What is a rootkit primarily designed to do, and which defense is effective against it?

• A. Infects the BIOS to persist across updates; defenses rely on firmware updates
• B. Hides itself from the operating system and security tools; defenses include integrity checks, secure boot, memory forensics, and kernel module signing
• C. Randomly changes system time to confuse logs
• D. Encrypts user data to demand ransom; defenses include backups

Answer: (B)

Rootkits are built to operate invisibly, hiding their presence from the operating system and security tools while maintaining persistence. They often intercept or spoof system data and kernel-level procedures so that processes, files, and network activity appear legitimate, allowing the attacker to control the system without detection.

The defenses listed are effective because they counter that stealth approach from different angles. Integrity checks verify that critical system binaries, configurations, and security tools haven’t been tampered with, catching changes a rootkit would make to hide itself. Secure Boot ensures the platform starts with trusted firmware and code, preventing unauthorized rootkit components from loading during boot. Memory forensics looks beyond the OS’s view by examining volatile memory for hidden processes, hooks, or anomalies that the OS cannot reveal. Kernel module signing requires only trusted, signed modules to be loaded, blocking kernel-mode rootkits that rely on unsigned or forged modules to operate.

Together, these defenses disrupt the rootkit’s ability to stay hidden and persist, making it detectable and removable.