Skip to main content

Questions tagged [rootkits]

A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications. The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool).

Filter by
Sorted by
Tagged with
7 votes
1 answer
3k views

Is Mac OS safer to use as far as firmware rootkits, cold boot attacks and evil maid?

Windows machines have things like TPM and Secure boot to help protect against firmware rootkits, but is Mac any safer in these regards? How does Mac work in the boot stage and is it any less ...
1 vote
0 answers
78 views

Why do I suddenly receive print notifications on Windows 10? [closed]

I have seen whats's in the image. But i don't have any printer. OS: Windows 10 22H2
1 vote
1 answer
150 views

Can rootkit spread through ATA interface?

I have connected a hard disk containing bootable Windows to a system confirmed to have a rootkit and attached that disk to a couple of other systems through SATA. I'm wondering (It's kind of been ...
1 vote
0 answers
111 views

Is having no driver installed better than having old driver?

How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates? On older PCs and laptops where some components are no ...
0 votes
1 answer
156 views

Successful UEFI secure boot exploitation

Are there any real examples (malware, rootkits, etc.) of exploiting the UEFI secure boot mechanism vulnerabilities such as CVE-2022-21894?
1 vote
3 answers
827 views

What are the the requirements for third party apps to install kernel drivers on Windows?

Can any application install a kernel driver? if not, then how Windows decides who can and who cannot? If AVs can install kernel drivers, considering they are an application with an installer just like ...
-1 votes
1 answer
584 views

How can kon-boot run code in UEFI?

I've now googled a lot, but the only information I can find is 'kon-boot hides its code in BIOS memory and changes kernel-code on the fly'... As far as I understand, UEFI initializes devices and tries ...
3 votes
2 answers
770 views

Detect and remove rootkit from Debian 8.5 (x64)

My Debian 8.5 (x64) server is infected with a rootkit, which I have detected by using a live CD to display the contents of /tmp and /var/tmp. I found out about the infection by seeing high CPU loads ...
0 votes
2 answers
220 views

Running Tails from a non-writable CD vs a USB on a PC with a UEFI infection. Would it comprimise Tails OS when loaded?

Lets say a computers UEFI is infected with a rootkit and you have a copy of Tails written to a USB drive. I am guessing it could possibly infect the Tails OS as well. Well if you were to write tails ...
0 votes
1 answer
1k views

Does secure boot protects against firmware rootkits and GPT bootkits?

This question is related but only partialy answers my question. I know firmware (most notably UEFI firmware) rootkits or bootkits are rare and possiblity to introduce one into system is very low, but ...
1 vote
1 answer
239 views

What firmware components of a PC are writeable?

What firmware components of a PC are writable? For instance which components have the ability to store rootkits or viruses?
0 votes
1 answer
306 views

Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?

For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and ...
0 votes
1 answer
1k views

Is there a difference between a bootkit and a ring-0 rootkit?

I understand the difference between a Ring-0 rootkit and a Ring-3 rootkit, in terms of their hierarchical depth in computational models. That is kernel mode and usermode, respectively. I am confused ...
0 votes
1 answer
185 views

Is it possible to enumerate thru all the hardware IDs?

I am thinking of developing of a rather primitive CLI program for the sole purpose of detecting rootkits/bootkits/firmware modifying advanced malware. Can you iterate thru all all hardware IDs (CPUID,...
2 votes
1 answer
440 views

How to protect yourself from firmware viruses

What componets of a PC do firmware viruses and rootkits infect? Secure boot is supposed to protect you from these types of viruses. Although, it doesn't protect you against rootkits in UEFI firmware ...
26 votes
8 answers
78k views

Detecting and removing Absolute persistence technology

Absolute persistence technology amounts to a persistent rootkit pre-installed by many device manufacturers (Acer, Asus, Dell, HP, Lenovo, Samsung, Toshiba, etc) to facilitate LoJack for laptops, and ...
1 vote
0 answers
284 views

Can a running SSH connection to a rootkit infected VPS be used to attack the remote client?

If a VPS running Debian 10 Xfce as a cloud desktop has been rootkit infected and there is an ongoing SSH connection with X2Go from a client to manage this server, is it possible for an attacker on the ...
3 votes
1 answer
3k views

Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners

All traditional anti-virus software uses signatures to detect known malware after it has been discovered by the software companies and added to the definitions. Heuristic definitions allow a piece ...
4 votes
1 answer
479 views

Is Sleep mode safe?

If a PC has rootkit, when it goes into sleep mode, can rootkit do anything to it while it’s in state of sleeping? Meaning steal data, open programs and basically do anything. Assuming it’s not BIOS ...
1 vote
2 answers
1k views

How to securely create a bootable USB drive from a possibly infected system?

I'm not sure about my system so I want to completely wipe my HDD and reinstall Windows 10. But I realized that an infected system can also infect a USB bootable drive. Unfortunately, I don't have ...
2 votes
2 answers
749 views

What is the difference between "hooking" and "rooting"?

My client did a pentest and he gave us feedback about root detection. So I used RootBeer android lib to fix root detection. In their readme, they highlighted that root detection is a "game of cat ...
2 votes
1 answer
2k views

How to load a malicious LKM at startup?

How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
26 votes
4 answers
5k views

Linux-based Turla trojan

There are several articles describing the newly discovered Linux-based Turla trojan. But basically, all these articles repeat the same, very limited, information. Can anybody provide more details, ...
16 votes
2 answers
3k views

Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?

