Two prominent Web sites that specialize in remote access software known as "rootkits" have been taken offline by a large distributed denial-of-service attack. The take-down was allegedly ordered by a shadowy group of hackers and rootkit authors who took offense to criticisms of their software posted on the sites.

Rootkit.com, an established Web site run by security expert Greg Hoglund, has been offline for almost a week. Two other sites, operated by a prominent rootkit author known as "Holy Father" have also been taken down in the attacks, which are believed to be the work of a group of Bulgarian and Turkish hackers known as the SIS-Team, according to Hoglund, the CEO of HBGary, an information technology software and services company.

The attack against rootkit.com began April 5 after someone using the name "ATmaCA" posted an inflammatory message to one of the discussion groups on the site that advertised a number of malicious remote access software programs sold by SIS Team, including SIS-Downloader, ProAgent and SIS-IExploiter, Hoglund said.

The programs are powerful spyware tools that, when combined, enable remote attackers to secretly compromise other machines using attack Web pages. They are sold online at Web sites like www.spyinstructors.com and are popular with those behind spam campaigns, who use the tools to plant remote control programs that are then used to send out spam, Hoglund said.

The post by ATmaCA prompted curt responses from rootkit.com members, who objected to authors using the discussion forum as a venue to advertise their commercial software. Other rootkits discussed on rootkit.com are open source, and authors typically post links to their source code on the site, Hoglund said.

In the "flame war" that erupted between the SIS-Team members and the rootkit.com contributors, questions were also raised about the quality of the SIS-Team products. Some rootkit.com regulars alleged that the tools were poorly written and frequently crashed machines they ran on, Hoglund said.

The IDG News Service is a Network World affiliate.