How does an attacker install a rootkit? |
 |
By Kurt Dillard, Microsoft
06 May 2005 | SearchWindowsSecurity.com |
|
|
Learn how to detect and remove rootkits in Windows systems with this collection of tips, written by Microsoft's Kurt Dillard. Read one of the several tips below, or return to the main page for the complete list.
How does an attacker install a rootkit?
In order for an attacker to install a rootkit on a system, he must somehow compromise it and gain administrator privileges. He will attempt to accomplish this in a variety of ways. He can:
- Trick a user into executing malicious code that's embedded in what appears to be a benign download from the Web, such as a game, screensaver or file sharing utility.
- Figure out an easy-to-guess password.
- Take advantage of a missing security hotfix.
- Exploit a poorly configured system.
- Install his rootkit once he gains control of the system.
About the author: Kurt Dillard is a program manager with Microsoft Solutions for Security. He has collaborated on many solutions published by this team, including "Windows Server 2003 Security Guide" and "Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP". He has also co-authored two books on computer software and operating systems.
Click for the next tip in this series: What's the difference between user-mode and kernel-mode rootkits?
|
|
|
|
