As I recall, back in 2004, some tried to label the malware known as “Opener” as a rootkit, but that was a stretch to say the least. I’m aware of Dino Dai Zovi’s “Machiavelli” proof of concept, but that’s demonstrating parts of a root kit and also fails the “in the wild” test. Still, there are “legitimate” programs that likely use various root kit methods and kernel extensions that could technically be classified as root kits. From that perspective, I would agree with your correction and will likewise update that one line in my post.

Rootkits are very similar to trojans in that they generally require administrative rights on the target system to install. They can be written by anyone with knowledge of BSD Unix. They generally don’t require knowledge of OS X specifically. Since much of OS X is open source, the source for the rootkit is readily available. Again, like a trojan, there is little an OS vendor can do to prevent rootkits. Heeding warnings and not supplying administrator credentials is probably all that is needed to prevent this kind of malware.

….. niiiiice, Ballmer. Keep up the monkey imitations and chair-throwing tantrums; you may not have a job at Microsoft for too long, but any ringmaster would hire you.