Which rootkit replaces the original boot loader with the one controlled by a remote attacker?

Which rootkit replaces the original boot loader with the one controlled by a remote attacker?

• A. Hypervisor Level Rootkit
• B. Library Level Rootkits
• C. Kernel Level Rootkit
• D. Boot Loader Level Rootkit

Answer: (D)

This item tests understanding of where a rootkit takes control during the boot process and how persistence is achieved. A boot loader level rootkit replaces the initial code that runs when the machine powers on, the boot loader. Since the boot loader runs before the operating system loads, an attacker who replaces it can dictate what loads next, inject or hide malware, and maintain stealth and persistence across reboots. This allows remote control from the very start of the system’s operation. Other rootkit types operate after the system begins to boot or once the OS is already running: a kernel level rootkit hides inside the running kernel, a library level rootkit hooks into shared libraries used by programs, and a hypervisor level rootkit sits between hardware and the OS to monitor or control the guest. None of these inherently involve replacing the boot loader itself, so they don’t match the described scenario.

This item tests understanding of where a rootkit takes control during the boot process and how persistence is achieved. A boot loader level rootkit replaces the initial code that runs when the machine powers on, the boot loader. Since the boot loader runs before the operating system loads, an attacker who replaces it can dictate what loads next, inject or hide malware, and maintain stealth and persistence across reboots. This allows remote control from the very start of the system’s operation.

Other rootkit types operate after the system begins to boot or once the OS is already running: a kernel level rootkit hides inside the running kernel, a library level rootkit hooks into shared libraries used by programs, and a hypervisor level rootkit sits between hardware and the OS to monitor or control the guest. None of these inherently involve replacing the boot loader itself, so they don’t match the described scenario.