Which of the following rootkits patches, hooks, or replaces system calls with versions that hide information about the attacker?

Question

Options

• ALibrary rootkit
• BKernel level rootkit
• CHypervisor rootkit
• DBoot loader rootkit

• A
  93% (28)
• B
  3% (1)
• C
  3% (1)

Explanation

A library rootkit operates in user space by modifying, patching, or replacing shared system libraries (such as libc on Linux or DLLs on Windows) that applications use to make system calls. When an application calls a function like readdir() or getpwent(), the compromised library intercepts the call and returns filtered results - omitting files, processes, network connections, or users associated with the attacker. This technique effectively hides the attacker's presence at the application/user-space layer without needing kernel privileges. A kernel-level rootkit, by contrast, modifies the kernel itself (e.g., modifying the system call table directly in kernel space), which is a deeper and more powerful form of hiding. A hypervisor rootkit sits below the OS entirely. A boot loader rootkit operates at the pre-OS boot stage. The key distinguishing feature of a library rootkit is the interception/replacement of shared libraries and system call wrappers in user space.

No community discussion yet for this question.