{"id":476091,"date":"2023-08-09T07:25:33","date_gmt":"2023-08-09T07:25:33","guid":{"rendered":""},"modified":"2023-09-05T11:11:59","modified_gmt":"2023-09-05T11:11:59","slug":"bootkit","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/vn\/wiki\/bootkit\/","title":{"rendered":"B\u1ed9 kh\u1edfi \u0111\u1ed9ng"},"content":{"rendered":"<p>Bootkit l\u00e0 m\u1ed9t lo\u1ea1i ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i ph\u1ee9c t\u1ea1p nh\u1eafm m\u1ee5c ti\u00eau c\u1ee5 th\u1ec3 v\u00e0o qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng c\u1ee7a h\u1ec7 th\u1ed1ng m\u00e1y t\u00ednh. N\u00f3 s\u1edf h\u1eefu kh\u1ea3 n\u0103ng \u0111\u1ed9c nh\u1ea5t \u0111\u1ec3 l\u00e2y nhi\u1ec5m B\u1ea3n ghi kh\u1edfi \u0111\u1ed9ng ch\u00ednh (MBR) ho\u1eb7c ch\u01b0\u01a1ng tr\u00ecnh c\u01a1 s\u1edf Giao di\u1ec7n ph\u1ea7n m\u1ec1m m\u1edf r\u1ed9ng h\u1ee3p nh\u1ea5t (UEFI), khi\u1ebfn n\u00f3 c\u00f3 kh\u1ea3 n\u0103ng t\u00e0ng h\u00ecnh \u0111\u1eb7c bi\u1ec7t v\u00e0 kh\u00f3 ph\u00e1t hi\u1ec7n. Bootkit \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 gi\u00e0nh quy\u1ec1n ki\u1ec3m so\u00e1t li\u00ean t\u1ee5c \u0111\u1ed1i v\u1edbi h\u1ec7 th\u1ed1ng b\u1ecb nhi\u1ec5m, ngay c\u1ea3 tr\u01b0\u1edbc khi h\u1ec7 \u0111i\u1ec1u h\u00e0nh (OS) t\u1ea3i, cho ph\u00e9p ch\u00fang kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n b\u1edfi c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt truy\u1ec1n th\u1ed1ng.<\/p>\n<h2>L\u1ecbch s\u1eed ngu\u1ed3n g\u1ed1c c\u1ee7a Bootkit v\u00e0 l\u1ea7n \u0111\u1ea7u ti\u00ean nh\u1eafc t\u1edbi n\u00f3<\/h2>\n<p>Kh\u00e1i ni\u1ec7m Bootkit xu\u1ea5t hi\u1ec7n v\u00e0o gi\u1eefa nh\u1eefng n\u0103m 2000 nh\u01b0 m\u1ed9t s\u1ef1 ph\u00e1t tri\u1ec3n c\u1ee7a rootkit truy\u1ec1n th\u1ed1ng. Ngu\u1ed3n g\u1ed1c c\u1ee7a ch\u00fang c\u00f3 th\u1ec3 b\u1eaft ngu\u1ed3n t\u1eeb th\u1eddi k\u1ef3 m\u00e0 rootkit \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 gi\u00e0nh \u0111\u1eb7c quy\u1ec1n qu\u1ea3n tr\u1ecb tr\u00ean h\u1ec7 th\u1ed1ng. Tuy nhi\u00ean, v\u1edbi nh\u1eefng ti\u1ebfn b\u1ed9 trong c\u00f4ng ngh\u1ec7 b\u1ea3o m\u1eadt v\u00e0 s\u1ef1 ra \u0111\u1eddi c\u1ee7a c\u01a1 ch\u1ebf kh\u1edfi \u0111\u1ed9ng an to\u00e0n, nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 chuy\u1ec3n tr\u1ecdng t\u00e2m sang vi\u1ec7c x\u00e2m ph\u1ea1m ch\u00ednh qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng.<\/p>\n<p>S\u1ef1 \u0111\u1ec1 c\u1eadp n\u1ed5i b\u1eadt \u0111\u1ea7u ti\u00ean v\u1ec1 Bootkit l\u00e0 v\u00e0o n\u0103m 2007 khi c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u th\u1ea3o lu\u1eadn v\u1ec1 k\u1ef9 thu\u1eadt \u201cBootRoot\u201d t\u1ea1i h\u1ed9i ngh\u1ecb Black Hat Europe. BootRoot l\u00e0 m\u1ed9t trong nh\u1eefng Bootkit \u0111\u1ea7u ti\u00ean \u0111\u01b0\u1ee3c bi\u1ebft l\u00e0 \u0111\u00e3 s\u1eed d\u1ee5ng MBR \u0111\u1ed9c h\u1ea1i \u0111\u1ec3 ki\u1ec3m so\u00e1t h\u1ec7 th\u1ed1ng trong qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng. K\u1ec3 t\u1eeb \u0111\u00f3, Bootkit \u0111\u00e3 ph\u00e1t tri\u1ec3n \u0111\u00e1ng k\u1ec3, k\u1ef9 thu\u1eadt c\u1ee7a ch\u00fang ng\u00e0y c\u00e0ng ph\u1ee9c t\u1ea1p v\u00e0 ph\u1ee9c t\u1ea1p h\u01a1n.