Windows Root Kits a Stealthy Threat

Windows Root Kits a Stealthy Threat
Kevin Poulsen, SecurityFocus 2003-03-05

Hackers are using vastly more sophisticated techniques to secretly control the machines they've cracked, and experts say it's just the beginning.

Expand all | Post comment

Windows Root Kits a Stealthy Threat 2003-03-05
Anonymous

Windows Root Kits a Stealthy Threat 2003-03-05
Anonymous (1 replies)

Windows Root Kits a Stealthy Threat 2003-03-13
Anonymous

You *can* write a rootkit in user-mode, but it won't be stealthy (compared to kernel-mode). In kernel-mode you have privileged access to the inner workings of windows. One example (given in the article) is hiding the binaries by intercepting the file io api. Another would be achieving network communications by tapping into the network stack, This would remove the necessity to leave of\pen ports waiting. eg: By monitoring incoming packets to closed ports, you could either: a) only open the "command" port after a certain "knock" pattern is detected, or simply run all communications through "dead" packets like these. Commands could be sent encrypted at the end of emails or any other medium which results in an incoming packet to the machine in question...

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/2879/18705#18705

Hacker Defender and NAV 2003-03-06
Anonymous (2 replies)

Hacker Defender and NAV 2003-03-06
Anonymous

Hacker Defender and NAV 2003-03-06
Anonymous (1 replies)

Hacker Defender and NAV 2003-03-07
Anonymous

Windows Root Kits a Stealthy Threat 2003-03-06
TK

Windows Root Kits a Stealthy Threat 2003-03-06
Anonymous

There is a cure, but its proactive, not reactive. 2003-03-07
Anonymous

prevent Root Kits with Authenticated Execution 2003-03-08
Marco

Windows Root Kits a Stealthy Threat 2003-03-09
DarkS0rcerer

Windows Root Kits a Stealthy Threat 2003-03-10
Anonymous

Absolutely probably? 2003-03-12
Anonymous

Windows Root Kits a Stealthy Threat 2003-03-12
Anonymous

Windows Root Kits a Stealthy Threat 2003-03-12
Anonymous (1 replies)

Windows Root Kits a Stealthy Threat 2003-03-13
Anonymous

Windows Root Kits a Stealthy Threat 2007-01-21
Anonymous