Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [rootkits]

A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications. The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool).

0
votes
0answers
58 views

How to spot malwares that hide their disk usage from Resource monitor?

So lets say a malware has hid itself from task manager, so it wont show up in there. lets also say that it also hides its disk usage from resource monitor as well. (based on previously asked ...
0
votes
1answer
60 views

Does secure boot protects against firmware rootkits and GPT bootkits?

This question is related but only partialy answers my question. I know firmware (most notably UEFI firmware) rootkits or bootkits are rare and possiblity to introduce one into system is very low, but ...
2
votes
0answers
34 views

What tools and techniques do we have at disposal to manually search for rootkits?

I use tools from sysinternals for various tasks (ex. process monitor), but I'm not sure if these programs can be used to manual rootkit detection since rootkit processes can be hiden. Are there any ...
1
vote
1answer
26 views

Discrepancies between rkhunter itemized report and summary

I am new to rkhunter, which I have been using on Lubuntu 18.04. While it is running, it indicates an itemized scan of rootkits in two waves. First, it states: Performing check of known rootkit files ...
1
vote
0answers
191 views

Weird Python script found on a Mac Os X client machine

I was reviewing a Mac Os X machine (a late 2016 MacBook Pro) and I found some weird scripts in the LaunchAgent folder. 8 -rw-r--r-- 1 XX wheel 500 30 Lug 07:18 com.1e1zq.plist 8 -rw-r--r-- 1 XX ...
0
votes
1answer
190 views

Is it possible for the firmware of an SSD be infected by malware/malicious rootkits via the internet?

I am asking this because based on Snowden's relevations, bad actors "interdict" (intercept) shipments of routers, HDDs, SSDs, servers, etc., install malicious rootkits and spyware in the firmware and ...
3
votes
1answer
146 views

Remove malicious rootkits and spyware from HDDs and SSDs

I have read at least twenty articles dating from the time Edward Snowden's startling revelations about rogue nations and bad actors embedding malicious rootkits and spyware in the firmware of hard ...
2
votes
0answers
48 views

My server is compromised through apache - help! [duplicate]

As mentioned previously, I cannot physically remove the server from the internet as I do not have physical access. So, very little information in the ticket marked duplicate is relevant. I am going ...
0
votes
1answer
86 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
2
votes
3answers
1k views

How to remove MBR Rootkits/bootkits?

How do I remove them from internal hard drives and USB sticks? Can they infect MicroSD cards as well or anything else? DVD? cd? Heard it's possible to do with a live CD via formatting. What are best ...
1
vote
1answer
130 views

Somebody called a number from a pop-up on their MacOS computer and installed a program called GoToAssist. What is the best course of action now? [duplicate]

Somebody I know saw a pop-up on their iMac running Sierra (10.13.5) that advised them to call 877-336-5833. They called the number and the representative advised that they install a program called "...
2
votes
1answer
187 views

Detect and remove rootkit from Debian 8.5 (x64)

My Debian 8.5 (x64) server is infected with a rootkit, which I have detected by using a live CD to display the contents of /tmp and /var/tmp. I found out about the infection by seeing high CPU loads ...
2
votes
2answers
216 views

Does Windows protect MBR from being overwritten?

I have read article about TDL/Alureon Rootkit: According to research published on Monday by GFI Software, the latest TDL4 installation penetrates 64-bit versions of Windows by bypassing the OS’s ...
6
votes
1answer
109 views

How can a rootkit infect Windows without signed driver file?

Windows 7 64 bit and newer versions feature Driver Signature Enforcement, which prevents loading an unsigned driver. Then how can some kernel-mode rootkits infect Windows? I rea Lets say, some user ...
-1
votes
1answer
192 views

What should I do if C:\Windows\System32\svchost.exe got infected? [duplicate]

The original svchost.exe file in my Windows XP was changed with a malicious copy, I think this is easy to do on Windows XP. How am I supposed to return it to the clean original without crashing the ...
1
vote
1answer
55 views

Access encrypted system/files with rootkit

I have encrypted files that I need access to but I believe the BIOS/UFEI/hardware or recovery partition have a rootkit or keylogger now in order to get my encryption password for the encrypted system ...
3
votes
1answer
431 views

Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners

All traditional anti-virus software uses signatures to detect known malware after it has been discovered by the software companies and added to the definitions. Heuristic definitions allow a piece ...
-2
votes
1answer
212 views

What exactly is the meaning of 'trojan' and 'rootkit'? [duplicate]

I know both are a type of malware, trojans 'disguise them self as a useful program' and rootkits 'embed them self in the system to avoid detection'. Technically how do they accomplish such things? I'm ...
1
vote
1answer
232 views

SSD Wipe to remove known & unknown malware [duplicate]

Does anyone know of a method to wipe a HDD that gives a high degree of confidence that any malware present will not persist when the OS is reinstalled? Using tools on Linux and/or Windows? We have ...
3
votes
4answers
211 views

How To give someone a shell in my local net without security risks?

I have a server A in my local network in my house. I want to allow someone to come to that server using a reverse ssh connection from my server to his server from which he can get to my server. I don'...
2
votes
1answer
388 views

How to load a malicious LKM at startup?

How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
1
vote
0answers
329 views

Can VBR rootkit survive format?

I found this article which talks about a rootkit which infects the VBR and creates a virtual file system in unallocated space between partitions. I know that there are MBR rootkits which cannot be ...
0
votes
1answer
90 views

can a malware conceal true browser history

Suppose a zero-access malware like TDSS/Blue pill Kernel rootkit invades. If it opens any of my logged-in sites (2FA enabled, so that they can't just go incognito or open in any other browsers or ...
1
vote
1answer
59 views

There is a recommanded solution to protect SRP verifier to be used if the DB is leaked?

We working on a new website we would like to use SRP protocol. So the salt and verifier are sent to the server, and in theory the server store them like that in a database. If the DB is leaked, ...
0
votes
1answer
111 views

chkrootkit weird output DEBIAN 9 [closed]

I recently had this in the chkrootkit output comparison : +! 7:0| 255 0:0|242:0|243:0|245:0|253:1|254:1|7:0| -stringPrefs 3:7;release|174:3;1.0|191:332; ¼½¾ǃː??։֊׃״܁܂܃܄ᅟᅠ᜵           ???‐’․‧?...
4
votes
3answers
1k views

Should I be worried about rootkits?

*Note: My question is quite specific to my situation. Although there may be an answer out there, I am unsure how to search it. * I am curious to understand more about optimizing my internet speed for ...
0
votes
0answers
645 views

BIOS rootkit : Computrace and Wiping SSD HPA on Linux + protect it with custom encryption

My primary goal is to close firmware backoors. First, I want to know if my plan might work or not, and if it is a good idea, how to implement it: I erased preinstalled Windows and installed Linux ...
1
vote
0answers
60 views

Is there a way to install a rootkit without kernel headers?

I was just wonderin, is there a way to create a rootkit without the kernel header files? I'm trying to have fun with a mips device and I'm curious if there is another way to infect it.
0
votes
1answer
378 views

How do you assess if your computer has a hardware rootkit? [closed]

How do you assess if your computer has a hardware rootkit? There was another question about Chipsec with no answers, I assume no one knows the answer. Any other way to assess?
1
vote
1answer
445 views

XSS attack on to get root priveleges

Is there any way of execute an xss attack inside a Linux machine to get to sudo mode? I know Linux is designed to separate the two types of user. I guess, i don't really know but I guess diferent ...
4
votes
1answer
130 views

How does Windows schedule a thread when the thread has no process?

I have heard that some rootkits try to hide themselves by destroying the process object (nt!_EPROCESS ?) but keeping the thread alive (nt!_ETHREAD ?) . That way they are not visible in tools like Task ...
1
vote
1answer
461 views

Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?

To be honest, I'm not really sure the best title for this question, or the full scope of it, but the motivation behind it is: Motivation Assume your server was hacked, you open up your UTF-8 encoded ...
1
vote
1answer
177 views

Can malware attach itself to user files?

