1. Rootkits
Jonathan Hobbs

2. What is a rootkit? A tool set installed to grant a user root access
First modern rootkits emerged in the mid 1990s
Before rootkits there were log cleaners

3. Goal of a Rootkit
Maintain access
Execute malware
Remain hidden

4. Types of Rootkits Binary rootkits Kernel- and User-level rootkits
Remote & local access
Hide processes, connections, files, and user activity
Kernel- and User-level rootkits
Loadable Kernel Module
Firmware rootkits

5. Installation Rootkit installation can be achieved in two ways
Trojan Horse
Root or administrator level access
Local or remote
UNIX rootkit installation process (LKM backdoor example)
Disable shell history
Setup directory structure for rootkit
Freeze system logs
Deploy backdoor

6. Architecture
Scanner
Scans for vulnerable systems
Installer
Payload

7. Payloads Back doors Packet sniffers Log and file wipers
Denial of service

8. Detection Evasion & System Manipulation
Techniques include
Masquerading
Hooking
Direct Kernel Object Manipulation (DKOM)

9. Hooking and Masquerading
Rootkit payload pretending to be normal programs’
Windows: using the System Service Dispatch Table (SSDT)

10. DKOM Windows EPROCESS Connected by double-linked lists
Rootkit processes hidden by unlinking themselves from the list

11. Summary
Rootkits have effectively compromised systems by manipulating the core operating system processes
Different types of rootkits exist which compromise the system at different levels
Rootkits require administrator access to a system for installation and execution

12. Questions?