在網(wǎng)絡(luò)安全中經(jīng)常會(huì)遇到ROOTKIT，NSA安全和入侵檢測術(shù)語字典( NSA Glossary of Terms Used in Security and Intrusion Detection)對(duì)ROOTKIT的定義如下：A hacker security tool that captures passwords and message traffic to and from a computer. A collection of tools that allows a hacker to provide a backdoor into a system, collect information on other systems on the network,mask the fact that the system is compromised, and much more. ROOTKIT is a classic example of Trojan Horse software. ROOTKIT is available for a wide range of operating systems.
The tool presented below tries to detect from remote if the target machine was compromised with the HACKER Defender ROOTKIT. The tool connect to the remote host, and compares the reply to several known replies. The ROOTKITs that can be detected by the tool are: HACKER Defender v1.0.0 and below.
