Spy vs. Spy: counter-intelligence methods for backtracking malicious intrusions

Advanced malicious software threats have become commonplace in cyberspace, with large scale cyber threats exploiting consumer, corporate and government systems on a constant basis. Regardless of the target, upon successful infiltration into a target system an attacker will commonly deploy a backdoor to maintain persistent access as well as a rootkit to evade detection on the infected machine. If the attacked system has access to classified or sensitive material, virus eradication may not be the best response. Instead, a counter-intelligence operation may be initiated to track the infiltration back to its source. It is important that the counter-intelligence operations are not visible to the infiltrator. Rootkits can not only hide the malware, they can also be used to hide the detection and analysis operations by the defenders from the malware. This paper surveys the rootkit literature for their applicability to counter-intelligence operations.