Problems Rooted in Five

• WordPress
• Twitter
• Facebook

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

So you’re at your computer sitting on your fart box, surfing the vast world of the internet and you decide to make a pit stop in the “red light district” because you have five minutes of free time and no one is around so you don’t have to feel an ounce of shame.

Given that you have five minutes means you’re on the clock and you figure downloading would be faster than streaming. After you find and download that sweet but extra spicy file to handle your developing situation, once the fun is had and the mission is complete, a moment of clarity happens.

You notice something, it’s a strange shortcut on your desktop named “This is nothing to worry about”. Thinking to yourself, “Hmm, that wasn’t there before. Oh well, I’m sure it’s nothing to worry about.” But wait sweet child of mine, it is something to worry about indeed.

Like a chick who partied too hard and left a frat party the next morning, how would you feel if I told you; You just may be pregnant? Don’t understand? Let me explain.

Rooting to the Core

You see, while you were in the red-light district of the internet seeking your jollies. Someone has provided something called a “rootkit” to get into your computer and well, have its way with your machine.

A rootkit is a type of malware that can provide administrative privileges to hackers for complete control of a targeted device. There are five types of rootkits and none of which are pleasant to deal with.

Hardware (Firmware) rootkit infects your computer’s hard drive, the BIOS (Basic input/output system), and your router.

Bootloader rootkit, your bootloader is an important tool since its loads when your computer is turning on, however, when booting, the system can be attacked and even replace your computer’s bootloader with a tainted one.

Memory rootkit hides in the computer’s RAM (Random Access Memory) and like football players running plays in the backfield, carry on any number of malicious tasks in the background. A good thing to note is they only live while your computer is on and sometimes go away after a simple rebooting, however, in some cases, you may have to do more.

An application rootkit will replace a file in your computer with a malicious file or files. This could also alter the way an application works such as Word or Notepad. A problem with this is trying to figure out which program is infected because an infected program will operate normally.

Lastly, kernel mode, the worst one in my opinion, hits the core of your computer’s operating system and can change how the OS functions. Where in some cases if not most, turns your computer into a zombie.

Crackers Seeking Control

Who are the people who use such a thing? Hackers originally were called “crackers” because they were working to crack a code or into a network and not hack but hackers just stuck I guess. These cybercriminals use such tactics to make like your nosey neighbor and eavesdrop on your interactions.

Hackers can intercept personal information via keyloggers which are devices that collect your keystrokes while typing on a keyboard. Yes, to all of you keyboard peckers, if were to equate your typing to internet speed, hackers would consider you to be dial-up. But while logging keystrokes, hackers, as mentioned before, can gain control of your operating system.

While eavesdropping, hackers can also conceal their digital footprint on a compromised system leaving a backdoor for frequent visits without being detected. So this is in a sense, your nosey neighbor jimmying your door and being allowed to free roam while you’re sat on the couch watching tv.

Nerds and Drive-by Exploits

Why is knowing about rootkits so important? Well, if you had experience with dealing with a stalker, you know things can get uncomfortable, however, if you find that not only, they are stalking you but are also inside the house. Things can ramp up very quickly.

Rootkits have the same behavior, a rootkit’s goal is to get into your system, bury itself deep within your OS, and change, collect, release, or even perform a combination of all three in your machine. But like stalkers, rootkits don’t just limit themselves to your house, smartphones, and other devices are not off the menu as they have several exploits such as GPS, battery, and voice.

There are ways to check for a rootkit, one way is looking for any strange behavior such as your machine is operating on its own. Another is performing a memory dump analysis which is to take all the information from the RAM and put it onto a storage drive for later analysis. Performing a factory reset will typically remove some infections but like cockroaches, some will survive.

The use of anti-virus programs like Norton or McAfee will not get rid of a rootkit, especially if they’re not up to date. As with any other type of malware, the absolute best way to avoid a rootkit infection is to never get it in the first place.

This might be easier said than done since visiting some sites will trigger an event where a file will be downloaded onto your computer without any action on your end. This is called “drive-by downloading”. I thought drive-bys were just limited to being in “da hood”, apparently, they can happen in IT too.

The thought of gang-affiliated nerds beefing with each other and doing drive-bys just broke me, I’m sorry. This event is hard to keep up with as it’s not just limited to any unknown sites, well-known and legitimate sites could have embedded code in them.

But if you have to visit some unknown sites because your curiosity about the darknet is killing you then keeping your operating system and all your software up to date will aid in the protection of your machine from rootkits.

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Feel like I may have missed something? Script a comment below.