Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [rootkits]

A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications. The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool).

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

chkrootkit output interpretation help [closed]

I ran the following command: sudo chkrootkit -x | more And the output is as follows: ROOTDIR is `/' not found ### ### Output of: /usr/bin/strings -a /usr/bin/basename ### @(#)PROGRAM:basename ...
dumbdump's user avatar
1 vote
0 answers
16 views

How to enable USB debugging mode when it has been disabled [migrated]

I have a Samsung Android which I am almost certain has malware/a rootkit on it. I'd like to take a forensic image of the device. In developer mode, the 'USB debugging' mode is shaded in and set to off....
chickenj0's user avatar
1 vote
0 answers
71 views

Why do I suddenly receive print notifications on Windows 10? [closed]

I have seen whats's in the image. But i don't have any printer. OS: Windows 10 22H2
priv-like-user's user avatar
1 vote
0 answers
107 views

Is having no driver installed better than having old driver?

How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates? On older PCs and laptops where some components are no ...
Shubham Deshmukh's user avatar
1 vote
1 answer
145 views

Can rootkit spread through ATA interface?

I have connected a hard disk containing bootable Windows to a system confirmed to have a rootkit and attached that disk to a couple of other systems through SATA. I'm wondering (It's kind of been ...
Shimla's user avatar
  • 11
0 votes
1 answer
152 views

Successful UEFI secure boot exploitation

Are there any real examples (malware, rootkits, etc.) of exploiting the UEFI secure boot mechanism vulnerabilities such as CVE-2022-21894?
Artem S. Tashkinov's user avatar
-1 votes
1 answer
561 views

How can kon-boot run code in UEFI?

I've now googled a lot, but the only information I can find is 'kon-boot hides its code in BIOS memory and changes kernel-code on the fly'... As far as I understand, UEFI initializes devices and tries ...
BlackFlag's user avatar
0 votes
1 answer
293 views

Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?

For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and ...
User4857's user avatar
0 votes
1 answer
1k views

Is there a difference between a bootkit and a ring-0 rootkit?

I understand the difference between a Ring-0 rootkit and a Ring-3 rootkit, in terms of their hierarchical depth in computational models. That is kernel mode and usermode, respectively. I am confused ...
questioner's user avatar
7 votes
1 answer
3k views

Is Mac OS safer to use as far as firmware rootkits, cold boot attacks and evil maid?

Windows machines have things like TPM and Secure boot to help protect against firmware rootkits, but is Mac any safer in these regards? How does Mac work in the boot stage and is it any less ...
Rideboards's user avatar
0 votes
2 answers
209 views

Running Tails from a non-writable CD vs a USB on a PC with a UEFI infection. Would it comprimise Tails OS when loaded?

Lets say a computers UEFI is infected with a rootkit and you have a copy of Tails written to a USB drive. I am guessing it could possibly infect the Tails OS as well. Well if you were to write tails ...
Rideboards's user avatar
1 vote
1 answer
233 views

What firmware components of a PC are writeable?

What firmware components of a PC are writable? For instance which components have the ability to store rootkits or viruses?
Rideboards's user avatar
0 votes
1 answer
175 views

Is it possible to enumerate thru all the hardware IDs?

I am thinking of developing of a rather primitive CLI program for the sole purpose of detecting rootkits/bootkits/firmware modifying advanced malware. Can you iterate thru all all hardware IDs (CPUID,...
Sir Muffington's user avatar
2 votes
1 answer
429 views

How to protect yourself from firmware viruses

What componets of a PC do firmware viruses and rootkits infect? Secure boot is supposed to protect you from these types of viruses. Although, it doesn't protect you against rootkits in UEFI firmware ...
Rideboards's user avatar
1 vote
0 answers
279 views

Can a running SSH connection to a rootkit infected VPS be used to attack the remote client?

If a VPS running Debian 10 Xfce as a cloud desktop has been rootkit infected and there is an ongoing SSH connection with X2Go from a client to manage this server, is it possible for an attacker on the ...
user avatar
1 vote
2 answers
1k views

How to securely create a bootable USB drive from a possibly infected system?

I'm not sure about my system so I want to completely wipe my HDD and reinstall Windows 10. But I realized that an infected system can also infect a USB bootable drive. Unfortunately, I don't have ...
user avatar
4 votes
1 answer
466 views

Is Sleep mode safe?

If a PC has rootkit, when it goes into sleep mode, can rootkit do anything to it while it’s in state of sleeping? Meaning steal data, open programs and basically do anything. Assuming it’s not BIOS ...
heilo's user avatar
  • 41
2 votes
2 answers
729 views

What is the difference between "hooking" and "rooting"?

