Skip to main content

Questions tagged [rootkits]

A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications. The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool).

Filter by
Sorted by
Tagged with
43 votes
7 answers
48k views

Can a powered down cell phone be turned on remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion referenced a bug that could track/listen in on the subject "whether the phone was powered on or off," although that may have been ...
Sam Skuce's user avatar
  • 573
28 votes
6 answers
4k views

Why do malware creators use such clever technologies for such silly purposes?

Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question). It was a two-...
Massimo's user avatar
  • 721
26 votes
4 answers
5k views

Linux-based Turla trojan

There are several articles describing the newly discovered Linux-based Turla trojan. But basically, all these articles repeat the same, very limited, information. Can anybody provide more details, ...
Martin Vegter's user avatar
26 votes
8 answers
78k views

Detecting and removing Absolute persistence technology

Absolute persistence technology amounts to a persistent rootkit pre-installed by many device manufacturers (Acer, Asus, Dell, HP, Lenovo, Samsung, Toshiba, etc) to facilitate LoJack for laptops, and ...
sampablokuper's user avatar
24 votes
3 answers
2k views

What is a rootkit?

As a followup to "Tripwire - Is It Security Theater", I'm looking to get a better idea of what a rootkit is. To be more clear: What is a kernel module? What at high-level is the flow for how it's ...
blunders's user avatar
  • 5,072
24 votes
2 answers
15k views

How would one know if they have a rootkit?

Are they impossible to detect? Seeing as the attacker has admin rights and could modify anti virus software that might otherwise be used to detect or circumvent a root kit. Are there certain red flags ...
DBroncos1558's user avatar
23 votes
2 answers
11k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
Steve's user avatar
  • 269
19 votes
4 answers
2k views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
Massimo's user avatar
  • 721
18 votes
3 answers
2k views

Why do rootkits hide in drivers?

A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that? One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't ...
Erik's user avatar
  • 1,065
18 votes
5 answers
12k views

Detecting malware-infected USB drives

I'm about to distribute some relatively cheap promotional usb drives to some of my company's clients. I'm fairly confident the company I purchased them from wouldn't intentionally implant malware on ...
Myer's user avatar
  • 279
16 votes
4 answers
5k views

What risk does Carrier IQ pose, exactly?

There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out. My questions: What exactly does Carrier ...
D.W.'s user avatar
  • 99.9k
16 votes
2 answers
3k views

Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?

My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
Daniel Sangorrin's user avatar
15 votes
5 answers
4k views

Are there ways to protect the guest kernels at the hypervisor level?

Let's say I have a linux guest running in xen and I want xen to check the integrity of the guest kernel so that I know there aren't any rootkits, or similar, active. Is there a way to accomplish this ...
baj's user avatar
  • 513
14 votes
5 answers
28k views

Is it possible for a phone to be transmitting even while turned off and the battery removed?

Is it technically or theoretically possible for any part of a mobile phone's circuitry to be still on and transmitting even while turned off and the battery has been removed? If so, how? I am ...
user20702's user avatar
  • 159
13 votes
3 answers
2k views

How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?

There are several commercial exploit kits available containing 0day vulnerabilities: White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml Agora Exploit Pack http:...
Tate Hansen's user avatar
  • 13.8k
13 votes
2 answers
1k views

How to analyze a rootkit?

The other a friend of mine sent me a rootkit/code he found on a server that was exploited (php cgi exploit). Now I was thinking of having a look at it, but I was wondering if there are some basic ...
Lucas Kauffman's user avatar
13 votes
2 answers
956 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
Martin Vegter's user avatar
11 votes
5 answers
1k views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...
Martin Vegter's user avatar
11 votes
3 answers
4k views

How to minimize the risk posed by Intel AMT/ME's "ring -3 exploits"?

