Malware: Fighting Malicious Code

UNIX User-Mode RootKits

Girl, you know it's true!

—From the 1989 hit song “Girl You Know It's True” by Milli Vanilli, the pop music duo who revealed that they did not actually sing any of their hit songs and instead lip-synched their way to the top of the charts

RootKits were originally created for UNIX systems. UNIX environments are very well-suited to RootKit attacks, given their reliance on the root account. The root account is sometimes called the superuser account, given that it has all power on a typical UNIX system. From a root-level account, an attacker can completely reconfigure the box, overwrite existing applications, change logs, and view any data stored unencrypted on the target machine. Additionally, UNIX administrators rely very ...