Sidebar: A Simple Rootkit Example
An important element of a kernel rootkit is its ability to hide itself and cover up what is really going on. Here's one way that some rootkits do that. When a rootkit is installed, it replaces certain system calls and utilities with its own, modified versions of those routines.
For example, to hide the existence of a file, the rootkit must intercept all system calls that can carry a file name argument, such as open(), chdir() and unlink().
By Russell Kay at Computer World
[ Read more ]
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.