What are user-mode vs. kernel-mode rootkits?
The concealment aspect is what distinguishes rootkits from other types of malware, and it’s what makes them so difficult to detect and remove. Rootkits can provide the attacker with a backdoor for future attacks, launch and hide other applications, and gather sensitive data to be collected by the attacker at a later time. Today’s common rootkits usually run in user mode with administrative privileges. Breaking the integrity of the trusted computing base, they alter the security subsystem and display false information to legitimate administrators of the compromised computer. They intercept system calls and filter output application programming interfaces (APIs) to, for example, hide processes, files, system drivers, network ports, registry keys and paths, and system services. There are many user-mode rootkits available, including HE4Hook, Vanquish, Aphex and currently the most widespread, Hacker Defender. Each of these rootkits is persistent in that its files must be copied to the targe