<\/p>\n<h2>Th\u00f4ng tin chi ti\u1ebft v\u1ec1 Bootkit. M\u1edf r\u1ed9ng ch\u1ee7 \u0111\u1ec1 Bootkit<\/h2>\n<p>Bootkit ho\u1ea1t \u0111\u1ed9ng \u1edf m\u1ee9c \u0111\u1ed9 th\u1ea5p h\u01a1n so v\u1edbi c\u00e1c lo\u1ea1i ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i kh\u00e1c, cho ph\u00e9p ch\u00fang thao t\u00fang qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng v\u00e0 quy tr\u00ecnh kh\u1edfi t\u1ea1o h\u1ec7 \u0111i\u1ec1u h\u00e0nh. B\u1eb1ng c\u00e1ch l\u00e2y nhi\u1ec5m ph\u1ea7n s\u1ee5n MBR ho\u1eb7c UEFI, Bootkit c\u00f3 th\u1ec3 t\u1ea3i m\u00e3 \u0111\u1ed9c tr\u01b0\u1edbc khi h\u1ec7 \u0111i\u1ec1u h\u00e0nh kh\u1edfi \u0111\u1ed9ng, khi\u1ebfn ch\u00fang c\u1ef1c k\u1ef3 kh\u00f3 ph\u00e1t hi\u1ec7n v\u00e0 lo\u1ea1i b\u1ecf.<\/p>\n<p>\u0110\u00e2y l\u00e0 nh\u1eefng \u0111\u1eb7c \u0111i\u1ec3m ch\u00ednh c\u1ee7a Bootkits:<\/p>\n<ol>\n<li>\n<p><strong>Ki\u00ean tr\u00ec<\/strong>: Bootkit c\u00f3 kh\u1ea3 n\u0103ng thi\u1ebft l\u1eadp ch\u1ed7 \u0111\u1ee9ng trong h\u1ec7 th\u1ed1ng v\u00e0 duy tr\u00ec quy\u1ec1n ki\u1ec3m so\u00e1t ngay c\u1ea3 sau khi kh\u1edfi \u0111\u1ed9ng l\u1ea1i h\u1ec7 th\u1ed1ng. H\u1ecd th\u01b0\u1eddng s\u1eeda \u0111\u1ed5i ph\u1ea7n s\u1ee5n MBR ho\u1eb7c UEFI \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o m\u00e3 c\u1ee7a h\u1ecd \u0111\u01b0\u1ee3c th\u1ef1c thi trong m\u1ecdi qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng.<\/p>\n<\/li>\n<li>\n<p><strong>s\u1ef1 t\u00e0ng h\u00ecnh<\/strong>: Bootkit \u01b0u ti\u00ean \u1ea9n m\u00ecnh kh\u1ecfi ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt, ho\u1ea1t \u0111\u1ed9ng \u1edf ch\u1ebf \u0111\u1ed9 \u1ea9n \u0111\u1ec3 tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n. \u0110i\u1ec1u n\u00e0y khi\u1ebfn ch\u00fang \u0111\u1eb7c bi\u1ec7t nguy hi\u1ec3m v\u00ec ch\u00fang c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n trong th\u1eddi gian d\u00e0i.<\/p>\n<\/li>\n<li>\n<p><strong>N\u00e2ng cao \u0111\u1eb7c quy\u1ec1n<\/strong>: Bootkit nh\u1eb1m m\u1ee5c \u0111\u00edch \u0111\u1ea1t \u0111\u01b0\u1ee3c c\u00e1c \u0111\u1eb7c quy\u1ec1n n\u00e2ng cao \u0111\u1ec3 truy c\u1eadp c\u00e1c th\u00e0nh ph\u1ea7n h\u1ec7 th\u1ed1ng quan tr\u1ecdng v\u00e0 v\u01b0\u1ee3t qua c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt, bao g\u1ed3m c\u00e1c c\u01a1 ch\u1ebf b\u1ea3o v\u1ec7 ch\u1ebf \u0111\u1ed9 kernel.<\/p>\n<\/li>\n<li>\n<p><strong>K\u1ef9 thu\u1eadt ch\u1ed1ng ph\u00e1p y<\/strong>: Bootkit th\u01b0\u1eddng xuy\u00ean s\u1eed d\u1ee5ng c\u00e1c k\u1ef9 thu\u1eadt ch\u1ed1ng ph\u00e1p y \u0111\u1ec3 ch\u1ed1ng l\u1ea1i vi\u1ec7c ph\u00e2n t\u00edch v\u00e0 lo\u1ea1i b\u1ecf. H\u1ecd c\u00f3 th\u1ec3 m\u00e3 h\u00f3a ho\u1eb7c l\u00e0m x\u00e1o tr\u1ed9n m\u00e3 v\u00e0 d\u1eef li\u1ec7u c\u1ee7a m\u00ecnh, khi\u1ebfn vi\u1ec7c k\u1ef9 thu\u1eadt \u0111\u1ea3o ng\u01b0\u1ee3c tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n.