Security vendors looking to define 'rootkit'
Symantec, Anti-Spyware Coalition hope to ease confusion over cloaking techniques — After being criticized for including rootkit-like cloaking software in its Norton SystemWorks product, security vendor Symantec (Profile, Products, Articles) …
Context & Ripple Effects
The definitional scramble follows Mark Sysinternals' October 2005 exposure of the Sony BMG rootkit, which turned 'rootkit' from an obscure malware term into a consumer-facing scandal — and caught legitimate vendors in its wake. Symantec was criticized for shipping rootkit-like cloaking software inside Norton SystemWorks, putting the industry's biggest security brand in the awkward position of selling techniques it sells protection against.
The push also builds on the Anti-Spyware Coalition's momentum: on 2006-01-13 the group agreed on final standard methods for identifying and combating spyware, and Microsoft had already folded its antispyware effort into the rebranded Windows Defender in November 2005. A shared rootkit definition is the next contested term, with Symantec's own product line as the test case.
First-order effects
- If Symantec and the Anti-Spyware Coalition settle on a definition, tools like Windows Defender gain a principled basis for flagging — or whitelisting — commercial cloaking code such as that found in Norton SystemWorks, directly affecting how Symantec's own suite is classified by rival scanners.
Second-order effects
- Vendors bundling stealth techniques into legitimate products face pressure to disclose them or risk detection as malware, while the Anti-Spyware Coalition's just-finished spyware standards become the template for adjudicating gray-area software across member companies.
Third-order effects
- The episode points toward industry-body governance of security terminology itself: when a vendor can be both offender and arbiter, definitions set by coalitions rather than individual firms determine which commercial behaviors get tolerated — a structural question that outlasts any single product.
The trend: Post-Sony-rootkit scrutiny is pushing the security industry from ad-hoc malware naming toward formal, coalition-set definitions of cloaking techniques that bind vendors' own products.