-: What is a rootkit?
A rootkit is a specific type of software
that's designed to gain administrative level control
over a given computer system without being detected.
Now, this is really important,
because when we talk about root
or administrative level permissions,
this is the highest level permissions
that someone can have on a given computer system.
If you're using a Windows machine, for example,
this is called the Administrator account.
This allows somebody to install programs, delete programs,
open ports and shut ports.
Basically, they can do whatever it is they want
on that computer.
In a UNIX, Linux, or Mac OSX computer,
this would be called root access.
Either way, gaining Administrative or root access
is great for an attacker,
but it is horrible for you and your security.
Now, let's talk for a moment about how this works.
If you look at a computer program,
it has several different rings of permissions
throughout the system.
The outermost ring, Ring 3,
is where the user sits if you're a standard user.
As you use different programs,
they have a way to get down, all the way down to Ring 0,
which is what we call kernel-mode.
This allows a system to control access to things
like device drivers, the sound card, the monitor,
and other things like that.
Now, if you're able to get Administrative permissions,
or root permissions,
you may be sitting at Ring 1,
and this would be a lot closer to the kernel
where you could do more damage.
Again, the closer you are to the kernel,
the more permissions you have and the more damage,
or dangers, that you can cause.
With rootkits, they try to get them installed
down into Ring 0, or Ring 1,
and this allows them to hide
from other functions of the operating system,
and avoid detection.
In fact, rootkits are able to perform malicious operations
on a target computer at any date they want,
without the knowledge of the administrators or the users
and even sometimes without the knowledge
of the operating system themselves, if they are done right.
Again, rootkits can really get dug into your system
really deeply, and when they're in there,
it's really hard to detect them.
Rootkits use a technique called DLL injection
that allows them to maintain persistent control.
With a DLL injection, what ends up happening
is malicious code is inserted into a running process
on a Windows machine by taking advantage
of the DLLs, or Dynamic Link Libraries,
that are loaded at runtime.
This means that the Windows system
doesn't even understand the fact
that it has a rootkit installed.
This also can occur by doing driver manipulation.
This is an attack that relies on compromising
the kernel-mode device drivers
that operate at a privileged or system level.
Both DLL injection and driver manipulation
occur by the use of a shim.
A shim is simply a piece of software code
that is placed between two components,
and that intercepts the calls and redirects them.
So, the rootkit will allow an interception to happen
between the Windows operating system
and the Dynamic Link Library,
and then redirect that call with the malicious code
embedded into it.
Now, again, both of these are just concepts
that you should be familiar with seeing the word
and remembering that either a DLL injection
or a driver manipulation have to do with rootkits.
If you remember that for the exam, you're going to do fine.
Rootkits are extremely powerful,
and again, they're very difficult to detect
because the operating system is essentially blinded to them.
To detect them, the best way is to boot
from an external device and then scan
the internal hard drive to ensure
that you detect those rootkits.