Recently my AV has been detecting Trojan backdoors, Rootkits and Worms quite often. Some go unnoticed (I've checked suspicious files in VirusTotal a few times and they indeed turned out to be malware ...
1
vote
2answers
113 views

Clearing/Securing an android device from untrusted source

There has been at least one notable case of a minor seller/brand shipping android phones with malware pre-baked, and some threads have already discussed that a factory reset won't necessarily kill ...
1
vote
3answers
729 views

Unsigned windows driver

After regular Windows update I noticed that my video card's driver had suddenly stopped working. I made a rollback to a previous system backup and took a look at this video cards driver's information: ...
1
vote
0answers
614 views

busybox rootkit?

I use Buildroot zImage and kernel build for my rpis and busybox for my Linux command box. It's the second time I seem to have a rootkit, a root sh history give me that, so my question is: is it a ...
-1
votes
1answer
131 views

Buffer overflow process in my server(How detect rootkit)? [duplicate]

Today i'm update my web server on Cent OS 6 and like this if see top 2593 root 20 0 196m 5228 212 S 730.6 0.1 484:18.06 wjeackglrl 8648 bitrix 20 0 399m 85m 7580 R 42.5 2.2 0:23....
0
votes
1answer
72 views

Possible ways for hackers to alter kernel behaviour without root [closed]

I'm wondering is it possible to harm kernel (by injecting shared library, loadable module or something like that) without root. If yes, how hackers can achieve it?
2
votes
1answer
545 views

How hypervisor rootkits create network connections?

How hypervisor rootkits create network connections to exfiltrate data? They don't have access to the underlying OS syscalls, right? Because they are usually programmed with VTx Intel instructions in ...
3
votes
2answers
298 views

Randomizing system call numbers to prevent rootkits?

I've heard of rootkits that infect computers by first having a simple virus infect the computer, make a call to the "command" computer containing the target computer's specs. With the specs, the ...
3
votes
1answer
125 views

How does Android prevent me from installing custom system services?

I am trying to understand the secure boot process. Lets say the firmware is locked and only does signed installation of an OS image. This "image" is a compressed bundle of all the binaries needed by ...
-1
votes
2answers
332 views

I have a very bizarre malware that I cannot seem to get rid of [closed]

Here is my horror story that I thought I would share to see if one had any great suggestions and maybe would be interested in researching my problem because it is very fascinating. If you are ...
0
votes
1answer
332 views

What is sizeofblock used for in image_base_relocation table?

I am looking at the dll loader in carberp and there is this line i dont understand. for (DWORD i = 0; i < ((Relocation->SizeOfBlock - IMAGE_SIZEOF_BASE_RELOCATION) / 2 ); i++, RelInfo++ ) You ...
2
votes
2answers
2k views

How does malware load a dll from memory

I am trying to understand how malware loads a dll from memory, like from a resource section. I am seeing codes all over google but i cant find sort of a pseudocode like in simple english that can ...
1
vote
1answer
100 views

Does periodically rebooting secure-boot-enabled devices improve security by preventing persistent compromise?

Many devices now enforce verified/trusted/secure boot, which according to Wikipedia "will only allow signed software to run on the device." Platforms that support this feature include Android, iOS, ...
5
votes
1answer
373 views

How does a ring 3 rootkit manage to modify files in /etc and/or /usr?

A recent article spiked my curiosity; please bare with me, I'm no security expert but just a Linux admin. This states that the rootkit runs from userspace, but modifies /etc/so.preload and creates ...
2
votes
2answers
1k views

Refurbished phones…risky?

At least in theory, when buying a refurbished phone, is there a chance the phone has been modified, in the same vein as phishing, to look like a stock installation, down to the "factory reset" and ...
1
vote
0answers
182 views

Buffer overflow Rooting vs SU via recovery?

After researching on rooting processes low level details and techniques i found that it happens mostly through Buffer overflow to gain root access via running payload ( binaries ) at return call ...
4
votes
2answers
2k views

Can Restarting An Infected Computer Make It Worse?

I seem to remember that rebooting a potentially infected Windows PC before removing the malware may allow it to take advantage of early boot up states that may be vulnerable if the security measures ...
3
votes
1answer
714 views

Is a rootkit not an exploit?

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that rootkits aren't exploits. Is this true? I thought an exploit included any software that was used to ...