<\/p>\n<\/li>\n<\/ol>\n<h2>C\u1ea5u tr\u00fac b\u00ean trong c\u1ee7a Bootkit. C\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a Bootkit<\/h2>\n<p>C\u1ea5u tr\u00fac b\u00ean trong c\u1ee7a Bootkit r\u1ea5t ph\u1ee9c t\u1ea1p v\u00e0 kh\u00e1c nhau t\u00f9y thu\u1ed9c v\u00e0o ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i c\u1ee5 th\u1ec3. Tuy nhi\u00ean, c\u01a1 ch\u1ebf l\u00e0m vi\u1ec7c chung bao g\u1ed3m c\u00e1c b\u01b0\u1edbc sau:<\/p>\n<ol>\n<li>\n<p><strong>S\u1ef1 nhi\u1ec5m tr\u00f9ng<\/strong>: Bootkit gi\u00e0nh \u0111\u01b0\u1ee3c quy\u1ec1n truy c\u1eadp ban \u0111\u1ea7u v\u00e0o h\u1ec7 th\u1ed1ng th\u00f4ng qua nhi\u1ec1u ph\u01b0\u01a1ng ti\u1ec7n kh\u00e1c nhau, ch\u1eb3ng h\u1ea1n nh\u01b0 email l\u1eeba \u0111\u1ea3o, n\u1ed9i dung t\u1ea3i xu\u1ed1ng b\u1ecb nhi\u1ec5m \u0111\u1ed9c ho\u1eb7c khai th\u00e1c l\u1ed7 h\u1ed5ng.<\/p>\n<\/li>\n<li>\n<p><strong>Thao t\u00e1c qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng<\/strong>: Bootkit thay \u0111\u1ed5i firmware MBR ho\u1eb7c UEFI \u0111\u1ec3 ch\u00e8n m\u00e3 \u0111\u1ed9c c\u1ee7a n\u00f3 v\u00e0o qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng.<\/p>\n<\/li>\n<li>\n<p><strong>Ki\u1ec3m so\u00e1t ti\u1ebfp qu\u1ea3n<\/strong>: Trong qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng, m\u00e3 MBR ho\u1eb7c UEFI b\u1ecb nhi\u1ec5m s\u1ebd ki\u1ec3m so\u00e1t v\u00e0 t\u1ea3i th\u00e0nh ph\u1ea7n ch\u00ednh c\u1ee7a Bootkit, sau \u0111\u00f3 thi\u1ebft l\u1eadp t\u00ednh b\u1ec1n v\u1eefng v\u00e0 b\u1eaft \u0111\u1ea7u th\u1ef1c thi t\u1ea3i tr\u1ecdng l\u00f5i.<\/p>\n<\/li>\n<li>\n<p><strong>Ch\u1ee9c n\u0103ng rootkit<\/strong>: Bootkit th\u01b0\u1eddng bao g\u1ed3m ch\u1ee9c n\u0103ng rootkit \u0111\u1ec3 che gi\u1ea5u s\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a ch\u00fang kh\u1ecfi ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt v\u00e0 h\u1ec7 \u0111i\u1ec1u h\u00e0nh.<\/p>\n<\/li>\n<li>\n<p><strong>Th\u1ef1c thi t\u1ea3i tr\u1ecdng<\/strong>: Sau khi \u0111\u01b0\u1ee3c ki\u1ec3m so\u00e1t, Bootkit c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n nhi\u1ec1u h\u00e0nh \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i kh\u00e1c nhau, ch\u1eb3ng h\u1ea1n nh\u01b0 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m, ti\u00eam th\u00eam ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i ho\u1eb7c cung c\u1ea5p quy\u1ec1n truy c\u1eadp c\u1eeda sau v\u00e0o h\u1ec7 th\u1ed1ng.<\/p>\n<\/li>\n<\/ol>\n<h2>Ph\u00e2n t\u00edch c\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a Bootkit<\/h2>\n<p>Bootkit s\u1edf h\u1eefu m\u1ed9t s\u1ed1 t\u00ednh n\u0103ng ch\u00ednh gi\u00fap ch\u00fang kh\u00e1c bi\u1ec7t v\u1edbi c\u00e1c lo\u1ea1i ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i kh\u00e1c:<\/p>\n<ol>\n<li>\n<p><strong>Thao t\u00e1c qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng<\/strong>: B\u1eb1ng c\u00e1ch l\u00e2y nhi\u1ec5m v\u00e0o qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng, Bootkit c\u00f3 th\u1ec3 t\u1ea3i tr\u01b0\u1edbc h\u1ec7 \u0111i\u1ec1u h\u00e0nh, mang l\u1ea1i cho ch\u00fang kh\u1ea3 n\u0103ng ki\u1ec3m so\u00e1t v\u00e0 t\u00e0ng h\u00ecnh cao.<\/p>\n<\/li>\n<li>\n<p><strong>Ki\u00ean tr\u00ec<\/strong>: Bootkit thi\u1ebft l\u1eadp t\u00ednh b\u1ec1n v\u1eefng tr\u00ean h\u1ec7 th\u1ed1ng, khi\u1ebfn ch\u00fang kh\u00f3 b\u1ecb lo\u1ea1i b\u1ecf n\u1ebfu kh\u00f4ng c\u00f3 c\u00f4ng c\u1ee5 chuy\u00ean d\u1ee5ng v\u00e0 ki\u1ebfn th\u1ee9c chuy\u00ean m\u00f4n.