This question is about how to minimize the risk posed by Intel AMT/ME's ring -3 exploits? I'm looking for advice on common strategies and practices. Here is my current situation. I am parking my ...
humanityANDpeace's user avatar
10 votes
2 answers
4k views

Rootkits on Mac OS X

Is there known existence of rootkits for Mac OS X, and can you please provide examples? What software would you recommend to detect rootkits on OS/X? From a software developer's perspective, can you ...
amateur barista's user avatar
9 votes
4 answers
2k views

Can we trust the information displayed by the linux utility commands for a vulnerable machine?

After checking a vulnerable linux machine for rootkit and deleting them, we need to get some informations about the process , port ,incoming or outgoing connections... , using some useful commands as ...
GAD3R's user avatar
  • 2,231
9 votes
3 answers
3k views

How to manually check for rootkits on a server

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
Chris Dale's user avatar
  • 16.1k
9 votes
5 answers
4k views

Besides MBR & BIOS, is it possible for a rootkit to stay persistent after a format of the hard drive?

If a system becomes infected and does not have any other storage units besides the one hard drive. Is it there any other way for a rootkit to stay on the system besides infecting the BIOS OR the MBR ...
Digital fire's user avatar
  • 3,186
9 votes
3 answers
860 views

Do any antivirus products use "canary files" to detect rootkits?

Recently, I've learned how some rootkits are able to hide certain files, services, etc. from programs in the kernel or user modes. This got me wondering: Are there any antivirus programs, or other ...
Iszi's user avatar
  • 27.1k
8 votes
3 answers
5k views

How does a root kit work inside a virtual machine?

In my class, we are discussing virtual machine based root kits. I've research root kits, but could not find any information specifically talking about how root kits work inside of virtual machines ...
user45738's user avatar
8 votes
3 answers
20k views

Finding a backdoor on a server?

Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices. The ...
Agustín Covarrubias's user avatar
8 votes
5 answers
2k views

Is it safer to compile open source code vs simply running the binary?

I understand that with OpenSource software, my milage may vary based on the trust of the author and the distribution platform they use (Codeplex, Git, or private server). Oftentimes a FOSS website ...
makerofthings7's user avatar
8 votes
4 answers
2k views

Verify Mac firmware is not hacked...how to do?

I have a late model Mac computer. I allowed someone to plug in a USB drive, and my network activity changed afterwards. Normally, Little Snitch will report every app that uses the internet. Every ...
user avatar
8 votes
2 answers
5k views

Perl script rootkit (exploit)

I received a spam abuse few days ago on my server. As a precaution, I blocked the SMTP port and started an investigation. I found a running Perl process. The script it was using was deleted but I ...
Olier Saari's user avatar
7 votes
1 answer
3k views

Is Mac OS safer to use as far as firmware rootkits, cold boot attacks and evil maid?

Windows machines have things like TPM and Secure boot to help protect against firmware rootkits, but is Mac any safer in these regards? How does Mac work in the boot stage and is it any less ...
Rideboards's user avatar
7 votes
2 answers
5k views

How helpful is rkhunter?

I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website. With these things already in place, do ...
Hope4You's user avatar
  • 333
7 votes
1 answer
2k views

TPM bootstrap process

Assume that the file partition where the PC operating system and user data reside are sealed by a number of PCRs (Platform Configuration Registers) dedicated to BIOS measurements. What happens during ...
niklr's user avatar
  • 591
6 votes
1 answer
1k views

Icesword rootkit detector, How does it work?

I'm curious about how I can learn more about icesword rootkit detector. I've only used it and never studied it myself. Ive always been curious how it works. As far as I understand it works by ...
user avatar
6 votes
3 answers
4k views

what is the difference between boot-sector virus and rootkits?

I have read the definition for both and also read about a few examples for both the cases. I'm still not very sure what the difference is. Is the difference blurred or are there some specific ...
naresh's user avatar
  • 645
6 votes
1 answer
282 views

What do malware authors using android root exploits go after?

