A rootkit is a collection of malicious programs that give administrative access of a computer to attackers. The term “rootkit” is derived from two words “root” and “kit”. Using this malware attackers can get root level or administrative level access to a computer and hence the name.
A rootkit can be of 4 types –
– User-mode rootkit
– Kernel-mode rootkit
– Hybrid rootkit and
– Firmware rootkit
The details on how each type of these rootkits work can be found here https://www.thesecuritybuddy.com/preventing-rootkits/what-is-a-rootkit-and-how-to-detect-and-remove-it/
A bootkit is a kernel-mode rootkit that can modify startup code like the Master Boot Record or MBR, Volume Boot Record or VBR and boot sector, so that the malware can run every time the computer boots. And as it infects the startup code, it becomes extremely difficult to remove this malware once it infects a computer. Sometimes reformatting and reinstallation of the infected computer is the only work around to get rid of the malware.
A very common example of this bootkit is Nemesis Bootkit, which infected lots of banking systems in 2015. The details of the malware can be found here https://www.thesecuritybuddy.com/malware-prevention/what-is-nemesis-bootkit/
Hence, bootkit is a type of rootkit that change Operating System kernel and modify the startup code of the system for persistence, which in turn makes this malware extremely challenging to remove.
Loading...