My client did a pentest and he gave us feedback about root detection. So I used RootBeer android lib to fix root detection. In their readme, they highlighted that root detection is a "game of cat ...
TooCool's user avatar
  • 205
2 votes
0 answers
413 views

What is the current (mid-2020) status of hardware rootkit/malware and possible detection/monitoring?

I've posted a question (link) related to a potential compromised computer via SSH access with root user. Although no evidence of a break-in, I'm considering extended measures to ensure (as much as ...
Johnny Dosh's user avatar
3 votes
2 answers
340 views

how would a 12-digit password be a safe guard in this situation?

So guys, I messed up with the configs in a computer and let the SSH server open to the wild with ROOT login enabled. I'm trying to assess the potential damages, which I may never know for sure. ...
Johnny Dosh's user avatar
1 vote
0 answers
319 views

Hidden Process Discovered in Tails OS

How concerned should I be about this result from unhide? unhide-linux scan starting at: 17:02:43, 2020-03-23 Used options: logtofile [*]Searching for Hidden processes through /proc stat ...
Patriot's user avatar
  • 297
1 vote
1 answer
313 views

Security of a laptop order

What's the likelihood of a laptop being compromised when it comes directly from a trusted computer store or a large, known computer technology company? Would there be any liability if malware or ...
user224380's user avatar
1 vote
0 answers
286 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
Hercslure's user avatar
-1 votes
1 answer
130 views

Confused as to what changing the internal process of the OS is [closed]

I am a highschool student taking TestOut's Ethical Hacker Pro. Currently I am learning about rootkits and Sirefef. When explaining Sirefef, it says: Sirefef hides itself by altering the internal ...
Jordan Baron's user avatar
2 votes
0 answers
3k views

Find out if a process is legitimately allowed to use "shared memory segments"

rkhunter is checking for processes using shared memory segments and warns with output like: Warning: The following suspicious (large) shared memory segments have been found: Process: /usr/bin/python3....
rubo77's user avatar
  • 2,390
4 votes
1 answer
805 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
Max's user avatar
  • 97
-1 votes
1 answer
337 views

Macbook Pro compromised / Rootkit. Are the files I pulled onto my external drive safe? [duplicate]

I am basically positive my macbook pro has been hacked and has a firmware rootkit installed on it, and at this point I have decided it is now a brick and I need to move onto a new computer. The ...
Mumen's user avatar
  • 1
0 votes
1 answer
235 views

Should i update the BIOS

I was reading about BIOS vulnerabilities and rootkits that have flashed malicious code to the BIOS in order to maintain access after a factory reset/operating system install or a hard drive ...
Jerry's user avatar
  • 29
1 vote
2 answers
237 views

PC Component Firmware integrity and security

I recently bought a new laptop. If you read the news you must've noticed Vault 6 and Vault 7 leaks (from Wikileaks), which contain rootkits which sit on your Hard Drive Firmware, MBR and other ...
Sir Muffington's user avatar
1 vote
3 answers
818 views

What are the the requirements for third party apps to install kernel drivers on Windows?

Can any application install a kernel driver? if not, then how Windows decides who can and who cannot? If AVs can install kernel drivers, considering they are an application with an installer just like ...
OneAndOnly's user avatar
1 vote
2 answers
783 views

Can rootkits hide their internet usage from resource-manager and third party software in windows 10? If so, how?

Lets say I have the latest windows 10 version. I also have DU meter for checking my network usage I know that in windows there is a linked list of processes that many rootkits tend to remove ...
OneAndOnly's user avatar
0 votes
0 answers
23 views

How rootkits hide a specified process? [duplicate]

I heard that a rootkit can hide itself and specified files, processes, and network links. I know it can set a file to be hidden, but how does it hide a process? Such as, there is a httpd process ...
qg_java_17137's user avatar
2 votes
1 answer
325 views

When to use which rootkit?

According to my understanding so far: a kernel-space rootkits runs in ring0 and use techniques such as syscalls a user-space rootkits runs in ring3 and uses techniques such as library injections ...
meoware's user avatar
  • 373
-1 votes
1 answer
394 views

Can a rootkit hide its data in slack space of pages in memory instead of disk?

So I'm asking about Linux or Windows type of rootkit/malware is this possible? can a rootkit use the slack space in the pages of the memory instead of disk to hide data? if so, has this ever been ...
Max's user avatar
  • 97
1 vote
2 answers
562 views

Can a rootkit write to a virtual memory of a kernel process and rewrite a instruction to jump into his own malicious code inside that process?

