Which of the following rootkits is used to attack against full disk encryption systems?

Question

Options

• ABoot loader rootkit
• BLibrary rootkit
• CHypervisor rootkit
• DKernel level rootkit

• A
  79% (41)
• B
  2% (1)
• C
  6% (3)
• D
  13% (7)

Explanation

A boot loader rootkit (also known as a bootkit) targets the Master Boot Record (MBR) or Volume Boot Record (VBR) - the code that runs before the operating system loads. This makes it uniquely effective against full disk encryption (FDE) systems such as BitLocker or TrueCrypt. Because FDE requires a pre-boot authentication component that runs before the OS, a bootkit can intercept this stage to capture encryption keys or passwords entered by the user, effectively bypassing the encryption. Library rootkits operate at the shared library level (e.g., modifying libc) to intercept system calls in user space. Kernel-level rootkits modify the OS kernel itself to hide processes or files. Hypervisor rootkits (e.g., Blue Pill) insert a thin virtualization layer beneath the OS. None of these other types specifically target the pre-boot/FDE attack surface the way a boot loader rootkit does.

No community discussion yet for this question.