words per minute
6
ElliotTheUnread
00:00
Speed
An attacker typically designs a rootkit to affect a particular OS and software set. If the
rootkit is designed with direct hardware access, then it will be limited to that specific
hardware. Rootkits can be generic to different versions of an OS, but will still be limited
to a given OS family. For example, some rootkits in the public domain affect all flavors
of Windows NT, 2000, and XP. This is possible only when all the flavors of the OS have
similar data structures and behaviors. It would be far less feasible to create a generic
rootkit that can infect both Windows and Solaris, for example.
A rootkit may use more than one kernel module or driver program. For instance, an attacker
may use one driver to handle all file hiding operations, and another driver to hide registry keys.
Distributing the code across many driver packages is sometimes a good thing because it
helps keep the code manageable -- as long as each driver has a specific purpose. It would be
hard for an attacker to manage a monolithic "kitchen sink" driver that provides every feature
known to man.