A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that?
One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't there easier ways to accomplish this? Or are there even other reasons?