On the user side, unless you are one of the lucky few to have rootkit detection included in your existing endpoint security suite for free (with good performance), it’s something that should only be used tactically. When you have reasonable suspicion something is going on, through network security monitoring or some other anomalous behavior, the cash and performance cost of rootkit detection probably isn’t worth it. You might consider it more for exposed or high value systems, but even there you want to do a bunch of testing first. In other words, it’s more an incident response, investigative, and cleanup tool (when you can’t just nuke the system from orbit, which is the safest option). Eventually this functionality will be a standard part of our anti-malware (AV) tools, and probably perform about the same. Which means it will miss the hard stuff, catch the easy stuff, and probably cost too much for the value provided. But anti-malware still provides enough marginal value that we can’t just dump it.

However, we shouldn’t go trying to detect malware hiding in every possible nook and cranny. It is much better to detect their effects because no matter how stealthy the rootkit abuses SMM, hardware-assisted virtualization, or operating system drivers, it still has to actually *do* something and that may be detectable. An anomaly in process CPU usage accounting, file system usage, or network traffic may give it away.

You will not stop people from attempting to write better rootkits, and there will always be people working to better detect them. It is to my advantage that this happens “in the open” so I can benefit from all the hard work and competitive spirit of both sides.

But the truth is we should take a step back, look at the problem, and try and come up with solutions that fix the root cause. Rootkits aren’t the problem- exploitation of the systems is. Viruses, spyware, remote hacking, none of those are the real problems, they are just the vector. I’d rather see more investment in anti-exploitation technologies than rootkit detection, not that the two are mutually exclusive. It’s a matter of prioritizing the research, not dropping one for the other.

My strongest defense is to make attacking my information assets riskier and more expensive for The Bad Guys. An ongoing arms race will continue to make rootkits more complicated and less survivable. This effectively reduces the risk adjusted rate of return an attacker gains from them.

You are already screwed when someone installed it on your machine. Especially, when the attacker is in a position to leverage SMM or install a malicious hypervisor. It’s pretty much game over the second someone compromised your user account. You know the account with privileges to access all of your stuff.