Root kit - Definition

A root kit is a set of tools used after cracking a computer system that hides logins, processes, and logs as well as usually sniff terminals, connections, and the keyboard. In many sources root kits are counted as trojan horses.

Called "root" kit after the fact that originally it referred to a set of recompiled Unix tools such as "ps" "netstat" "w" "passwd" that would carefully hide any trace of the cracker that those commands would normally display, thus the cracker could maintain "root" on the system without the system administrator even seeing them. Rootkits come in two different flavours, kernel and application level kits. The idea of kernel level rootkits is to replace a portion of kernel code with modified code that helps the intruder cover his tracks. One common way of doing this is by replacing system calls with versions that hide information about the attacker. With Application level rootkits regular application binaries are replaced with trojaned fakes.

A rootkit may also include utilities to help the attacker subsequently access the system more easily. For example, the rootkit may include an application that spawns a shell when the attacker connects to a particular network port on the system.

Generally now the term is not restricted to Unix based operating systems, as tools that perform a similar set of tasks now exist for non-Unix operating systems, even though they may not have a "root" account. Tools that detect root kits on Unix and Unix-like systems include Chrootkit and Rootkit Hunter.

See also: Host-based intrusion-detection system

Example Usage of Root