Today in this article we are going to discuss what is a rootkit, its types, and the different tools used to remove rootkits from a system.
Introduction
A rootkit is a set of malicious computer programs that are designed to enable access to a remote computer system while hiding its presence. Having rootkits on a system means someone has unauthorized access to it. It is used by cybercriminals to gain access to a remote computer with the intention to get personal or financial details.
The term rootkit is derived from Unix where “root” is the term used for someone who has privileged access to the system and “kit” is the collection of tools that implement it.
How rootkit is installed on a computer?
A rootkit gets installed on a system typically through the use of Trojan Horse programs that looks legitimate but actually contains malicious code.
A rootkit can be bundled with other software that looks trustworthy and when the system admin gives permission to install the software the rootkit also get installed with it.
What rootkits can do?
After installing rootkit to a system attackers gain access to that system which means they can do the given possible things with it –
- Additional malicious software can be installed
- They can extract sensitive information such as username, password, financial information, etc
- They can delete or modify important files or directories on your system
- Your activities on the system can be tracked
- Execute or install a program
- Your system settings including security settings can be modified.
Types of rootkits
There are different types of rootkits some of them are given below –
Hardware or firmware rootkit – Instead of installing on an operating system this type of rootkit gets installed in the firmware of the target system and affects your system hard drive, BIOS, and other hardware components. Firmware rootkits are difficult to detect and remove so hacker takes advantage of it and use it for keystroke logging and monitoring user’s activities.
Bootloader rootkit – The bootloader rootkit replaces the original bootloader of a system that is responsible for loading an operating system on a computer. So rootkit starts even before your system opens.
Memory rootkit – This rootkit resides inside the RAM of a computer and carries out malicious activities in the background. A memory rootkit disappears once you reboot your system.
Application rootkit – This type of rootkit replaces the standard user application file like MS Office, Winrar, Notepad, etc, and changes the way that the application works. The application rootkit can be easily detected and removed using the normal antivirus program.
Kernel-mode rootkit – Kernel-mode rootkit targets the kernel part of an operating system that is used by cybercriminals to gain access to a remote system. It is one of the most severe types of computer threat which also modifies how your operating system works.
Virtual machine-based rootkit (VMBR) – This type of rootkit loads itself underneath the existing operating system and then runs the os as a virtual machine. This is only detectable through special tools.
Examples of rootkit
Examples of some well-known rootkits are –
- Stuxnet – It was first uncovered in 2010 and it is believed that it causes substantial damage to Iran’s nuclear program by targeting supervisory control and data acquisition systems.
- Flame – It was first discovered in 2012 and is responsible for attacking many computers running Windows operating system. It has the ability to record audio, screenshots, keyboard activity, and network traffic.
- NTRootkit – One of the first rootkits that targeted the Windows operating system.
- HackerDefender – HackDef was an early malicious program that targets and modifies Windows OS at a very low level.
- Machiavelli – It was the first rootkit that targeted macOS that creates hidden system calls and kernel threads.
- ZeroAccess – This is a kernel-mode rootkit that was discovered in 2011. It infected more than 2 million computers around the world. It downloads and installs malware to a system and makes it a botnet to be used by hackers.
- Greek wiretapping – It is known for tapping many mobile phones of top govt officials in Greek between 2004 -to 05.
- Zeus – It was first identified in July 2007 it is known for stealing banking information by man-in-the-browser keystroke logging and form grabbing.
How to detect and remove the rootkit
Detection of a rootkit on a system is difficult a few things can indicate the presence of a rootkit on a system –
- Your Windows operating system hangs, restarts, or sometimes a blues screen appears with a lot of error messages
- The web browser on your system behaves unusually
- System settings get modified automatically without your permissions
- Web pages don’t function properly
To remove rootkits from a system first scan your whole system with a good updated antivirus program and then use some specialized programs like rkhunter, chkrootkit, etc.
Sometimes you may need to reinstall your operating system or repair your system in case of firmware or hardware rootkit infections.
How to prevent your system from rootkits
Most of the rootkits are installed on a system with software that seems legitimate. To prevent your system from rootkits you need to follow a few things –
- Always make your system up to date so that it gets patched against any known vulnerability
- Use up to date applications
- Use an updated antivirus program
- Don’t install software from an unknown source
- Don’t open file attachments from unknown sources
- Read the software license agreement carefully and then allow it to install.
Ok, that’s all for now, we hope this article is useful to you. Now for any queries or suggestions write us in the comments below.