Which rootkit hides in hardware devices or platform firmware that are not inspected for code integrity?

Which rootkit hides in hardware devices or platform firmware that are not inspected for code integrity?

• A. Hypervisor Level Rootkit
• B. Kernel Level Rootkit
• C. Hardware/Firmware Rootkit
• D. Library Level Rootkits

Answer: (C)

This question tests the idea that rootkits can hide outside the operating system, in places where standard code integrity checks don’t normally reach—specifically within hardware devices or the platform firmware. When a rootkit resides in firmware (like BIOS/UEFI, embedded controller firmware) or embedded hardware microcode, it operates below the OS layer and can manipulate boot processes, firmware updates, or device behavior without being detected by typical integrity scans that focus on the OS and its loaded modules. Because firmware and hardware can persist across OS reinstallations and aren’t routinely inspected by normal security checks, this type of rootkit is particularly stealthy. The other options describe rootkits that live inside the OS or virtualization stack: a hypervisor-level rootkit hides at the virtualization layer; a kernel-level rootkit hides within the OS kernel; library-level rootkits reside in user-space libraries. These are eventually tied to the host’s software stack and are more likely to be detected by integrity checks that monitor the kernel, libraries, or drivers, unlike firmware or hardware-resident threats.

This question tests the idea that rootkits can hide outside the operating system, in places where standard code integrity checks don’t normally reach—specifically within hardware devices or the platform firmware. When a rootkit resides in firmware (like BIOS/UEFI, embedded controller firmware) or embedded hardware microcode, it operates below the OS layer and can manipulate boot processes, firmware updates, or device behavior without being detected by typical integrity scans that focus on the OS and its loaded modules. Because firmware and hardware can persist across OS reinstallations and aren’t routinely inspected by normal security checks, this type of rootkit is particularly stealthy.

The other options describe rootkits that live inside the OS or virtualization stack: a hypervisor-level rootkit hides at the virtualization layer; a kernel-level rootkit hides within the OS kernel; library-level rootkits reside in user-space libraries. These are eventually tied to the host’s software stack and are more likely to be detected by integrity checks that monitor the kernel, libraries, or drivers, unlike firmware or hardware-resident threats.