'Hacker Defender' Rootkit Author Offers Cease-Fire

The author of the Hacker Defender rootkit said he's taking a break from developing the popular hacking tool—but that he may soon return to developing new rootkit programs.

The author, who uses the name "Holy Father," posted a message on the Hacker Defender Web site calling a truce with security companies that make anti-rootkit technology.

However, in an e-mail exchange with eWEEK, "Holy Father" said he isn't throwing in the towel, and that he may return to rootkit development after taking a break from Hacker Defender to work on other projects.

Hacker Defender is one of the best-known rootkit programs. Rootkits have been common in computer hacking circles for years, and allow attackers to maintain access to a computer, without being detected, long after they have compromised its defenses.

In recent years, authors have developed so-called "kernel mode" rootkits, like Hacker Defender, that manipulate information sent to Microsoft Windows' core processing center and are very difficult to detect.

Click here to read what Microsoft is doing about the threat of rootkits.

Hacker Defender was initially released as an open-source program in 2004. More recently, Holy Father has sold updated copies of the rootkit, dubbed "Golden Hacker Defender," for 450 euros. That version of the program had an anti-detection engine designed to thwart anti-rootkit technology from vendors like anti-virus firm F-Secure, in Helsinki, Finland.

Read the rest of this eWEEK story: "'Hacker Defender' Rootkit Author Offers Cease-Fire"