<\/p>\n<\/li>\n<li>\n<p><strong>Quy\u1ec1n truy c\u1eadp c\u1ea5p h\u1ea1t nh\u00e2n<\/strong>: Nhi\u1ec1u Bootkit ho\u1ea1t \u0111\u1ed9ng \u1edf c\u1ea5p kernel, cho ph\u00e9p ch\u00fang v\u01b0\u1ee3t qua c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt v\u00e0 truy c\u1eadp c\u00e1c th\u00e0nh ph\u1ea7n h\u1ec7 th\u1ed1ng quan tr\u1ecdng.<\/p>\n<\/li>\n<li>\n<p><strong>T\u00ednh m\u00f4 \u0111un<\/strong>: Bootkit th\u01b0\u1eddng s\u1eed d\u1ee5ng c\u1ea5u tr\u00fac m\u00f4-\u0111un, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng c\u1eadp nh\u1eadt ho\u1eb7c thay \u0111\u1ed5i c\u00e1c ch\u1ee9c n\u0103ng \u0111\u1ed9c h\u1ea1i c\u1ee7a ch\u00fang m\u1ed9t c\u00e1ch d\u1ec5 d\u00e0ng.<\/p>\n<\/li>\n<li>\n<p><strong>K\u1ef9 thu\u1eadt ch\u1ed1ng ph\u00e1p y<\/strong>: Bootkit k\u1ebft h\u1ee3p c\u00e1c ph\u01b0\u01a1ng ph\u00e1p ch\u1ed1ng ph\u00e1p y \u0111\u1ec3 tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n v\u00e0 ph\u00e2n t\u00edch, l\u00e0m ph\u1ee9c t\u1ea1p vi\u1ec7c lo\u1ea1i b\u1ecf ch\u00fang.<\/p>\n<\/li>\n<\/ol>\n<h2>C\u00e1c lo\u1ea1i Bootkit<\/h2>\n<p>Bootkit c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c ph\u00e2n lo\u1ea1i th\u00e0nh nhi\u1ec1u lo\u1ea1i kh\u00e1c nhau d\u1ef1a tr\u00ean \u0111\u1eb7c \u0111i\u1ec3m v\u00e0 ch\u1ee9c n\u0103ng c\u1ee5 th\u1ec3 c\u1ee7a ch\u00fang. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 c\u00e1c lo\u1ea1i ch\u00ednh:<\/p>\n<table>\n<thead>\n<tr>\n<th><strong>Ki\u1ec3u<\/strong><\/th>\n<th><strong>S\u1ef1 mi\u00eau t\u1ea3<\/strong><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>B\u1ed9 kh\u1edfi \u0111\u1ed9ng MBR<\/strong><\/td>\n<td>L\u00e2y nhi\u1ec5m B\u1ea3n ghi kh\u1edfi \u0111\u1ed9ng ch\u00ednh \u0111\u1ec3 ki\u1ec3m so\u00e1t qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng.<\/td>\n<\/tr>\n<tr>\n<td><strong>B\u1ed9 kh\u1edfi \u0111\u1ed9ng UEFI<\/strong><\/td>\n<td>Nh\u1eafm m\u1ee5c ti\u00eau ch\u01b0\u01a1ng tr\u00ecnh c\u01a1 s\u1edf UEFI v\u00e0 Giao di\u1ec7n ch\u01b0\u01a1ng tr\u00ecnh c\u01a1 s\u1edf m\u1edf r\u1ed9ng (EFI) \u0111\u1ec3 t\u1ed3n t\u1ea1i trong c\u00e1c h\u1ec7 th\u1ed1ng hi\u1ec7n \u0111\u1ea1i.<\/td>\n<\/tr>\n<tr>\n<td><strong>B\u1ed9 kh\u1edfi \u0111\u1ed9ng b\u1ed9 nh\u1edb<\/strong><\/td>\n<td>V\u1eabn n\u1eb1m trong b\u1ed9 nh\u1edb m\u00e0 kh\u00f4ng s\u1eeda \u0111\u1ed5i MBR ho\u1eb7c UEFI, v\u1eabn \u1ea9n trong khi h\u1ec7 th\u1ed1ng \u0111ang ch\u1ea1y.<\/td>\n<\/tr>\n<tr>\n<td><strong>B\u1ed9 kh\u1edfi \u0111\u1ed9ng rootkit<\/strong><\/td>\n<td>K\u1ebft h\u1ee3p ch\u1ee9c n\u0103ng c\u1ee7a Bootkit v\u1edbi ch\u1ee9c n\u0103ng c\u1ee7a rootkit truy\u1ec1n th\u1ed1ng \u0111\u1ec3 che gi\u1ea5u s\u1ef1 hi\u1ec7n di\u1ec7n v\u00e0 ho\u1ea1t \u0111\u1ed9ng c\u1ee7a n\u00f3.