Rootkits In Commercial Software
By now many of you have heard that Symantec released a security advisory last Tuesday that reported its use of rootkit-like cloaking technology in its SystemWorks product. The Symantec use of rootkit-like cloaking raises the question of what exactly defines a …
Context & Ripple Effects
Mark Russinovich's October 2005 exposure of the Sony BMG DRM rootkit made 'rootkit' a household word and put every piece of commercial software that hides files or processes under scrutiny. Two days before this post, InfoWorld reported that Symantec and the Anti-Spyware Coalition were already trying to pin down what the term actually means — a definitional fight with obvious stakes for vendors whose own products use cloaking techniques.
First-order effects
- Symantec has confirmed via its own security advisory that Norton SystemWorks ships rootkit-like cloaking technology, meaning the company is simultaneously selling detection against such techniques and employing them — an immediate credibility problem with the security community.
- SystemWorks customers have hidden directories and processes on their machines that standard inspection tools will not surface until Symantec's disclosure is acted on.
Second-order effects
- Rival security vendors and standards bodies like the Anti-Spyware Coalition are pushed to finalize a working definition of 'rootkit' quickly, because any strict definition would classify parts of their own commercial products alongside malware.
- Antivirus engines face a classification dilemma: flagging cloaked commercial code risks false positives on paying customers' software, while exempting it undermines the premise of heuristic detection.
Third-order effects
- If the pattern holds, the industry moves toward disclosure obligations for cloaking techniques in legitimate software — the trusted-tool boundary between security product and stealth technique becomes a governed line rather than an informal one.
- The episode normalizes third-party researcher audits of vendor binaries, since the Sony and Symantec cases both surfaced through outside analysis rather than vendor transparency.
The trend: Cloaking techniques are migrating from malware-only territory into commercial software, forcing the security industry to define where legitimate stealth ends and malicious behavior begins.