Which honeypot application captures rootkits by intercepting the read() system call?

Which honeypot application captures rootkits by intercepting the read() system call?

• A. OpenSSH
• B. Snort_inline
• C. Fake AP
• D. User-Mode Linux

Answer: (D)

Intercepting the read() system call allows a honeypot to see exactly what a process reads from the system and detect when a rootkit tries to alter or hide data by tampering with those reads. Running a Linux kernel inside user space with User-Mode Linux gives you the ability to instrument or monitor such low-level kernel interactions without touching the host kernel. In a honeypot, UML can log or intercept system calls like read(), making it possible to catch rootkits as they attempt to read or hide information. The other options aren’t designed for this kind of kernel-call monitoring: OpenSSH is a legitimate remote access service, Snort_inline is a network IDS, and Fake AP is a wireless honeypot. Therefore, User-Mode Linux is the best fit for capturing rootkits by intercepting the read() system call.

Intercepting the read() system call allows a honeypot to see exactly what a process reads from the system and detect when a rootkit tries to alter or hide data by tampering with those reads. Running a Linux kernel inside user space with User-Mode Linux gives you the ability to instrument or monitor such low-level kernel interactions without touching the host kernel. In a honeypot, UML can log or intercept system calls like read(), making it possible to catch rootkits as they attempt to read or hide information. The other options aren’t designed for this kind of kernel-call monitoring: OpenSSH is a legitimate remote access service, Snort_inline is a network IDS, and Fake AP is a wireless honeypot. Therefore, User-Mode Linux is the best fit for capturing rootkits by intercepting the read() system call.