I know there has been a lot of discussion on rooting on the internet and even on stack exchange. What I want to ask here is not how rooting works - assuming the root exploit as a black box, what ...
Jake's user avatar
  • 1,095
5 votes
3 answers
493 views

What can manufactures of hardware do to prevent attacks on the firmware?

Given the revelations since The Equation Group was discovered. As well as that it is possible to not guarantee removal of a rootkit even with a nuke from high orbit. What properties of a harddrive ...
Digital fire's user avatar
  • 3,186
5 votes
1 answer
289 views

How can a rootkit infect Windows without signed driver file?

Windows 7 64 bit and newer versions feature Driver Signature Enforcement, which prevents loading an unsigned driver. Then how can some kernel-mode rootkits infect Windows? I rea Lets say, some user ...
noop's user avatar
  • 51
5 votes
1 answer
724 views

How does a ring 3 rootkit manage to modify files in /etc and/or /usr?

A recent article spiked my curiosity; please bare with me, I'm no security expert but just a Linux admin. This states that the rootkit runs from userspace, but modifies /etc/so.preload and creates ...
tink's user avatar
  • 206
5 votes
1 answer
1k views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
student's user avatar
  • 1,473
4 votes
3 answers
4k views

how to detect the origin of a hacker attempting to breach or who has sucesfully breached a network or system

In the case of detecting that a system is infected with a root-kit, what if any thing can be done to trace route the origins of the remote out going packets to attempt to find out where the attacker ...
Keegan Black's user avatar
4 votes
2 answers
5k views

UEFI secure boot and rootkits

I heard that with UEFI secure boot enabled a custom kernel module that is not signed will not run, hence a rootkit might be difficult to install. Can a secure boot really block rootkit modules from ...
Kevin Parker's user avatar
4 votes
3 answers
2k views

Should I be worried about rootkits?

*Note: My question is quite specific to my situation. Although there may be an answer out there, I am unsure how to search it. * I am curious to understand more about optimizing my internet speed for ...
Nate's user avatar
  • 41
4 votes
2 answers
759 views

Randomizing system call numbers to prevent rootkits?

I've heard of rootkits that infect computers by first having a simple virus infect the computer, make a call to the "command" computer containing the target computer's specs. With the specs, the ...
tzengia's user avatar
  • 143
4 votes
1 answer
810 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
Max's user avatar
  • 97
4 votes
1 answer
479 views

Is Sleep mode safe?

If a PC has rootkit, when it goes into sleep mode, can rootkit do anything to it while it’s in state of sleeping? Meaning steal data, open programs and basically do anything. Assuming it’s not BIOS ...
heilo's user avatar
  • 41
4 votes
2 answers
4k views

Is it risky to buy refurbished phones?

At least in theory, when buying a refurbished phone, is there a chance the phone has been modified, in the same vein as phishing, to look like a stock installation, down to the "factory reset" and ...
Danny's user avatar
  • 41
4 votes
1 answer
1k views

Does malware which infects the BIOS/ Firmware always need 'root' access to do so?

There are very few hardened Operating Systems who restrict or totally disable Terminal 'root' access for the user. Would this feature prevent persistent BIOS rootkits from writing into BIOS or ...
user3200534's user avatar
4 votes
1 answer
944 views

Does reinstalling ubuntu eliminates all existing rootkits/ malware/spyware/ virus etc?

If I do a fresh installation of ubuntu from an uninfected cd, will it remove all the existing rootkits/malwares/spywares/viruses etc if any ? Is formatting the hard disk required before reinstalling ...
aks's user avatar
  • 61
4 votes
2 answers
5k views

Can Restarting An Infected Computer Make It Worse?

I seem to remember that rebooting a potentially infected Windows PC before removing the malware may allow it to take advantage of early boot up states that may be vulnerable if the security measures ...
user58446's user avatar
  • 563
3 votes
1 answer
3k views

How to remove ssh rootkits? [duplicate]

I checked my linux server with rkhunter, I got following warning messages, ... [00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon [00:35:35] ...
Kumar's user avatar
  • 161