So lets say we have a rootkit on our system can this rootkit write something inside a kernel process? for example in windows, can a rootkit write to ntoskrnl process, changing some functions and ...
Max's user avatar
  • 97
0 votes
0 answers
277 views

How to spot malwares that hide their disk usage from Resource monitor?

So lets say a malware has hid itself from task manager, so it wont show up in there. lets also say that it also hides its disk usage from resource monitor as well. (based on previously asked ...
Mery Ted's user avatar
  • 363
0 votes
1 answer
1k views

Does secure boot protects against firmware rootkits and GPT bootkits?

This question is related but only partialy answers my question. I know firmware (most notably UEFI firmware) rootkits or bootkits are rare and possiblity to introduce one into system is very low, but ...
user avatar
3 votes
1 answer
155 views

What tools and techniques do we have at disposal to manually search for rootkits?

I use tools from sysinternals for various tasks (ex. process monitor), but I'm not sure if these programs can be used to manual rootkit detection since rootkit processes can be hiden. Are there any ...
user avatar
1 vote
1 answer
110 views

Discrepancies between rkhunter itemized report and summary

I am new to rkhunter, which I have been using on Lubuntu 18.04. While it is running, it indicates an itemized scan of rootkits in two waves. First, it states: Performing check of known rootkit files ...
Absurdistan's user avatar
2 votes
0 answers
553 views

Weird Python script found on a Mac Os X client machine [closed]

I was reviewing a Mac Os X machine (a late 2016 MacBook Pro) and I found some weird scripts in the LaunchAgent folder. 8 -rw-r--r-- 1 XX wheel 500 30 Lug 07:18 com.1e1zq.plist 8 -rw-r--r-- 1 XX ...
elbuild's user avatar
  • 121
0 votes
1 answer
2k views

Is it possible for the firmware of an SSD be infected by malware/malicious rootkits via the internet?

I am asking this because based on Snowden's relevations, bad actors "interdict" (intercept) shipments of routers, HDDs, SSDs, servers, etc., install malicious rootkits and spyware in the firmware and ...
ssdhddinfected's user avatar
3 votes
1 answer
1k views

Remove malicious rootkits and spyware from HDDs and SSDs

I have read at least twenty articles dating from the time Edward Snowden's startling revelations about rogue nations and bad actors embedding malicious rootkits and spyware in the firmware of hard ...
ssdhddinfected's user avatar
2 votes
0 answers
51 views

My server is compromised through apache - help! [duplicate]

As mentioned previously, I cannot physically remove the server from the internet as I do not have physical access. So, very little information in the ticket marked duplicate is relevant. I am going ...
Matt Innes's user avatar
0 votes
1 answer
617 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
uofc's user avatar
  • 135
2 votes
3 answers
5k views

How to remove MBR Rootkits/bootkits?

How do I remove them from internal hard drives and USB sticks? Can they infect MicroSD cards as well or anything else? DVD? cd? Heard it's possible to do with a live CD via formatting. What are best ...
Alister's user avatar
  • 77
1 vote
1 answer
312 views

Somebody called a number from a pop-up on their MacOS computer and installed a program called GoToAssist. What is the best course of action now? [duplicate]

Somebody I know saw a pop-up on their iMac running Sierra (10.13.5) that advised them to call 877-336-5833. They called the number and the representative advised that they install a program called "...
chaimp's user avatar
  • 113
3 votes
2 answers
758 views

Detect and remove rootkit from Debian 8.5 (x64)

My Debian 8.5 (x64) server is infected with a rootkit, which I have detected by using a live CD to display the contents of /tmp and /var/tmp. I found out about the infection by seeing high CPU loads ...
Shuzheng's user avatar
  • 1,237
2 votes
2 answers
1k views

Does Windows protect MBR from being overwritten?

I have read article about TDL/Alureon Rootkit: According to research published on Monday by GFI Software, the latest TDL4 installation penetrates 64-bit versions of Windows by bypassing the OS’s ...
n00p's user avatar
  • 121
5 votes
1 answer
285 views

How can a rootkit infect Windows without signed driver file?

Windows 7 64 bit and newer versions feature Driver Signature Enforcement, which prevents loading an unsigned driver. Then how can some kernel-mode rootkits infect Windows? I rea Lets say, some user ...
noop's user avatar
  • 51
-1 votes
1 answer
568 views

What should I do if C:\Windows\System32\svchost.exe got infected? [duplicate]

The original svchost.exe file in my Windows XP was changed with a malicious copy, I think this is easy to do on Windows XP. How am I supposed to return it to the clean original without crashing the ...
Kalkal Bolblbl's user avatar