Anti Rootkit Blog

I found this interesting blog article about how to use the Tenable Passive Vulnerability Scanner (PVS) for finding Rootkit activity. As Rootkits are used to hide information from the Operating System and bypass anti virus and anti spyware programs it is only with specific rootkit scanners that they can be found.

If a new rootkit is created and can bypass the anti rootkit scanners then it will be invisible to everyone and everthing…..except….if you scan network traffic from another PC then you can possibly see the traffic caused by the rootkit and what ports were opened. A list of open ports may show ports opened that are unknown to any application and should be investigated.

A quote from the Blog.
“When systems are compromised by some sort of rootkit, botnet agent, maleware or some other type of malicious software, they tend to use their own network channels to communicate for command and control. Obviously, some bots are more stealthy than others, but the large bulk of them open up network connections to someplace else to report home and receive commands. If these connections are on ports not normally visited  by a system, they “stick out” in the traffic.”

Check out the full blog posting here at http://blog.tenablesecurity.com/2007/01/using_new_port_.html

Keep Safe
regards
Steo

This entry was posted on Sunday, January 14th, 2007 at 5:33 pm and is filed under News, Rootkit Scanners. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.