A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications. The term rootkit is a concatenation of "root" (the traditional name of the privileged ...

learn more… | top users | synonyms

2
votes
0answers
25 views

Find the installer of a Rootkit and reason for attack on a Linux OS? [duplicate]

My Linux Jenkins server was compromised and a Rootkit was installed. I know this since a running process tells me the path Jenkins job is running and it includes a URL with path pointing to a Python ...
21
votes
2answers
2k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
0
votes
1answer
35 views

Can standalone malware survive on current mobile devices? [closed]

Can malware run on mobile devices? I don't see how it would be able to (given that those devices have fine-grained permissions and sandboxing). Unlike on a desktop OS, malware cannot access registry ...
1
vote
3answers
68 views

What can manufactures of hardware do to prevent attacks on the firmware?

Given the revelations since The Equation Group was discovered. As well as that it is possible to not guarantee removal of a rootkit even with a nuke from high orbit. What properties of a harddrive ...
1
vote
1answer
81 views

How to minimize the risk posed by Intel AMT/ME's “ring -3 exploits”?

This question is about how to minimize the risk posed by Intel AMT/ME's ring -3 exploits? I'm looking for advice on common strategies and practices. Here is my current situation. I am parking my ...
8
votes
2answers
147 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
-1
votes
2answers
107 views

High Level NSA Target, Help/Feasibility [closed]

I would like to know the feasibility of certain kinds of attacks. To be clear, assume the target is a high-level priority of the NSA. Is an OS such as tails useless against root-kits/keyloggers, ...
4
votes
3answers
149 views

Besides MBR & BIOS, is it possible for a rootkit to stay persistant after a format of the harddrive?

If a system becomes infected and does not have any other storage units besides the one hard drive. Is it there any other way for a rootkit to stay on the system besides infecting the BIOS OR the MBR ...
10
votes
5answers
261 views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...
2
votes
1answer
132 views

Does malware which infects the BIOS/ Firmware always need 'root' access to do so?

There are very few hardend Operating Systems who restrict or totally disable Terminal 'root' access for the user. (1) Would this feature prevent persistant BIOS rootkits from writing into BIOS or ...
21
votes
3answers
2k views

Linux-based Turla trojan

There are several articles describing the newly discovered Linux-based Turla trojan. But basically, all these articles repeat the same, very limited, information. Can anybody provide more details, ...
2
votes
1answer
108 views

How Regin hides running instances of itself?

I have been reading Symantec & Kaspersky Labs analysis of the Regin malware. According to Symantec [Stage 2] can also hide running instances of Stage 1. Once this happens, there are no ...
-1
votes
1answer
142 views

Home PC has been compromised remotely and even after cleaning my PC repeatedly, the problem still comes back, help please? [closed]

I'm a regular guy running two small franchise businesses with a basic understanding of computers etc, (very basic really), but I am certain my home network has been hacked and I am finding lots of new ...
0
votes
1answer
204 views

My computer hacked? tcpdump show a connection to an ALLOCATED UNSPECIFIED ip address

13:06:05.345111 IP 192.168.1.101.36218 > 157.55.130.174.40033: Flags [.], ack 162, win 237, options [nop,nop,TS val 688796 ecr 596714815], length 0 This IP address is Allocated Unspecified on ...
0
votes
1answer
310 views

UEFI secure boot and rootkits

I heard that with UEFI secure boot enabled a custom kernel module that is not signed will not run, hence a rootkit might be difficult to install. Can a secure boot really block rootkit modules from ...
3
votes
2answers
207 views

I ran a virus on a PC. What should be the next steps?

I wanted to remove a probably malicious executable, but instead inadvertently double-clicked on it while using an account with administrative privileges. Nothing visible happened during a few seconds, ...
0
votes
4answers
68 views

post-disk-wipe computer security

I have a standard Dell or Asus-motherboard based computer. it is a hard-disk or RAM. it was hacked remotely. I suspect that they were sophisticated. I am happy to reformat the disk and/or throw it ...
3
votes
1answer
85 views

Freezing creates unusual pattern in kern.log

My server freezed a few days ago. After restarting I immediately checked the logs and the only trace I saw were some dots in the kern.log. To my surprise, a day or two later these dots disappeared ...
2
votes
1answer
197 views

Linux Rootkit / BIOS Malware: What packages are necessary to get infected?

Everybody knows about the dangers of Rootkits / BIOS malware. What do you say about this countermeasure? In order to actually get infected the malware needs to use the OS to 'patch' the BIOS chip. ...
5
votes
5answers
2k views

Is it possible for a phone to be transmitting even while turned off and the battery removed?

Is it technically or theoretically possible for any part of a mobile phone's circuitry to be still on and transmitting even while turned off and the battery has been removed? If so, how? I am ...
0
votes
1answer
55 views

Questions about common exploits

I'm investigating the state of my MacBook Pro which I know was compromised, and do not know if I removed the exploits completely (and I realize, technically will never know this). I'm trying to hone ...
0
votes
1answer
51 views

Is an Antivirus scan via network share equivalent to an offline scan of the system?

When a system is suspected to be infected, one of the measures often recommended for cleaning the system (without actually taking the "nuke from orbit" approach) is to scan the drive with anti-malware ...
7
votes
3answers
922 views

How does a root kit work inside a virtual machine?

In my class, we are discussing virtual machine based root kits. I've research root kits, but could not find any information specifically talking about how root kits work inside of virtual machines ...
2
votes
1answer
811 views

How to detect infected devices on your local network [closed]

Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone ...
5
votes
1answer
286 views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
1
vote
1answer
299 views

Linux kernel 3+ system call table modification detection [closed]

Is there any available tool which can check kernel 3+ system call table for modifications? Also I want to know, is there any automated general tool to check Linux for unknown rootkits? Not like ...
2
votes
1answer
76 views

After restoring from a (valid) full disk backup can malware still persit?

