The Continuing Evils of Rootkit Attacks

BEAVERTON, Ore. - Nov. 13, 2015 - PRLog -- Rootkits are considered by many server administrators and owners to be one of the most evil pieces of malware that can exist on a dedicated server. Many web hosting providers will simply end up having to reload the Operating System in order to “resolve” such a frightening issue. Rootkits simply are extremely difficult to detect and completely get rid of. Preventing a rootkit getting on to a dedicated server is considered by many the best defense.

What makes a rootkit so serious an issue is that it obtains root level access gaining privileged access to a server putting it in control of every aspect of a server. This means that the malware can execute administrator level tasks and at the same time remain undetected.

This malware is similar to viruses and trojans, but rootkits have complete access to a server enabling it to even delete and stop services as well as attack other servers and services and cause various other types of network abuse such as spamming, port scanning, DoS etc. It therefore and without surprise is the most popular with hackers and cyber criminals of all sorts around the globe. Security software also has a very difficult time detecting rootkits since it does not act malicious or have ominous patterns and traits like other unwanted software such as viruses, malware and trojans etc.

Rootkits working as a background process can log all activity that happens on a dedicated server such as key-strokes which leads to sensitive e-commerce data, user-names and passwords as well as work habits to impersonate employees and possibly even gain access to other vital systems outside that particular dedicated server. This is also one technique in which rootkits end up on a dedicated server in the first place. Any existing vulnerabilities and security holes means possible access for a rootkit. Discarded thumb drives can cause an office worker to get curious and simply check and see what is on it, or what appears are genuine office colleague email communication can have attachments with the rootkit inside.

A server administrator may begin to notice odd server behavior that cannot easily be explained leading them to believe a possible rootkit infection. Such signs may be sluggish and slow loading or network speeds or settings being changed for no apparent reason. Task managers may be able to help in determining what is currently running on the system but since rootkits are so easily disguised as part of the Operating System this can easily be impossible to find in such a simple and quick way unfortunately. In many cases however, there are two other options left; running special diagnostic routines that came with the OS or simply reinstalling the entire OS which means loosing all data.

Trying to get rid of a rootkit can be beyond the scope of many inexperienced server administrators. Many dedicated server providers can assist in such a scenario but can also be beyond their scope. Each provider will be different in their abilities to assist in rootkit removal. The most certain course of action to ensure the rootkit is completely removed is to simply perform a fresh OS reinstall. Backing up data may be the most difficult since backing up data may very likely end up copying the rootkit along with the important data. External software protected backups may help in this regard.

The best solution is the best defenses available in security software/hardware and keeping them up to date. Only installing and running mainstream software that’s kept up to date and available from trustworthy sources. One example is the Apple app store which is tested and verified by Apple (although some bad apps using XcodeGhost have slipped through.) Prevention is the best course of action but rootkits can happen to almost any business. Leaving your, or someone else’s guard down for a minute during a busy work day, can result in  downloading unknown malware and rapidly spreading especially in a networked business environment. The more passwords in a business environment the better, keeping software and security updated and noticing unusual server activity as well as securing mobile devices should be a daily occurrence.

For more information, please go here: http://www.hostinganddesigns.com/Blog/