News for hackers. Stuff that matters.

A comment on Sophisticated OS X Backdoor Discovered. Parent comment

Re:Sophisticated OS X Backdoor Discovered by takeda on Thursday September 08, 2016 @03:11PM (#12456274)
rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible.

The sony rootkit was named somewhat incorrectly, because it also tried to hide itself and no other existing malware names fit it.

[ Parent | on HN ]
Re:Sophisticated OS X Backdoor Discovered by stcredzero on Thursday September 08, 2016 @04:17PM (#12456883)
rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible.

Are you sure? It also commonly referred to such kits being used by hostile parties. I've personally interrupted an attempt at installing the "Hungarian Rootkit" in the 90's. (I put unpatched Red Hat 6 online when Red Hat 7 was out.)

(that's where the name comes from root = admin on unix)

The fact that you think this is something that bears explaining is interesting in the context of HN. I hope this is based on something you've noticed about recent user trends here. There was a time when someone would be very surprised if a user here didn't already know this.

[ Parent | on HN ]
Re:Sophisticated OS X Backdoor Discovered by takeda on Saturday September 10, 2016 @12:30PM (#12469890)
I see my response was ambiguous. Of course I meant rootkit was always malicious. It was used by intruder to gain root back after admin though he restored the host after being hacked.

Rootkits are the reason why it is recommended to wipe the whole system after being hacked, because you can't be sure there there wasn't anything installed.

[ Parent | on HN ]
Re:Sophisticated OS X Backdoor Discovered by Whitestrake on Thursday September 08, 2016 @07:46PM (#12458489)
> It also commonly referred to such kits being used by hostile parties.

I suspect that's exactly what he means - a rootkit is deployed by an intruder so that when the admin discovers the host has been compromised and patches the vulnerability, the rootkit, if not addressed, will grant the intruder root capabilities once more.

[ Parent | on HN ]
Re:Sophisticated OS X Backdoor Discovered by caf on Thursday September 08, 2016 @07:34PM (#12458416)
Right. a "rootkit" was a kit of tools you deploy once you have obtained root (on someone else's server).
[ Parent | on HN ]
Re:Sophisticated OS X Backdoor Discovered by cmdrfred on Thursday September 08, 2016 @08:27PM (#12458755)
I always thought of them as a way to gain root. As in privilege escalation.
[ Parent | on HN ]
Re:Sophisticated OS X Backdoor Discovered by detaro on Thursday September 08, 2016 @08:33PM (#12458788)
A rootkit might come with tools for that, but the actual rootkit generally requires you having root (or some other privileged role) to deploy it. E.g. a Linux rootkit commonly is a kernel module, which you can only load if you have already obtained root privileges.
[ Parent | on HN ]