Is A Rootkit Malware?

Rootkits like Spector Pro and eBlaster have been known to be employed as monitoring tools by not only law enforcement agencies, but also by parents and employers to keep checks and retain command and control over their children and employees respectively.

Contrary to the media portrayal rootkits are not malware, though they are used by hackers to infiltrate and monitor systems. Media attention disproportionately focuses only on the rootkits that are installed by Trojan and viruses, depicting them in a negative manner. The purpose of a rootkit is to basically take control of systems and hide files, memory addresses, network connections or registry entries used by network administrators to detect intrusions. A rootkit is usually bundled with other malicious utilities. A rootkit is essentially a technology, which can be used both productively and destructively.

Rootkits are used to hide other programs and create “backdoors” to allow attackers to access comprised systems again. Rootkits, including kernel rootkits, hide applications which can spawn notifications and shells when an attacker accesses a system. They can also grant users privileged accesses that are reserved for administrators only. Other tools can be hidden in the compromised system making it a staging ground for further attack using programs it communicates with, such as sniffers and keyloggers. Such attacks hide the attacker while showing the compromised system as the source of the attack. Denial of service attacks, email spams and tools to relay chat sessions are included in this. Rootkits allow attackers to access user name and login information for sites which require them allowing them to store such personal information. Rootkits can also be used to hide from third party scanners to avoid detection or tampering. Some security and emulation software employ rootkits. Alcohol 120% and Daemon tools are common commercial non-hostile rootkits. Rootkit is a term that is now loosely used for cloaking techniques and methods.