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>C\u00e1ch s\u1eed d\u1ee5ng Bootkit, c\u00e1c v\u1ea5n \u0111\u1ec1 v\u00e0 c\u00e1ch gi\u1ea3i quy\u1ebft li\u00ean quan \u0111\u1ebfn vi\u1ec7c s\u1eed d\u1ee5ng<\/h2>\n<p>Bootkit \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ed9i ph\u1ea1m m\u1ea1ng s\u1eed d\u1ee5ng cho nhi\u1ec1u m\u1ee5c \u0111\u00edch \u0111\u1ed9c h\u1ea1i kh\u00e1c nhau:<\/p>\n<ol>\n<li>\n<p><strong>Nhi\u1ec5m tr\u00f9ng l\u00e9n l\u00fat<\/strong>: Bootkit \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 thi\u1ebft l\u1eadp s\u1ef1 l\u00e2y nhi\u1ec5m l\u00e9n l\u00fat tr\u00ean c\u00e1c h\u1ec7 th\u1ed1ng m\u1ee5c ti\u00eau, cho ph\u00e9p ki\u1ec3m so\u00e1t li\u00ean t\u1ee5c m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n.<\/p>\n<\/li>\n<li>\n<p><strong>Tr\u1ed9m c\u1eafp d\u1eef li\u1ec7u<\/strong>: T\u1ed9i ph\u1ea1m m\u1ea1ng t\u1eadn d\u1ee5ng Bootkit \u0111\u1ec3 \u0111\u00e1nh c\u1eafp th\u00f4ng tin nh\u1ea1y c\u1ea3m, ch\u1eb3ng h\u1ea1n nh\u01b0 th\u00f4ng tin x\u00e1c th\u1ef1c \u0111\u0103ng nh\u1eadp, d\u1eef li\u1ec7u t\u00e0i ch\u00ednh v\u00e0 th\u00f4ng tin c\u00e1 nh\u00e2n.<\/p>\n<\/li>\n<li>\n<p><strong>gi\u00e1n \u0111i\u1ec7p<\/strong>: Nh\u1eefng k\u1ebb \u0111\u01b0\u1ee3c nh\u00e0 n\u01b0\u1edbc b\u1ea3o tr\u1ee3 c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng Bootkit cho m\u1ee5c \u0111\u00edch thu th\u1eadp th\u00f4ng tin t\u00ecnh b\u00e1o, gi\u00e1n \u0111i\u1ec7p ho\u1eb7c chi\u1ebfn tranh m\u1ea1ng.<\/p>\n<\/li>\n<li>\n<p><strong>T\u1ea5n c\u00f4ng h\u1ee7y di\u1ec7t<\/strong>: Bootkit c\u00f3 th\u1ec3 t\u1ea1o \u0111i\u1ec1u ki\u1ec7n cho c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ph\u00e1 ho\u1ea1i, ch\u1eb3ng h\u1ea1n nh\u01b0 x\u00f3a s\u1ea1ch d\u1eef li\u1ec7u, l\u00e0m gi\u00e1n \u0111o\u1ea1n c\u00e1c h\u1ec7 th\u1ed1ng quan tr\u1ecdng ho\u1eb7c g\u00e2y ra l\u1ed7i h\u1ec7 th\u1ed1ng.<\/p>\n<\/li>\n<\/ol>\n<h3>V\u1ea5n \u0111\u1ec1 v\u00e0 gi\u1ea3i ph\u00e1p:<\/h3>\n<ul>\n<li>\n<p><strong>Th\u1eed th\u00e1ch ph\u00e1t hi\u1ec7n<\/strong>: Ph\u1ea7n m\u1ec1m ch\u1ed1ng vi-r\u00fat truy\u1ec1n th\u1ed1ng c\u00f3 th\u1ec3 g\u1eb7p kh\u00f3 kh\u0103n trong vi\u1ec7c x\u00e1c \u0111\u1ecbnh Bootkit do thao t\u00e1c qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng \u1edf m\u1ee9c \u0111\u1ed9 th\u1ea5p. Vi\u1ec7c s\u1eed d\u1ee5ng t\u00ednh n\u0103ng b\u1ea3o v\u1ec7 \u0111i\u1ec3m cu\u1ed1i n\u00e2ng cao v\u00e0 ph\u00e2n t\u00edch h\u00e0nh vi c\u00f3 th\u1ec3 gi\u00fap ph\u00e1t hi\u1ec7n v\u00e0 gi\u1ea3m thi\u1ec3u t\u00ecnh tr\u1ea1ng l\u00e2y nhi\u1ec5m Bootkit.<\/p>\n<\/li>\n<li>\n<p><strong>B\u1ea3o m\u1eadt ph\u1ea7n m\u1ec1m c\u01a1 s\u1edf<\/strong>: Vi\u1ec7c \u0111\u1ea3m b\u1ea3o t\u00ednh to\u00e0n v\u1eb9n c\u1ee7a ch\u01b0\u01a1ng tr\u00ecnh c\u01a1 s\u1edf v\u00e0 k\u00edch ho\u1ea1t c\u01a1 ch\u1ebf kh\u1edfi \u0111\u1ed9ng an to\u00e0n c\u00f3 th\u1ec3 b\u1ea3o v\u1ec7 kh\u1ecfi UEFI Bootkit.<\/p>\n<\/li>\n<li>\n<p><strong>C\u1eadp nh\u1eadt th\u01b0\u1eddng xuy\u00ean<\/strong>: Lu\u00f4n c\u1eadp nh\u1eadt h\u1ec7 \u0111i\u1ec1u h\u00e0nh, ch\u01b0\u01a1ng tr\u00ecnh c\u01a1 s\u1edf v\u00e0 ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt gi\u00fap gi\u1ea3i quy\u1ebft c\u00e1c l\u1ed7 h\u1ed5ng m\u00e0 Bootkit khai th\u00e1c.