2023/12/13 Council Agenda Packet

What Is a Rootkit? How to Defend and Stop Them? I Fortinet https:I/www.fortinetcom/resources/cyberglossary/rootkit#:—:text - ... A memory rootkit hides in a machine's random access memory (RAM), the hardware that enables data to be received and stored on a computer. These rootkits only have short lifespans, but they can carry out extremely harmful activity in the background of a machine. Memory rootkits live in a machine's RAM and typically disappear when the system is rebooted, but they can sometimes require additional work to be removed. They reduce the performance of a machine's RAM by eating up resources with their malicious processes. (® ®• '••t it An application rootkit replaces the files on a computer with malicious rootkit files, which changes the performance of standard applications like Notepad, Paint, or Word. Every time a user runs these applications, they give the hacker access to their computer. The infected programs run as usual, which can make it difficult to detect that a rootkit is present, but they should be discovered with good anti-rootkit or antivirus programs. • • • Kernel mode rootkits are pieces of advanced, complex malware that target a machine's OS. They give an attacker simple access to a machine, enabling them to steal data and modify how the OS works by adding, deleting, or replacing its code. Creating a kernel mode rootkit requires significant technical knowledge, which means if it has bugs or glitches, then it could have a huge impact on the infected machine's performance. However, a kernel rootkit laden with bugs is easier to detect as it leaves a trail for anti-rootkit or antivirus software. These rootkit types have been used to create devastating attacks, including: 1. NTRootkit: One of the first malicious rootkits created, which targeted the Windows OS. 2. Machiavelli: The first rootkit to target the Mac OS. The 2009 Machiavelli rootkit attack • 3of11 1911 919091 F • 1 R PM