Chapter 13: Digging In

OVERVIEW

Opportunities multiply as they are seized.

--SUN TZU

BREAKING INTO A COMPUTER ISN'T EASY, SO ONCE A HACKER GETS INTO A COMPUTER, THE FIRST GOAL IS TO MAKE SURE HE CAN GET BACK INTO THAT COMPUTER AT ANY TIME. The best way to do this is to gain a system administrator account on the computer, otherwise known as a root account or just plain root.

To gain root access, hackers have created special tools called rootkits, which are designed to punch holes in a computer's defenses. That way, if a system administrator finds and blocks the first way the hacker broke into the computer, the hacker can still use one of many alternative ways to get back into that same computer.

Some of the more common rootkit tools include sniffers and keystroke loggers (for snaring additional passwords), log-cleaning tools (for hiding the hacker's presence on the system), programs for finding common exploits (for taking advantage of flaws in the operating system or server software), and Trojan horses (for opening up back doors into the computer and masking the intruder's activities). Once a hacker has installed a rootkit on a computer, he can sneak back into that computer at any time without worrying about being detected.