<\/p>\n<\/li>\n<\/ul>\n<h2>C\u00e1c \u0111\u1eb7c \u0111i\u1ec3m ch\u00ednh v\u00e0 so s\u00e1nh kh\u00e1c v\u1edbi c\u00e1c thu\u1eadt ng\u1eef t\u01b0\u01a1ng t\u1ef1<\/h2>\n<table>\n<thead>\n<tr>\n<th><strong>Thu\u1eadt ng\u1eef<\/strong><\/th>\n<th><strong>S\u1ef1 mi\u00eau t\u1ea3<\/strong><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Rootkit<\/strong><\/td>\n<td>M\u1ed9t lo\u1ea1i ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i che gi\u1ea5u s\u1ef1 hi\u1ec7n di\u1ec7n v\u00e0 ho\u1ea1t \u0111\u1ed9ng c\u1ee7a n\u00f3 tr\u00ean h\u1ec7 th\u1ed1ng b\u1ecb nhi\u1ec5m.<\/td>\n<\/tr>\n<tr>\n<td><strong>Trojan<\/strong><\/td>\n<td>Ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i c\u1ea3i trang th\u00e0nh ph\u1ea7n m\u1ec1m h\u1ee3p ph\u00e1p \u0111\u1ec3 \u0111\u00e1nh l\u1eeba ng\u01b0\u1eddi d\u00f9ng v\u00e0 th\u1ef1c hi\u1ec7n c\u00e1c h\u00e0nh \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i.<\/td>\n<\/tr>\n<tr>\n<td><strong>Vi-r\u00fat<\/strong><\/td>\n<td>M\u1ed9t ch\u01b0\u01a1ng tr\u00ecnh t\u1ef1 sao ch\u00e9p l\u00e2y nhi\u1ec5m sang c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh kh\u00e1c v\u00e0 l\u00e2y lan kh\u1eafp h\u1ec7 th\u1ed1ng ho\u1eb7c m\u1ea1ng.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<ul>\n<li>\n<p>Trong khi rootkit v\u00e0 Bootkit c\u00f3 chung m\u1ee5c ti\u00eau l\u00e0 t\u00e0ng h\u00ecnh th\u00ec Bootkit ho\u1ea1t \u0111\u1ed9ng \u1edf c\u1ea5p \u0111\u1ed9 th\u1ea5p h\u01a1n trong qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng.<\/p>\n<\/li>\n<li>\n<p>Trojan v\u00e0 virus th\u01b0\u1eddng d\u1ef1a v\u00e0o s\u1ef1 t\u01b0\u01a1ng t\u00e1c c\u1ee7a ng\u01b0\u1eddi d\u00f9ng ho\u1eb7c th\u1ef1c thi ch\u01b0\u01a1ng tr\u00ecnh, trong khi Bootkit l\u00e2y nhi\u1ec5m tr\u1ef1c ti\u1ebfp v\u00e0o qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng.<\/p>\n<\/li>\n<\/ul>\n<h2>Nh\u1eefng quan \u0111i\u1ec3m v\u00e0 c\u00f4ng ngh\u1ec7 c\u1ee7a t\u01b0\u01a1ng lai li\u00ean quan \u0111\u1ebfn Bootkit<\/h2>\n<p>Khi c\u00f4ng ngh\u1ec7 ti\u1ebfn b\u1ed9, c\u00e1c nh\u00e0 ph\u00e1t tri\u1ec3n Bootkit c\u00f3 th\u1ec3 s\u1ebd t\u00ecm ki\u1ebfm c\u00e1c ph\u01b0\u01a1ng ph\u00e1p tinh vi h\u01a1n \u0111\u1ec3 tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n v\u00e0 t\u1ed3n t\u1ea1i l\u00e2u d\u00e0i tr\u00ean c\u00e1c h\u1ec7 th\u1ed1ng m\u1ee5c ti\u00eau. Quan \u0111i\u1ec3m trong t\u01b0\u01a1ng lai v\u1ec1 Bootkit c\u00f3 th\u1ec3 li\u00ean quan \u0111\u1ebfn:<\/p>\n<ol>\n<li>\n<p><strong>B\u1ea3o m\u1eadt d\u1ef1a tr\u00ean ph\u1ea7n c\u1ee9ng<\/strong>: Nh\u1eefng ti\u1ebfn b\u1ed9 trong c\u00f4ng ngh\u1ec7 b\u1ea3o m\u1eadt ph\u1ea7n c\u1ee9ng c\u00f3 th\u1ec3 t\u0103ng c\u01b0\u1eddng kh\u1ea3 n\u0103ng b\u1ea3o v\u1ec7 ch\u1ed1ng l\u1ea1i thao t\u00e1c trong qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng.<\/p>\n<\/li>\n<li>\n<p><strong>Ph\u00e1t hi\u1ec7n d\u1ef1a tr\u00ean AI h\u00e0nh vi<\/strong>: C\u00e1c gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt d\u1ef1a tr\u00ean AI c\u00f3 th\u1ec3 c\u1ea3i thi\u1ec7n vi\u1ec7c x\u00e1c \u0111\u1ecbnh h\u00e0nh vi kh\u1edfi \u0111\u1ed9ng b\u1ea5t th\u01b0\u1eddng li\u00ean quan \u0111\u1ebfn Bootkit.