Skip to main content

Questions tagged [rootkits]

A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications. The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool).

18 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
287 views

Does Windows 8 UEFI Trusted Boot protect SSDT table from modification?

I read from a link that says: Trusted Boot takes over where Secure Boot leaves off. The bootloader verifies the digital signature of the Windows 8 kernel before loading it. The Windows 8 kernel, ...
Jos8ph's user avatar
  • 31
2 votes
0 answers
421 views

What is the current (mid-2020) status of hardware rootkit/malware and possible detection/monitoring?

I've posted a question (link) related to a potential compromised computer via SSH access with root user. Although no evidence of a break-in, I'm considering extended measures to ensure (as much as ...
Johnny Dosh's user avatar
2 votes
0 answers
3k views

Find out if a process is legitimately allowed to use "shared memory segments"

rkhunter is checking for processes using shared memory segments and warns with output like: Warning: The following suspicious (large) shared memory segments have been found: Process: /usr/bin/python3....
rubo77's user avatar
  • 2,390
2 votes
0 answers
648 views

Can VBR rootkit survive format?

I found this article which talks about a rootkit which infects the VBR and creates a virtual file system in unallocated space between partitions. I know that there are MBR rootkits which cannot be ...
zack's user avatar
  • 31
2 votes
0 answers
265 views

Can linux cgroups and namespaces assist hiding malware?

Reading about sandboxing/security possibilities I was looking a bit into cgroups and namespaces and asked myself: How do I know that my linux root account is indeed the real root account and not ...
humanityANDpeace's user avatar
2 votes
0 answers
234 views

What protections are put in place to prevent rootkits from getting ring 0 access?

I've been learning about What is a rootkit? As well as rootkit building and general system architecture. I have read that there are "User mode" rootkits that run in ring 3. But these aren't the ...
Digital fire's user avatar
  • 3,186
1 vote
0 answers
111 views

Is having no driver installed better than having old driver?

How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates? On older PCs and laptops where some components are no ...
Shubham Deshmukh's user avatar
1 vote
0 answers
284 views

Can a running SSH connection to a rootkit infected VPS be used to attack the remote client?

If a VPS running Debian 10 Xfce as a cloud desktop has been rootkit infected and there is an ongoing SSH connection with X2Go from a client to manage this server, is it possible for an attacker on the ...
user avatar
1 vote
0 answers
324 views

Hidden Process Discovered in Tails OS

How concerned should I be about this result from unhide? unhide-linux scan starting at: 17:02:43, 2020-03-23 Used options: logtofile [*]Searching for Hidden processes through /proc stat ...
Patriot's user avatar
  • 297
1 vote
0 answers
287 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
Hercslure's user avatar
1 vote
0 answers
139 views

Is there a way to install a rootkit without kernel headers?

I was just wonderin, is there a way to create a rootkit without the kernel header files? I'm trying to have fun with a mips device and I'm curious if there is another way to infect it.
robertroja's user avatar
1 vote
0 answers
934 views

busybox rootkit?

I use Buildroot zImage and kernel build for my rpis and busybox for my Linux command box. It's the second time I seem to have a rootkit, a root sh history give me that, so my question is: is it a ...
stefff's user avatar
  • 21
1 vote
0 answers
294 views

Buffer overflow Rooting vs SU via recovery?

After researching on rooting processes low level details and techniques i found that it happens mostly through Buffer overflow to gain root access via running payload ( binaries ) at return call ...
Nayyar's user avatar
  • 11
1 vote
0 answers
389 views

How exactly does the HummingBad Android malware gain root access?

I've read a little bit in the last few days about HummingBad, an Android virus which tries to gain root access. It seems to use the root access to display ads and install apps. Varying estimates put ...
Fiksdal's user avatar
  • 3,107
0 votes
0 answers
282 views

How to spot malwares that hide their disk usage from Resource monitor?

So lets say a malware has hid itself from task manager, so it wont show up in there. lets also say that it also hides its disk usage from resource monitor as well. (based on previously asked ...
Mery Ted's user avatar
  • 363
0 votes
0 answers
1k views

BIOS rootkit : Computrace and Wiping SSD HPA on Linux + protect it with custom encryption

My primary goal is to close firmware backoors. First, I want to know if my plan might work or not, and if it is a good idea, how to implement it: I erased preinstalled Windows and installed Linux ...
TriloByte's user avatar
  • 239
0 votes
1 answer
306 views

Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?

For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and ...
User4857's user avatar
-1 votes
1 answer
186 views

Host Based IDS with syscall monitoring

Hey Guys I am a newbie in security stuff and now I am working on my final project about host based IDS. I have some questions to you guys Can a rootkit be classified as an intrusion or is it a ...
Ramandika Pranamulia's user avatar