GSEC · Question #149
John works as a professional Ethical Hacker. He is assigned a project to test the security of Which of the following statements are true about rootkits? Each correct answer represents a complete…
The correct answer is B. They allow an attacker to set a Trojan in the operating system and thus open a backdoor for C. They allow an attacker to replace utility programs that can be used to detect the attacker's activity. D. They allow an attacker to run packet sniffers secretly to capture passwords. Rootkits are stealthy malware that provide attackers with persistent, hidden access to a compromised system by manipulating the OS. They are not the mechanism for buffer overflow attacks.
Question
John works as a professional Ethical Hacker. He is assigned a project to test the security of Which of the following statements are true about rootkits? Each correct answer represents a complete solution. Choose all that apply.
Options
- AThey allow an attacker to conduct a buffer overflow.
- BThey allow an attacker to set a Trojan in the operating system and thus open a backdoor for
- CThey allow an attacker to replace utility programs that can be used to detect the attacker's activity.
- DThey allow an attacker to run packet sniffers secretly to capture passwords.
How the community answered
(34 responses)- A29% (10)
- B71% (24)
Why each option
Rootkits are stealthy malware that provide attackers with persistent, hidden access to a compromised system by manipulating the OS. They are not the mechanism for buffer overflow attacks.
Buffer overflow is a memory corruption exploitation technique that is independent of rootkits - rootkits are used post-exploitation for persistence and stealth, not to cause buffer overflows.
Rootkits are specifically designed to install Trojans and create backdoors in the operating system, allowing persistent attacker access that survives reboots.
A defining characteristic of rootkits is their ability to replace or patch legitimate OS utilities (like ls, ps, netstat) so those tools no longer reveal the attacker's files, processes, or connections.
Because rootkits operate at a privileged, hidden level within the OS, they can silently deploy packet sniffers to capture network traffic including plaintext passwords without detection.
Concept tested: Rootkit capabilities and characteristics
Source: https://attack.mitre.org/techniques/T1014/
Topics
Community Discussion
No community discussion yet for this question.