hacking - Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just fixing the hole that was used to compromise the system.

Given all the various root kit technologies and other things a hacker can do most experts suggest you should reinstall the operating system.

I am hoping to get a better idea why more people don't just take off and nuke the system from orbit.

Here are a couple points, that I would like to see addressed.

• Are there conditions where a format/reinstall would not clean the system?


• Under what types conditions do you think a system can be cleaned, and when must you do a full reinstall?


• What reasoning do you have against doing a full reinstall?


• If you choose not to reinstall, then what method do you use to be reasonably confident you have cleaned and prevented any further damage from happening again.

Answer

A security decision is ultimately a business decision about risk, just as is a decision about what product to take to market. When you frame it in that context, the decision to not level and reinstall makes sense. When you consider it strictly from a technical perspective, it does not.

Here's what typically goes into that business decision:

• How much will our downtime cost us in measurable amount?


• How much will it potentially cost us when we have to reveal to customers a bit about why we were down?


• What other activities am I going to have to pull people away from to do the reinstall? What is the cost?


• Do we have the right people who know how to bring up the system without error? If not, what's it going to cost me as they troubleshoot bugs?

And therefore, when you add up the costs like those, it may be deemed that continuing with a "potentially" still-compromised system is better than reinstalling the system.