Bootkit is a form of malicious computer software that operates on the lowest level of a computer’s operating system (OS) and is used to modify the OS in order to gain access to it. It is a type of malware that can compromise the security features of an OS, allowing attackers to gain privileged access to the computer. Bootkits can also be used to launch other malware, install malicious programs, and hide from anti-virus software.
Bootkits traditionally operate by replacing the bootloader of the computer, usually by infecting the master boot record (MBR) of the hard drive, but other types such as Hypervisor Bootkit can replace the hypervisor software. Bootkits can also be used to modify other parts of the OS, such as the kernel, allowing attackers to bypass security features.
The use of bootkits has become increasingly common, due to their effectiveness and ability to remain hidden from detection. As such, bootkit protection has become an important part of computer security. Anti-virus programs that are able to detect and remove bootkits are available to protect against this type of attack.
Bootkits can also be used by attackers to spread other types of malicious software, sometimes termed “bootkit-borne malware”. In some cases, the bootkit may be used to disable or bypass existing security measures, allowing other types of malware to be run on the system. As a result, it is important to ensure that a comprehensive security solution is in place which is able to detect and remove any malicious code on the system, including bootkit-borne malware.
