Rootkits;
In general, rootkits are small software packages installed by an attacker on any system with the goal to cause damage and/or to spy out the actions made by regular users. The danger compared to other kinds of attacks is that a rootkit hides itself against detection by system administrators and, especially, directly modifies important system commands. There are two types to be aware of:
System rootkits:
They take place in the application layer, i.e. they modify only the software on the system without entering neither the kernel or the boot process. They do exactly the changes described above. This is the ``classical' type of a rootkit.
Kernel rootkits:
These are newer and more dangerous kinds of rootkits. As the name already suggests, they intrude deeper into the system with the goal to directly manipulate the kernel. (This the central module of an operating system. It is the part of the operating system that loads first, and it remains in main memory).In order to enable this, they establish modules in the kernel with the aim to make their detection more difficult. The worst occurence of a kernel rootkit is characterized by the direct manipulation of the kernel memory and thus overtaking your computer.
� 2007 All Computer Services
