Which rootkit describes replacing the original boot loader with one controlled by a remote attacker?

Which rootkit describes replacing the original boot loader with one controlled by a remote attacker?

• A. Hypervisor Level Rootkit
• B. Kernel Level Rootkit
• C. Library Level Rootkits
• D. Boot Loader Level Rootkit

Answer: (D)

Replacing the boot loader means taking control before the operating system even starts. A boot loader level rootkit does exactly that: it substitutes the normal boot manager (the MBR/boot sector on BIOS or the EFI boot manager on UEFI) with code the attacker controls from afar. When the system boots, this malicious loader runs first, potentially loading additional components, hiding itself, and giving the attacker persistent access before any security tools or the OS have a chance to load. Other rootkits operate at different layers: kernel level rootkits modify the operating system after it has loaded and run in the kernel; hypervisor level rootkits reside at the virtualization layer above the OS; library level rootkits tamper with user-space libraries. These do not involve replacing the boot loader, so they describe different attack vectors.

Replacing the boot loader means taking control before the operating system even starts. A boot loader level rootkit does exactly that: it substitutes the normal boot manager (the MBR/boot sector on BIOS or the EFI boot manager on UEFI) with code the attacker controls from afar. When the system boots, this malicious loader runs first, potentially loading additional components, hiding itself, and giving the attacker persistent access before any security tools or the OS have a chance to load.

Other rootkits operate at different layers: kernel level rootkits modify the operating system after it has loaded and run in the kernel; hypervisor level rootkits reside at the virtualization layer above the OS; library level rootkits tamper with user-space libraries. These do not involve replacing the boot loader, so they describe different attack vectors.