Invisible intruders: rootkits in practice
David Brumley · ;login:: the magazine of USENIX & SAGE · 1999
To catch a craker you must understand the tools and techniques we will use to try to defeat you. A system cracker's first goal is to hide his presence from you, the admionistrator. One of the most widely used cracker tools for doing this is the rootkit. A rootkit gets its name not because the toolbox is composed of tolls to crack root, but instead because it comprises tools to keep root.