In the comments to this question it is mentioned that even after a backup recovery malware still can persist. Do I understand that correctly? How is this possible? If Acronis True Image is used to ...
10
votes
2answers
4k views

Detecting and removing Absolute persistance technology

Absolute persistance technology amounts to a persistent rootkit pre-installed by many device manufacturers (Acer, Asus, Dell, HP, Lenovo, Samsung, Toshiba, etc) to facilitate LoJack for laptops, and ...
3
votes
1answer
218 views

Does reinstalling ubuntu eliminates all existing rootkits/ malware/spyware/ virus etc?

If I do a fresh installation of ubuntu from an uninfected cd, will it remove all the existing rootkits/malwares/spywares/viruses etc if any ? Is formatting the hard disk required before reinstalling ...
-2
votes
2answers
381 views

What if I've been hacked and my IP is static? [closed]

My computer has a rootkit of some sort and the attacker can see everything that I do on it. I need it to do something related to banking, so I have to secure my computer first. I have a CD of windows ...
1
vote
2answers
263 views

Malware getting root access via “sudo” and “sudo -s”

Actually, I'd like to ask 3 questions. But since they are very related, I'll ask them all here. I use Ubuntu 12.04.4. Situation 1: I use Terminator, in one of its terminals I launch sudo iotop ...
1
vote
1answer
377 views

RK Hunter Warns about /usr/lib/apache2/mpm-event/apache2 uses deleted files, how to further investigate the matter and how shall I treat it?

I have a cloud server that I am preparing for a small E-Commerce website deployment. I've used a RSA-2048 keys right before booting the newly purchased server, with the help of the Provider's Control ...
1
vote
2answers
636 views

Is badBIOS real? [closed]

We've heard a lot about badBIOS and how low level rootkits can be used to exploit/bypass traditional security but can this story be true? bypass operating system security hide from the system ...
20
votes
2answers
3k views

How would one know if they have a rootkit?

Are they impossible to detect? Seeing as the attacker has admin rights and could modify anti virus software that might otherwise be used to detect or circumvent a root kit. Are there certain red flags ...
1
vote
0answers
149 views

Does Windows 8 UEFI Trusted Boot protect SSDT table from modification?

I read from a link that says: Trusted Boot takes over where Secure Boot leaves off. The bootloader verifies the digital signature of the Windows 8 kernel before loading it. The Windows 8 kernel, ...
1
vote
0answers
57 views

How to remove rootkits and malware? [duplicate]

I have downloaded and ran the programme Rootkit Hunter and the results are worrying. I don't know much about malware other than a malicious individual has persistently been installing it onto my ...
3
votes
1answer
536 views

Tools to analyze Hooks on Windows 7 / 2008, x64 platform [closed]

What tool can I use to analyze Hooks (SSDT, Inline etc.) on Windows 7 / 2008? (x64 Platform) Rku (Rootkit Unhooker) is the only tool I know, which is not available for x64 platforms.
3
votes
1answer
1k views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
7
votes
3answers
502 views

Is it safer to compile open source code vs simply running the binary?

I understand that with OpenSource software, my milage may vary based on the trust of the author and the distribution platform they use (Codeplex, Git, or private server). Oftentimes a FOSS website ...
1
vote
1answer
576 views

I wonder if my MacBook Pro with OS X got hacked?

Maybe I am getting a little paranoid. Lately my MacBook Pro with Mac OS X 10.8.2 is behaving a little different the usual. The last strange thing that happend was that in iTerm2 when I tried to sudo ...
1
vote
1answer
396 views

Is suspicious network activity likely to be caused by a rootkit?

Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass ...
1
vote
1answer
484 views

Macbook pro, rootkithunter

I've never really tried to understand rootkit enough, I'm too much paranoid... I recently reinstalled mountain lion, but my EFI might be infected. I have a macbook pro, it was really slow at some ...
4
votes
3answers
1k views

what is the difference between boot-sector virus and rootkits?

I have read the definition for both and also read about a few examples for both the cases. I'm still not very sure what the difference is. Is the difference blurred or are there some specific ...
3
votes
2answers
458 views

How to practically detect current system net traffic?

I know that some viruses or trojans can install rootkits or bootkits to change system's normal behaviour; AFAIK for example filter queries for running processes or even hide active TCP ports. My ...
4
votes
2answers
1k views

How helpful is rkhunter?

I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website. With these things already in place, do ...
4
votes
3answers
2k views

how to detect the origin of a hacker attempting to breach or who has sucesfully breached a network or system

In the case of detecting that a system is infected with a root-kit, what if any thing can be done to trace route the origins of the remote out going packets to attempt to find out where the attacker ...
4
votes
1answer
844 views

Icesword rootkit detector, How does it work?

I'm curious about how I can learn more about icesword rootkit detector. I've only used it and never studied it myself. Ive always been curious how it works. As far as I understand it works by ...
5
votes
1answer
628 views

TPM bootstrap process

Assume that the file partition where the PC operating system and user data reside are sealed by a number of PCRs (Platform Configuration Registers) dedicated to BIOS measurements. What happens during ...
12
votes
2answers
561 views

How to analyze a rootkit?

The other a friend of mine sent me a rootkit/code he found on a server that was exploited (php cgi exploit). Now I was thinking of having a look at it, but I was wondering if there are some basic ...
17
votes
3answers
829 views

Why do rootkits hide in drivers?

A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that? One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't ...