Rootkits, Computer Attacks and Cybercrime - Research Paper Example

The most powerful aspect of this type of intrusion was that it could make the attack invisible to the users of the computer. 2. Nature of Attack Koch (2007) explained that rootkits are used in combination with Trojan horses. The infected system can be used for malicious usages without the knowledge of the user, for example conducting spam attacks, botnet attacks, or changing the settings of a system according to the desire of the hacker. George (2006) stated that rootkits can even cause the replacement, and changing of executable programs in the systems or the kernel-based files to jeopardize the entire functioning of the system.    

3. Degree of Losses Rootkit attacks are known to cause hefty losses for organizations since they are difficult to be traced by a user. CCH Group (2009) included figures from a survey that took place in 2006; the Computer Crime and Security survey concluded their study and stated that $241,150 is the average loss on an annual basis for organizations in the US. They also stated that 20% of these losses occurred from rootkit intrusions that may have caused leakage of sensitive information, login credentials, banking details, etc. 

4. Example of Rootkits Koch (2007) gave an example of rootkits and explained that Sony BMG Music Entertainment had adopted the strategy of rootkits to set digital rights management software on the system of the user whenever their CD was played to ensure that the music was not being copied or used for piracy purposes. This installation was being done without the knowledge of the user.  

5. Techniques for Mitigation Rootkits are hard to detect since the intruder’s tracks are cleaned and made invisible after the intrusion. George (2006) pointed out an effective mode of recognizing the presence of rootkits in the system by using an alternate media such as rescue CD-ROM. The involvement of such an external medium may be able to detect the rootkits since they may not be executing at the time of running the CD and intentionally trying to hide their existence. Another effective mode was explained by Alsalam, Banerjee, Musick, and Saftoiu (2005) that detects the presence of rootkits and the changes made by the malicious tools; keeping rootkits detection software installed in the system that continues to compare the clean state of the system with the current one. Any changes that may become apparent after comparison can signal malicious changes in the system.     Read More