Differentiate Between Gootkit, Bootkit and Rootkit

This updated guide examines Differentiate Between Gootkit, Bootkit and Rootkit and organizes the essential facts, background, and practical takeaways in clear American English.

If you are interested in network security / information security, Gootkit, Bootkit and Rootkit are probably concepts you've heard about. So what is the difference between these 3 concepts? We will learn together shortly.

What is gootkit?

• Gootkit is a trojan malware, first discovered in 2014.
• Gootkit has the ability to hack into bank accounts, steal login information and manipulate online transactions.
• Gootkit uses the following three modules: The Loader, The Main Module, and the internet Injection Module (malware injection module). The Loader is the first stage of the attack process, when the trojan sets up a continuous environment. The Main Module will then create a proxy server that works with the internet Injection Module.
• Gootkit has no known propagation process. It uses phishing email, taking advantage of toolsets like Neutrino, Angler and RIG to spread to the targeted systems.

What is rootkit?

• Rootkits are secret computer software designed to perform a variety of malicious activities, including password theft and credit card information or online banking information.
• Rootkits can also give an attacker the ability to disable security software and record information as you type, simplifying the process of stealing information for cyber criminals.
• There are 5 types of rootkits: hardware or firmware rootkits, bootloader rootkits, memory rootkits, application rootkits, and application rootkits (kernel).
• Rootkits can take advantage of phishing emails and infected mobile applications to spread into large-scale systems.

What is bootkit?

• Bootkits are a more advanced, complex and dangerous type of rootkit that targets the Master Boot Record on the computer's physical motherboard.
• Bootkit can destabilize the system and lead to a 'blue screen' error or prevent the operating system from starting.
• In some cases, the bootkit may display a warning and require a ransom to restore the computer to normal operation.
• Bootkits generally spread via floppy disks and other bootable media. However, recently, this malware has also been recorded for distribution via phishing email software programs or free download data.

Understanding the basic differences for these 3 malicious agents plays a very important role in the construction of defense systems as well as troubleshooting of security incidents.