Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have read the definition for both and also read about a few examples for both the cases. I'm still not very sure what the difference is. Is the difference blurred or are there some specific characteristics that sets them apart from each other?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

A rootkit works by changing the output of system actions. This could be by replacing standard commands such as ls with other tools. It can also be by modifying libraries or kernel code. Rootkits don't necessarily take advantage of an exploit, but rather the user. They may rely on another exploit to place them.

Boot sector viruses are a subset of rootkits, but the term is far older. It referred specifically to viruses that would alter to the boot sector of a hard drive to launch themselves on reboot. They have a connotation of harking from the era when MS DOS was still a substantial piece of the personal computing world. Being from simpler times, the viruses were often simpler and didn't always need booting to another OS instance to detect. Despite that, their launch early in the boot process could provide them with all the potential power that we associate with rootkits.

Even the technical difference between the terms is very muddled. It is possible that code could be considered just a rootkit, just a boot sector virus, or both. As far as common speach goes, I think it is most common to refer to modern viruses that fit the definition of both as rootkits. I can't think of any notable contemporary malware that is considered to be merely a boot sector virus.

share|improve this answer
2  
Rootkits don't necessarily provide privilege escalation. Really - I always thought that was the definition. A kit for becoming root. –  Henning Klevjer Nov 19 '12 at 8:04
2  
I suppose I worded that poorly. Will edit. –  Jeff Ferland Nov 19 '12 at 8:17
    
I always read 'rootkit' as 'a kit, running as root, for hiding other code'. –  randomdude Nov 19 '12 at 10:41

A boot sector virus loads himself from the boot record then executes the real boot sector, which is saved to somewhere else on the disk. It doesn't really take care of hiding himself. There were problems if the same boot sector virus came because it didn't check the presence of the previous instance, so overwrote the real boot sector on the disk with previous instance of himself - so no boot possible until reinstalling at least the systemfiles. This kind of malware belongs to DOS-era.

A rootkit mainly hides processes, so it could download and install other malwares, backdoors etc.

share|improve this answer

A boot sector virus that runs from the boot sector and doesn't bother hiding itself is just a boot sector virus.

A boot sector virus that actively protects its storage in the boot sector, hides itself from detection and actively intercepts scans attempting to detect its operation is part of a root-kit.

Boot Sector viruses have been around since Brain, the first MS-DOS virus created, and was easily scanned and removed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.