Re: Kernel Rootkits

Malita, Florin
2005-04-15T17:34:15Z

On Fri, 2005-04-15 at 13:16 -0400, Richard B. Johnson wrote:
> I'm not sure there really are any "kernel" rootkits. You need to be
> root to install a module and you need to be root to replace a kernel
> with a new (possibly altered) one. If you are root, you don't
> need an exploit.

rootkit != exploit

The exploit is used to gain root privileges while the rootkit is used
after that to install & hide backdoors, sniffers, keyloggers etc.