<\/p>\n<\/li>\n<li>\n<p><strong>B\u1ea3o v\u1ec7 t\u00ednh to\u00e0n v\u1eb9n b\u1ed9 nh\u1edb<\/strong>: Bootkit d\u1ef1a tr\u00ean b\u1ed9 nh\u1edb c\u00f3 th\u1ec3 g\u1eb7p ph\u1ea3i th\u00e1ch th\u1ee9c khi tri\u1ec3n khai c\u01a1 ch\u1ebf b\u1ea3o v\u1ec7 t\u00ednh to\u00e0n v\u1eb9n c\u1ee7a b\u1ed9 nh\u1edb trong h\u1ec7 \u0111i\u1ec1u h\u00e0nh.<\/p>\n<\/li>\n<\/ol>\n<h2>C\u00e1ch s\u1eed d\u1ee5ng ho\u1eb7c li\u00ean k\u1ebft m\u00e1y ch\u1ee7 proxy v\u1edbi Bootkit<\/h2>\n<p>M\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng c\u00f9ng v\u1edbi Bootkit nh\u01b0 m\u1ed9t ph\u1ea7n c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng. T\u1ed9i ph\u1ea1m m\u1ea1ng c\u00f3 th\u1ec3 \u0111\u1ecbnh tuy\u1ebfn l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp \u0111\u1ed9c h\u1ea1i th\u00f4ng qua m\u00e1y ch\u1ee7 proxy \u0111\u1ec3 che gi\u1ea5u ngu\u1ed3n ho\u1ea1t \u0111\u1ed9ng c\u1ee7a ch\u00fang, khi\u1ebfn vi\u1ec7c truy t\u00ecm ngu\u1ed3n g\u1ed1c c\u1ee7a ch\u00fang tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n.<\/p>\n<p><strong>Li\u00ean k\u1ebft li\u00ean quan<\/strong>:<\/p>\n<ul>\n<li><a href=\"https:\/\/www.symantec.com\/security-center\/writeup\/2013-080722-0512-99\" target=\"_new\" rel=\"noopener nofollow\">T\u00ecm hi\u1ec3u v\u1ec1 Bootkit \u2013 Symantec<\/a><\/li>\n<li><a href=\"https:\/\/resources.infosecinstitute.com\/topic\/bootkits-new-threat-computer\/#gref\" target=\"_new\" rel=\"noopener nofollow\">Bootkit: M\u1ed1i \u0111e d\u1ecda m\u1edbi \u0111\u1ed1i v\u1edbi m\u00e1y t\u00ednh c\u1ee7a b\u1ea1n<\/a><\/li>\n<\/ul>\n<p>T\u00f3m l\u1ea1i, Bootkit \u0111\u1ea1i di\u1ec7n cho m\u1ed9t d\u1ea1ng ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i c\u1ef1c k\u1ef3 nguy hi\u1ec3m ho\u1ea1t \u0111\u1ed9ng \u1edf c\u1ea5p \u0111\u1ed9 c\u01a1 b\u1ea3n trong h\u1ec7 th\u1ed1ng. Kh\u1ea3 n\u0103ng thao t\u00fang qu\u00e1 tr\u00ecnh kh\u1edfi \u0111\u1ed9ng v\u00e0 thi\u1ebft l\u1eadp t\u00ednh b\u1ec1n b\u1ec9 c\u1ee7a ch\u00fang khi\u1ebfn ch\u00fang tr\u1edf th\u00e0nh m\u1ed9t th\u00e1ch th\u1ee9c \u0111\u00e1ng k\u1ec3 \u0111\u1ed1i v\u1edbi c\u00e1c chuy\u00ean gia an ninh m\u1ea1ng. Hi\u1ec3u \u0111\u01b0\u1ee3c \u0111\u1eb7c \u0111i\u1ec3m, ph\u01b0\u01a1ng ph\u00e1p l\u00e2y nhi\u1ec5m v\u00e0 c\u00e1c gi\u1ea3i ph\u00e1p ti\u1ec1m n\u0103ng c\u1ee7a ch\u00fang l\u00e0 r\u1ea5t quan tr\u1ecdng trong vi\u1ec7c ch\u1ed1ng l\u1ea1i c\u00e1c m\u1ed1i \u0111e d\u1ecda ti\u00ean ti\u1ebfn n\u00e0y trong t\u01b0\u01a1ng lai.<\/p>","protected":false},"featured_media":467782,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-476091","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Bootkit: A Comprehensive Overview<\/mark>","faq_items":[{"question":"What is a Bootkit?","answer":"<p>A Bootkit is a highly sophisticated form of malware that specifically targets the boot process of a computer system. It infects the Master Boot Record (MBR) or UEFI firmware, allowing it to gain persistent control over the system, even before the operating system loads. This stealthy approach makes Bootkits exceptionally difficult to detect and remove.