liveBook · Manning

Rootkit

As explained in Grokking Web Application Security

A rootkit is software that enables or hides privileged access to a computer system.

A rootkit is software used to help an attacker escalate privileges and reach a server’s root account, which has the most privileges. section 1.2

Root access can let an attacker:

  • Use the server’s computing resources to mine cryptocurrency, send phishing emails, or commit click fraud. section 1.2
  • Add the server to a botnet or resell access without the owner’s knowledge. section 1.2
  • Avoid detection by mimicking existing processes and using locally accessible services. section 1.2

Detection signals

Investigate unusual network activity, suspicious filesystem files, and unexplained spikes in resource use; detecting a compromised server remains difficult. section 1.2

How Grokking Web Application Security covers it

How deep it goes
Explains privilege escalation, attacker outcomes, and detection signals, but does not detail rootkit implementation.
Examples
Uses cryptocurrency mining, phishing emails, click fraud, suspicious files, and unexplained resource spikes as concrete examples.
What it assumes
Assumes an attacker has already gained a foothold and distinguishes ordinary access from privileged root access.
What you can do after
Diagnose compromised servers by checking network activity, filesystem contents, and unexplained resource consumption.
How it connects
Connects rootkits with privilege escalation, root accounts, botnets, living off the land, and resource abuse.
Cover of Grokking Web Application Security
liveBookmanning.com
Read Grokking Web Application Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Grokking Web Application Security. The section links point to the parts of the book it draws on.