Rootkits allow hackers to hide content on infected computers
Rootkits allow hackers to hide content on infected computers

Rootkits leave antivirus systems powerless

No defence in standard antivirus code

Iain Thomson

An increasing number of virus writers are using so-called 'rootkit' technology to create malware that is invisible to existing antivirus packages, IT security experts warned today.

Rootkits have been around in Unix systems for about 15 years, but the technology has only been in Windows systems recently, according to security firm F-Secure.

Advertisement

They allow hackers to hide spam servers, stolen media and illegal content on infected computers, and provide a backdoor that gives full administrator privileges to those who know how to access it.

"Windows rootkit is a stealth technique for hiding files. But does it at the kernel level, rather than at the application level," explained Patrick Runald, senior technical consultant at F-Secure.

"As such, virtually none of the current antivirus products can detect a rootkit at work. You can bet they all will, but that will take about six months and the rootkits are being used now."

Two recent viruses, Myfip.H and Maslan.A, both had stealth features borrowed from rootkits, according to Runald.

Dr Emlyn Everitt, a consultant at Logicalis and the first person in Britain to gain a PhD in intrusion prevention, added: "The key to any hacking attack is privilege escalation.

"Most security conscious people will have limited PC privileges. These rootkits allow you to escalate the privileges and get full control, and they can be easily customised to get past antivirus security."

  • Have your say
  • Send to a friend
  • Print
  • Digg
  • Reddit
  • Share

Tags:

Do you agree?

Further reading

Spammers using stealth software to hijack PCs

Spam approaches 95 per cent of all email

Proxy-generated junk mail set to cause 'meltdown', warns anti-spam firm

David Emm

Bugwatch: The commercialisation of malware

Virus writers are waking up and smelling the money

Security

The latest wave of cyber-crimes and acts of vandalism have demonstrated once again that many systems are still vulnerable to attack.

Related whitepapers

Related jobs

Most watched

V3.co.uk weekly debrief, 13 Nov 09

This week we discuss the inaugural V3.co.uk Summit

Summit: Salesforce.com on SaaS and information overload

How web services contribute to data headaches

Analysis and Reports

Remote access - Three steps to getting connected

3.4 million UK professionals now work from home – is your company equipped?

Cost benefits of a global collaboration network

This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications

Poll

Impact of Information Overload poll

Impact of Information Overload poll

What is the biggest problem your firm faces as a result of the data explosion?

View poll results

Advertisement

White paper library

Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Advertisement

Spotlight

V3.co.uk weekly debrief, 13 Nov 09

This week we discuss the inaugural V3.co.uk Summit

Fingers on keyboard

New Flash vulnerability discovered

Web sites could be vulnerable to Flash attacks

Chris Adams

Summit: Microsoft Office to the rescue

Chris Adams, Office Client product manager for Microsoft UK, explains...

Illegal downloader

Industry and human rights campaigners united in opposition to "three strikes" plan

Critics says government proposals to curb illegal downloading are unworkable...

Primary Navigation