<\/p>"},{"question":"How did Bootkits originate, and when were they first mentioned?","answer":"<p>The concept of Bootkits emerged in the mid-2000s as an evolution of traditional rootkits. The first notable mention of Bootkits was in 2007 when researchers discussed the \"BootRoot\" technique at the Black Hat Europe conference. BootRoot was among the first Bootkits known to utilize a malicious MBR for control during the boot-up process.<\/p>"},{"question":"How do Bootkits work?","answer":"<p>Bootkits operate at a lower level compared to other malware types. They manipulate the boot process and OS initialization routines by infecting the MBR or UEFI firmware. Once infected, the Bootkit gains control during boot-up, establishing persistence and executing its core payload. This allows it to execute malicious actions while remaining undetected by traditional security measures.<\/p>"},{"question":"What are the key features of Bootkits?","answer":"<p>Bootkits possess several critical features, including persistence, stealthiness, privilege escalation, and anti-forensic techniques. They prioritize staying hidden from security software, operate at the kernel level, and employ anti-forensic methods to resist analysis.<\/p>"},{"question":"What types of Bootkits exist?","answer":"<p>Bootkits can be categorized into different types based on their characteristics and functionalities. The main types include MBR Bootkits, UEFI Bootkits, Memory Bootkits, and Rootkit Bootkits.<\/p>"},{"question":"How are Bootkits used, and what problems do they present?","answer":"<p>Bootkits have been employed for various malicious purposes, such as stealthy infections, data theft, espionage, and destructive attacks. Their stealthiness and low-level manipulation pose significant detection challenges for traditional security software. Ensuring firmware security, applying regular updates, and using advanced endpoint protection are essential to mitigate Bootkit-related problems.<\/p>"},{"question":"How do Bootkits compare with similar terms like rootkits, Trojans, and viruses?","answer":"<p>While Bootkits and rootkits share the objective of stealthiness, Bootkits operate at a lower level in the boot process. Unlike Trojans and viruses, Bootkits infect the boot process directly, enabling them to execute before the OS loads.<\/p>"},{"question":"What are the future perspectives and technologies related to Bootkits?","answer":"<p>As technology advances, Bootkit developers may seek more sophisticated methods to evade detection and persist on target systems. Hardware-based security, behavioral AI-based detection, and memory integrity protection are some potential future technologies to combat Bootkit threats.<\/p>"},{"question":"How are proxy servers associated with Bootkits?","answer":"<p>Proxy servers can be used in association with Bootkits as part of the attacker's infrastructure. Cybercriminals may route malicious traffic through proxy servers to hide the source of their activities, making it more difficult to trace them back to their origin.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/476091","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/476091\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media\/467782"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media?parent=476091"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}