RootKit By Parrag Mehta

OUTLINE What is a RootKit ? Installation Types How do RootKits work ? Detection Removal Prevention Conclusion References

What is a RootKit ? Software that allows continued privilege access to a computer system without the system users knowledge. RootKit comes from “Root” – UNIX administrator account and “Kit” – Software components that implement the tool.

INSTALLATION Exploit Security Vulnerabilities Cracking a Password Trick user into executing malicious code Social Engineering – Malware is beneficial

TYPES Persistent – Activated every time system starts up Non-persistent – Not capable of running again on system start up Way in which they execute – User Mode – Kernel Mode

How do RootKits work ? RootKits use a simple concept called “Modification” Some places where modifications can be made in the software: – Patching – Easter Eggs – Spyware Modifications – Source-Code Modifications – Legality of Software Modifications

DETECTION Alternative trusted medium Behavioral-based Signature-based Difference-based Integrity-based Memory Dump

REMOVAL Re-install OS from trusted media – Highly recommended – Re-install from scratch Anti-virus software – Malicious software removal tool – AVG Pro – SpySweeper

PREVENTION Use Anti-virus Software Install a Firewall Use good passwords Keep Software up to date Follow good security practices

CONCLUSION Thus, we have seen what Rootkits are, how they work, how can they be detected and removed and also what are the prevention mechanisms. We also conclude that there is no concrete method to detect and remove RootKits.

REFERENCES e-48 e-48 ticle.articleid+122+page+1.htm ticle.articleid+122+page+1.htm ?p=408884&seqNum=5 ?p=408884&seqNum=5

THANK YOU