Contents
What is a virtual rootkit?
Virtual machine (VM) technology has many positive uses. However, when a VM is paired with a rootkit, you have a problem called a VM-based rootkit (VMBR). VMBRs aren’t just theoretical nuisances. Causing a VMBR to become installed is the tricky part, as is usually the case with rootkits.
How is a rootkit installed?
User-mode rootkits remain installed on the infected computer by copying required files to the computer’s hard drive, automatically launching with every system boot. Sadly, user-mode rootkits are the only type that antivirus or anti-spyware applications even have a chance of detecting.
How does rootkit malware work?
A rootkit is a collection of computer software, typically malicious, that is designed to grant an unauthorized user access to a computer or certain programs. Once a rootkit is installed, it is easy to mask its presence, so an attacker can maintain privileged access while remaining undetected.
What runs inside a virtual machine?
A virtual machine is a simulated computer system which runs on a physical computer. In other words, a virtual machine is a computer inside a computer. Virtual machines allocate memory, a virtual CPU, disk storage space, and a network interface.
Why do people use rootkits?
The whole purpose of a rootkit is to protect malware. Think of it like an invisibility cloak for a malicious program. This malware is then used by cybercriminals to launch an attack. The malware protected by rootkit can even survive multiple reboots and just blends in with regular computer processes.
How do I know if I have a rootkit virus?
A rootkit scan is the best way to detect a rootkit infection, which your antivirus solution can initiate. If you suspect a rootkit virus, one way to detect the infection is to power down the computer and execute the scan from a known clean system. Behavioral analysis is another method of rootkit detection.
How does a virtual machine based rootkit work?
Virtual machine-based rootkits transport an operating system into a virtual environment so that the rootkit, along with the virtual environment, cannot be discovered at all or is extremely difficult to detect. A virtual machine-based rootkit (VMBR) loads itself underneath the existing OS, then runs the OS as a virtual machine.
How does a kernel rootkit boot the operating system?
A kernel rootkit will boot up at the same time as the operating system, but a virtualized rootkit will boot-up first, create a virtual machine and only then will it boot up the operating system. To give you a visual sense of this, imagine the rootkit and the boot-up process as if they were two boxes.
What can a rootkit do to your computer?
After a rootkit infects a device, you can’t trust any information that device reports about itself. If you were to ask a device to list all of the programs that are running, the rootkit might stealthily remove any programs it doesn’t want you to know about. Rootkits are all about hiding things.
How are rootkits different from viruses and worms?
Unlike viruses and worms, rootkits don’t spread or multiply on their own. Usually, rootkits are just one component of what is called a blended or combined threat, which consists of three snippets of code: a dropper, loader, and rootkit.