ITPEC FE Morning October 2019 Question 45

Rootkit — malware that gains administrator (root) privileges, hides its own presence and keeps the system under the attacker's control.

A rootkit is a set of tools installed after an intrusion. It opens a backdoor for later access and conceals the attack by tampering with logs and replacing or hooking system commands and OS components, so the attacker's files, processes and connections do not show up. The name joins root, the Unix administrator account, with kit.

Answer (c)

Why not others:

• •(a) Botnet — a network of infected computers (bots) commanded remotely by an attacker, for example to send spam or launch DDoS attacks; it describes many machines under control, not concealment with privileged access
• •(b) Ransomware — encrypts or locks the victim's data and demands payment; it announces itself to the victim rather than hiding
• •(d) Security hole — a vulnerability in software or configuration that an attacker can exploit; it is a weakness, not malware

Key rule: Malware is named by what it does: holding data to ransom is ransomware, turning hosts into remote-controlled bots is a botnet, hiding after a privileged intrusion is a rootkit.

Security · AI-written, may contain errors