Once an attacker gains root, the possibilities are endless. This is why it is critical to have capabilities in place to detect intrusions and their extent. Running Programs Automatically Another way to get an xterm running as root to appear on your machine would be to use cron, a program that runs tasks at specified times. Restricting user access to cron and checking root's and the system crontab entries regularly is encouraged. Again, the best way to deal with this is to use Tripwire or similar software to monitor changes to programs and configuration files.
Most systems have at least a few exploitable holes.
If the attacker is feeling brave and doesn't want to leave any traces, they may elect to simply re-exploit the machine each time they want to get in. Kernel Rootkits Rootkits are sets of tools to replace such system binaries as ls and ps, so that the attacker can evade detection. These can be found relatively quickly if the system is using a program such as Tripwire correctly. However there is a better way to skin the proverbial cat. Remove kernel module manipulation tools.