GCIH · Question #138
Which of the following Linux rootkits allows an attacker to hide files, processes, and network connections? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. Phalanx2 B. Beastkit C. Adore D. Knark. All four tools are established Linux kernel-level rootkits that use system call hooking or binary replacement to hide files, processes, and network connections from the operating system.
Question
Which of the following Linux rootkits allows an attacker to hide files, processes, and network connections? Each correct answer represents a complete solution. Choose all that apply.
Options
- APhalanx2
- BBeastkit
- CAdore
- DKnark
How the community answered
(30 responses)- A100% (30)
Why each option
All four tools are established Linux kernel-level rootkits that use system call hooking or binary replacement to hide files, processes, and network connections from the operating system.
Phalanx2 is a Linux kernel rootkit that hooks system calls to conceal attacker-controlled files, directories, processes, and network connections from administrators and security tools.
Beastkit is a Linux rootkit that replaces system binaries and patches kernel functions to hide the attacker's files, processes, and active connections from the OS.
Adore is a loadable kernel module (LKM) rootkit for Linux that intercepts system calls to hide files, processes, and network connections while maintaining persistent attacker access.
Knark is a classic Linux LKM rootkit that hooks kernel system calls to hide files, processes, and network connections, and can also redirect process execution to attacker-controlled binaries.
Concept tested: Linux kernel rootkit examples and stealth capabilities
Source: https://www.cisa.gov/sites/default/files/publications/Malware_and_Rootkit_Awareness_0.pdf
Topics
Community Discussion
No community discussion yet for this question.