows NT operating system appeared in 1999: a trojan called NTRootkit created by Greg Hoglund. It was followed by HackerDefender in 2003. The first rootkit targeting Mac OS X, WeaponX/Weapox, appeared in 2004 while the Stuxnet worm was the first to target programmable logic controllers (PLC).
Lenovo BIOS Rootkit (Lenovo Service Engine) Incident (2015) In mid-2015, it was discovered that Lenovo had been shipping certain consumer PCs with firmware that behaved like a built-in rootkit. The feature, called Lenovo Service Engine (LSE), was embedded in the system BIOS and would execute on startup, even before Windows booted. LSE was designed to ensure that Lenovo’s system update utility and related pre-installed programs remained installed by automatically reinstalling them if they were removed. Because it resided in firmware, the code was difficult for users to detect or remove; even a clean Windows installation would not eliminate LSE, as it would be reinstalled on the next reboot. Researchers later discovered that LSE introduced a serious security issue – a vulnerability allowing a privilege escalation attack (via a buffer overflow) to gain administrator-level control. In response, Lenovo released BIOS updates and a removal utility in 2015 to disable and delete the LSE feature. Microsoft also updated its Windows security guidelines to bar such firmware behavior, effectively forcing Lenovo to cease using LSE in new systems. The LSE functionality was removed from subsequent models, and Lenovo urged customers to install the updated firmware to eliminate the risk.
Stuxnet (2010)
Stuxnet, uncovered in 2010, was a highly sophisticated worm widely believed to have been developed in a joint U.S.–Israeli intelligence operation targeting Iran’s nuclear facilities. It notably included a Windows kernel-mode rootkit that concealed the malware’s files and processes, enabling the worm to silently sabotage industrial control systems. Stuxnet is often cited as the first known cyberweapon; it destroyed a significant part of Iran’s uranium centrifuges, while remaining difficult to detect.
Sony BMG copy protection rootkit scandal (2005)
… excerpt ends here. Continue reading the full article.
