Rootkit

The term rootkit combines root, the supreme administrator account on Unix systems, and kit, denoting a toolset. It appeared in security literature in the early 1990s to describe collections of programs allowing an attacker who had already obtained root privileges to conceal their presence by modifying system commands. The sophistication of rootkits has progressed in successive layers: user-space rootkits, which hijack system libraries, gave way to kernel rootkits, which operate at a trust level equivalent to the core of the operating system and are therefore invisible to any tool running above them. More dangerous still, bootkits inscribe themselves in the UEFI firmware or in the disk boot sector, loading their code before the operating system takes control, making them persistent even after a complete reinstall. Hypervisor rootkits, or bluepills, propose to interpose a malicious hypervisor below the target operating system, running it as a virtual machine without its knowledge. For cyber insurers, rootkits pose a particularly severe remediation problem: whether a system compromised by a firmware-level rootkit can ever be considered clean is technically an open question, which can lead to demands for complete hardware replacement and coverage disputes over the definition of a restored system. They are frequently associated with state-sponsored APT groups, raising war exclusion questions.

In 2010, the Stuxnet rootkit, attributed to American and Israeli services, used a stolen signed driver to install itself at Windows kernel level, then targeted the Siemens S7 PLCs of Iranian centrifuges. Its discovery redefined the boundary between cyberattack and act of war, and directly fueled the debate on war exclusions in cyber policies throughout the following decade.

rootkit, kit de dissimulation, kit racine, bootkitroot, bootkit, malware furtif