Blog

Could you root out a rootkit?

The stealthiest of all malware, a rootkit can go undetected for years — all the while stealing data from your computer system.

March 5, 2015

First off, you have to know what a rootkit is.

A rootkit is a kind of software that conceals malware from standard detection methods.

A good simile for a rootkit would be a burglar breaking into your house. The burglar is dressed all in black, so that he blends into the darkness. He tiptoes around silently so he’s more likely to go undetected as he steals your belongings.

But unlike a burglar, who usually takes your stuff and leaves, an efficient rootkit can stick around for years doing its work, robbing your computer or mobile device of data.

How do you get a rootkit? One way is via a malicious file that looks benign, such as a plug-in that you download or an email attachment you open. Rootkits can also be spread through infected mobile apps.

Once downloaded, a rootkit will interfere with your device’s functions — and those of your security software. If you run a security scan, a rootkit often will prevent your security software from showing you this information so you’ll have no idea that malware is running on your device.

Because of this, it is difficult to detect a rootkit. Detection methods include looking for strange behavior by your device or scanning its memory. If you believe that you do have a rootkit on your computer or mobile device, you can either reinstall your operating system (after backing up your data, of course) or use a rootkit removal tool.

Of course, the best approach is not to allow your devices to become infected by a rootkit in the first place, by following a few simple recommendations:

• don’t open suspicious links or attachments. Although they might appear to be harmless, they could contain malware;
• keep your operating system updated. Promptly install the latest updates for your operating system as well as any hardware updates that are available for your device, as these will often close security holes; and
• install comprehensive security software. Security software with rootkit detection tools can safeguard your computer or mobile device from rootkits. However, for this software to remain effective it must be updated continuously so that it can detect new threats.

Robert Siciliano is an identity theft expert and consultant, and the author of "99 Things You Wish You Knew Before Your Identity Was Stolen."

photo courtesy tatters|flickr