Why Didn't I think of that...

[bgrimm]

From the "Why Didn't I think of that" column...

I'm not sure how many of you have been following the Sony Music CD Rootkit mess that has been posted all over the internet.
But this post on SecurityFocus about World of Warcraft Hackers using the rootkit to hide there hacks got me thinking...

Link to SecFocus article: h**p://www.securityfocus.com/brief/34

Could this be "the best new way" to hide a debugger?

-bg

[Sten]

bgrimm, it's a big mistake of Sony to distribute Rootkits with music CD's.

However, rootkits in general cann't be used to hide debuggers - the detection methods work in different way than simply looking if some files are present.

[bgrimm]

Originally Posted by Sten

It's a big mistake of Sony to distribute Rootkits with music CD's.

Agreed, I personally have not purchased a music CD from any company under the RIAA banner in several years.

However, rootkits in general cann't be used to hide debuggers - the detection methods work in different way than simply looking if some files are present.

The more I htought about that I believe it would be more useful in hiding monitoring programs such as File/Reg from sysinternals.

Regards,
-bg