My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
19 votes
4 answers
2k views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
2 votes
3 answers
1k views

Unsigned windows driver

After regular Windows update I noticed that my video card's driver had suddenly stopped working. I made a rollback to a previous system backup and took a look at this video cards driver's information: ...
2 votes
0 answers
421 views

What is the current (mid-2020) status of hardware rootkit/malware and possible detection/monitoring?

I've posted a question (link) related to a potential compromised computer via SSH access with root user. Although no evidence of a break-in, I'm considering extended measures to ensure (as much as ...
3 votes
2 answers
345 views

how would a 12-digit password be a safe guard in this situation?

So guys, I messed up with the configs in a computer and let the SSH server open to the wild with ROOT login enabled. I'm trying to assess the potential damages, which I may never know for sure. ...
4 votes
2 answers
4k views

Is it risky to buy refurbished phones?

At least in theory, when buying a refurbished phone, is there a chance the phone has been modified, in the same vein as phishing, to look like a stock installation, down to the "factory reset" and ...
1 vote
0 answers
324 views

Hidden Process Discovered in Tails OS

How concerned should I be about this result from unhide? unhide-linux scan starting at: 17:02:43, 2020-03-23 Used options: logtofile [*]Searching for Hidden processes through /proc stat ...
1 vote
1 answer
315 views

Security of a laptop order

What's the likelihood of a laptop being compromised when it comes directly from a trusted computer store or a large, known computer technology company? Would there be any liability if malware or ...
6 votes
3 answers
4k views

what is the difference between boot-sector virus and rootkits?

I have read the definition for both and also read about a few examples for both the cases. I'm still not very sure what the difference is. Is the difference blurred or are there some specific ...
1 vote
0 answers
287 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
-1 votes
1 answer
132 views

Confused as to what changing the internal process of the OS is [closed]

I am a highschool student taking TestOut's Ethical Hacker Pro. Currently I am learning about rootkits and Sirefef. When explaining Sirefef, it says: Sirefef hides itself by altering the internal ...
2 votes
0 answers
3k views

Find out if a process is legitimately allowed to use "shared memory segments"

rkhunter is checking for processes using shared memory segments and warns with output like: Warning: The following suspicious (large) shared memory segments have been found: Process: /usr/bin/python3....
4 votes
1 answer
810 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
-1 votes
1 answer
341 views

Macbook Pro compromised / Rootkit. Are the files I pulled onto my external drive safe? [duplicate]

I am basically positive my macbook pro has been hacked and has a firmware rootkit installed on it, and at this point I have decided it is now a brick and I need to move onto a new computer. The ...
0 votes
1 answer
237 views

Should i update the BIOS

I was reading about BIOS vulnerabilities and rootkits that have flashed malicious code to the BIOS in order to maintain access after a factory reset/operating system install or a hard drive ...
1 vote
2 answers
240 views

PC Component Firmware integrity and security

I recently bought a new laptop. If you read the news you must've noticed Vault 6 and Vault 7 leaks (from Wikileaks), which contain rootkits which sit on your Hard Drive Firmware, MBR and other ...
8 votes
3 answers
20k views

Finding a backdoor on a server?

Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices. The ...
1 vote
2 answers
788 views

Can rootkits hide their internet usage from resource-manager and third party software in windows 10? If so, how?

Lets say I have the latest windows 10 version. I also have DU meter for checking my network usage I know that in windows there is a linked list of processes that many rootkits tend to remove ...
5 votes
1 answer
1k views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
0 votes
0 answers
23 views

How rootkits hide a specified process? [duplicate]

I heard that a rootkit can hide itself and specified files, processes, and network links. I know it can set a file to be hidden, but how does it hide a process? Such as, there is a httpd process ...
3 votes
1 answer
157 views

What tools and techniques do we have at disposal to manually search for rootkits?

I use tools from sysinternals for various tasks (ex. process monitor), but I'm not sure if these programs can be used to manual rootkit detection since rootkit processes can be hiden. Are there any ...
1 vote
2 answers
574 views

Can a rootkit write to a virtual memory of a kernel process and rewrite a instruction to jump into his own malicious code inside that process?

So lets say we have a rootkit on our system can this rootkit write something inside a kernel process? for example in windows, can a rootkit write to ntoskrnl process, changing some functions and ...
2 votes
1 answer
330 views

When to use which rootkit?

According to my understanding so far: a kernel-space rootkits runs in ring0 and use techniques such as syscalls a user-space rootkits runs in ring3 and uses techniques such as library injections ...
24 votes
3 answers
2k views

What is a rootkit?

As a followup to "Tripwire - Is It Security Theater", I'm looking to get a better idea of what a rootkit is. To be more clear: What is a kernel module? What at high-level is the flow for how it's ...
3 votes
1 answer
265 views

How does Windows schedule a thread when the thread has no process?

I have heard that some rootkits try to hide themselves by destroying the process object (nt!_EPROCESS ?) but keeping the thread alive (nt!_ETHREAD ?) . That way they are not visible in tools like Task ...
-1 votes
1 answer
397 views

Can a rootkit hide its data in slack space of pages in memory instead of disk?

So I'm asking about Linux or Windows type of rootkit/malware is this possible? can a rootkit use the slack space in the pages of the memory instead of disk to hide data? if so, has this ever been ...
0 votes
0 answers
282 views

How to spot malwares that hide their disk usage from Resource monitor?

So lets say a malware has hid itself from task manager, so it wont show up in there. lets also say that it also hides its disk usage from resource monitor as well. (based on previously asked ...