Windows Rootkits

GuidoJ writes "The Register is running an article by Kevin Poulsen of SecurityFocus Online about rootkits in Windows NT. While rootkits are a well-known issue in Unix and Linux systems, they have rarely been found on compromised Windows machines. According to the article, Windows NT backdoors have always been 'trivial', and they have caused enough havoc already. Imagine what a stealthy rootkit could do!"

Comments

And all this time

[antis0c]

I thought Windows WAS a rootkit.

Is this new???

[TopShelf]

I thought this was called "Windows Update"...

This shows that Windows

[ksheka]

...is approaching parity with Linux.

Heh...that's one way to decrease install size..

[A_Non_Moose]

quote:
"The stealth driver in my mind is the scary concept," says Mertens. "You can hide an elephant with it."


So the first thing they do is hide the \winnt folder?
.

Terminology

[gmuslera]

For what the article say, it is more a BSODkit than anything else.

Re:rootkit my ass

[Anonymous Coward]

But why would you do that? Delerious you are! That would be so hard to command.Compare that to a simple telnet session.

Why install a rootkit?

[CoyoteGuy]

Why install a rootkit when there are so many other, much easier vulnerabilities to exploit? I mean, come on... What haxx0r has time to write a rootkit, when they have oodles of options at their fingertips? It's the difference between a script kiddie and a real h@xx0r..

If it were me, I would just find a buffer overflow, and have some fun..

Re:How do you know Bill didn't?

[Imperator]

With closed source code, how do you know that there isn't a root kit included?

Because China is getting access to the code, and if there's one code review team to make Microsoft trustworthy, it's the Chinese government.

The very best line from the article:

[shrikel]

"I'm absolutely, one hundred percent positive that there's probably ten more that we haven't seen publicly,"