Rootkit

What is Rootkit?

A rootkit is a type of malicious software designed to gain unauthorized access to a computer system, often by exploiting vulnerabilities or by tricking users into installing it. Once installed, a rootkit can conceal its presence and control over the system, allowing attackers to execute commands, steal data, or maintain persistent access without detection. Rootkits can be particularly dangerous as they operate at the root level of the operating system, making them difficult to detect and remove using traditional antivirus or security measures. Detecting and removing rootkits typically requires specialized tools and expertise, often aided by IT asset discovery in security to identify the presence of malicious software.

Where did the term rootkit come from?

You can split the word rootkit into two to understand its etymology. Root, as in root user of the account, the admin with the most privileges, and kit – the application itself that allows the access. Originally, the term rootkit didn’t connote anything sinister, it was simply the tools that allowed administrator access to a machine or a network. However today, rootkit is usually associated with malware and malicious intent, and will usually refer to malware that can’t be easily spotted by other system tools or users.

What kinds of rootkits are there?

There are a lot of different kinds of rootkits, and they all use a different approach to reach the same end goal, stealth control over a machine, a system, or a network. For example, there are rootkits that go after hardware or firmware, and these can target something as seemingly innocent as your router. There are also bootloader rootkits which impact your security at the point your OS is being loaded, or application rootkits, which replace a specific application such as Excel, Notepad, or even a media player with a rootkit-infected program instead. The application might look the same, but in reality a good antivirus will be able to detect that the program is malicious in nature.

The most dangerous kind of rootkit is the kernel mode rootkit, which acts at the kernel level. These can be used to change system configuration and operating system settings, as they attack the very core of your OS. More recently, virtual rootkits have become more popular with attackers, which host the OS as a Virtual Machine in the cloud, making it very hard to detect. We love this graphic from Bitdefender that visualizes the different severity levels of rootkits and describes how they are utilized for malicious intent.

What can bad actors use rootkits for?

You can think of a rootkit like an invisibility cloak that hides the behavior of attackers. With a rootkit in place, and depending on the type of rootkit, bad actors can:
Inject malware: A rootkit will allow an attacker to install its own software onto your computer or network. This could contain viruses, worms, ransomware, spyware, or anything else. This malware is tough to spot, especially if its intention is something like stealing power for crypto mining or other activities. A rootkit can also create a persistent backdoor in your environment so that the attackers can come and go with ease.

Gain remote access: Remote access scams are growing in popularity, and allow attackers to steal personal, often financial, data or disrupt the operations of your system. These attacks often begin with a malware warning pop up on your machine, which can be easily faked using rootkit. You then agree to remote access software, granting deeper access unawares.

Change security settings: As the rootkit is inside your system, it can make changes to your settings or system configurations, making it harder for security teams to notice its existence, or even creating persistence so that it’s much harder to delete the rootkit or shut it down. While a rootkit doesn’t escalate privileges itself, it can provide a malicious user with more access and authorization credentials.

Steal data: By executing specific software, the rootkit can use the vulnerability to steal or simply delete files from your environment or your client network. Some rootkits, called payload rootkits, are specifically intended to log keystrokes to steal passwords and credentials like banking details.

Compromise privacy: Of course, this data is closely related to privacy and compliance. While attackers are looking to monetize the selling of sensitive data, this approach can leave you open to huge fines and reputational damage in terms of compliance.

How do you know if you have a rootkit attack underway?

Rootkit attacks by nature are hard to notice, and are known for flying under the radar of even sophisticated security tools. However, there are a number of ways to spot if you have a rootkit attack in progress, for example if you notice suspicious activity on your machine. This could be anything from Windows settings that change without your authorization, even if they seem harmless, like background images or start bar menu items, to something more serious like your antivirus or antimalware stopping running as usual. You should also look out for any dragging or dropping in performance, which could mean you have a rootkit infection slowing you down. Of course, if something more critical occurs like you are fully locked out of using your computer, or the touchpad, mouse or keyboard stops working – this could be a rootkit as well.

How can I protect against a rootkit attack?

First, make sure that you have an up to date and comprehensive cybersecurity solution in place. Atera integrates with Bitdefender, who offers a robust anti-rootkit solution, as well as Webroot.
As rootkits can often go unnoticed by traditional security tools, it’s also essential to make sure that you have a complete and robust patch management schedule so that your software and hardware is always up to date. Combined with staying on top of performance, this is a good first line of defense. Make sure to create baselines for the performance of all of your machines and client systems, so that you can be alerted to anomalies and any changes, even when your clients are unaware. These could be the first (or only) signs of a rootkit.

Of course, it’s also essential to spread awareness and education around the existence and behavior of rootkits, so make sure your clients know what to look out for, and to report anything suspicious or unusual – even if it seems unimportant. You could start by sending them this article!