13. A user downloads a patch from an unknown repository to update their device. After applying the patch, the system becomes unresponsive. An incident response team receives alerts sent by an FIM platform and indicates that the hashes of the operating system files have changed. Which of the following attacks most likely occurred?
Answer: D
Rootkit
The situation described suggests that after downloading and applying a patch from an unknown source, the device became unresponsive, and there were changes to the hashes of the operating system files. This strongly indicates the presence of a rootkit, which is designed to gain unauthorized access and maintain control over a system without detection.
A) Logic bomb
A logic bomb is a piece of malicious code that triggers under specific conditions, typically to perform harmful actions. While it could cause a system to become unresponsive, the indication of the operating system file hashes changing aligns more closely with a rootkit, which alters system files to maintain stealthy access.
B) Keylogger
A keylogger is designed to capture keystrokes for the purpose of stealing information, such as passwords. Although it can be part of a broader attack, it does not typically cause the operating system files to change or lead to an unresponsive system in the same way a rootkit would.
C) Ransomware
Ransomware encrypts files and demands payment to restore access. While it can make a system unresponsive by locking files, the specific mention of file hashes changing points more directly to a rootkit's method of subverting the operating system's integrity rather than merely restricting access to files.
D) Rootkit
A rootkit is specifically designed to hide its presence on a system and can modify operating system files, which would explain the changes in file hashes noted by the FIM platform. The unresponsiveness of the device further supports the likelihood that a rootkit has been installed, compromising the system's functionality.
Conclusion
The evidence points clearly to a rootkit as the most likely attack, given its ability to alter operating system files and cause unresponsiveness. Other options, such as logic bombs, keyloggers, and ransomware, do not adequately account for the specific changes in file hashes and the nature of the system's failure. The characteristics of a rootkit align perfectly with the situation presented, making it the definitive answer.