All about ROOTKITS in Cyber Security !!

Rootkit is a software program, typically malicious, that provides privileged, root level access to a computer while concealing its presence on that machine.

Rootkit tools (popular ones)

·       Purple Fox

·       MoonBounce

·       TDSS

Rootkit types

·       Hypervisor rootkit: It takes advantage of the hardware virtualization and is installed between the hardware and the kernel acting as the real hardware.

·       Kernel rootkit: Kernel Rootkits are specifically designed to attack the core of your operating system and change its functioning.

·       Bootloader rootkit: The bootloader rootkit attacks the legit bootloader and replaces it with the hacked one so that attackers could control the system boot.

·       Application rootkit: Application Rootkits replaces the legitimate files of the genuine applications with the infected ones so that the hackers could get control over them. Every time the user opens the infected application, the attacker behind the application rootkit gets access to the system.

·       Memory rootkit: Memory Rootkits are one of the dangerous rootkits. They hide in the Random Access Memory (RAM) of the system and consume CPU power, stopping all other processes and freezing the system.

Detecting rootkit: Detecting a rootkit on a computer can be difficult as this kind of malware is designed to stay hidden. Still there are various methods to detect a rootkit.

·       Integrity based

·       Behavior based

·       Signature based

·       Run-time execution

·       Cross-view based

·       Alternate trusted

·       Analysing memory dumps

Anti-rootkits

·       TDSS root killer

·       Stinger

·       Avastone

·       Rootkit buster

FOLLOW US HERE - Twitter FACEBOOK