Windows Root Kits a Stealthy Threat

Hackers are using vastly more sophisticated techniques to secretly control the machines they’ve cracked, and experts say it’s just the beginning. Barron Mertens admits to being puzzled last January when a cluster of Windows 2000 servers he runs at an Ontario university began crashing at random. The only clue to the cause was an identical epitaph carved into each Blue Screen of Death, a message pointing the blame at a system component called “ierk8243.sys.” He hadn’t heard of it, and when he contacted Microsoft, he found they hadn’t either. “We were pretty baffled,” Mertens recalls. “I don’t think that cluster had bluescreened since it was put into production two years ago.” Mertens didn’t know it at the time, but the university network had been compromised, and the mysterious crashes were actually a lucky break — they gave away the presence of an until-then unknown tool that can render an intruder nearly undetectable on a hacked system. Now dubbed “Slanret”, “IERK,” and “Backdoor-ALI” by anti-virus vendors, experts say the tool is a rare example of a Windows “root kit” — an assembly of programs that subverts the Windows operating system at the lowest levels, and, once in place, cannot be detected by conventional means. Full Story