Rootkits

Question 1

What is a Rootkit?

Answer 1

Designed to gain administrative level control over a given computer system without being detected

Question 2

What does the Administrative account do?

Answer 2

Allows the person to install programs, delete programs, open ports, shut ports, and do whatever it is they want to do on that system

Question 3

What is a technique used by Rootkits to gain a deeper level of access on computer systems?

Answer 3

DLL Injection

Question 4

What is a Dynamic Link Library (DLL)?

Answer 4

Collection of code and data that can be used by multiple programs simultaneously to allow for code reuse and modularization in software development

Question 5

What is a DLL Injection?

Answer 5

Technique used to run arbitrary code within the address space of another process by forcing it to load an infected dynamic-link library

Question 6

What is Shim?

Answer 6

Piece of software code that is placed between two components and that intercepts the calls between those components and can be used to redirect them

Question 7

What are the different rings of permission throughout a computer system?

Answer 7

Ring 0, Ring 1, Ring 3

Question 8

What is Ring 3 (Outermost Ring)?

Answer 8

Where user level permissions are used

Question 9

What is Ring 1?

Answer 9

You login as the administrator or root user on a system, you have root permission

Question 10

What is Ring 0 (Innermost or Highest Permission Level)?

Answer 10

This is Kernal mode, which allows a system to control access to things like device drivers, your sound card, your video display or monitor, and other similar things

Question 11

What does the Rootkit do once installed on a system?

Answer 11

It tries to move from Ring 1 to Ring 0 so that it can hide from other functions of the operating system to avoid detection

Question 12

How can you detect a Rootkit?

Answer 12

The best way is to boot from an external device and then scan the internal hard drive to ensure that you can detect those rootkits using a good anti-malware scanning solution from a live boot Linux distribution