57. A user downloads a patch from an unknown repository to update their device. After applying the patch, the system becomes unresponsive. An incident response team receives alerts sent by an FIM platform and indicates that the hashes simultaneously changed. Which of the following attacks most likely occurred?
Answer: D
Rootkit
The incident described suggests that the system became unresponsive after applying a patch from an unknown source, indicating a likely compromise of the device. A rootkit is designed to hide its presence and can alter system files, which aligns with the simultaneous hash changes reported by the FIM platform.
A) Logic bomb
A logic bomb is a piece of malicious code that triggers under specific conditions, but it typically does not cause immediate unresponsiveness or simultaneous hash changes across a system. The scenario described does not indicate a delayed trigger or specific condition for activation, making this option less likely.
B) Keylogger
Keyloggers are designed to capture keystrokes and user input rather than cause system instability or unresponsiveness. While they can lead to data breaches, they do not typically result in simultaneous hash changes or the direct system effects observed in this situation.
C) Ransomware
Ransomware encrypts data and demands a ransom for its release, which could lead to a system becoming unresponsive. However, ransomware usually encrypts specific files rather than altering system files to the extent that would result in simultaneous hash changes, making it an unlikely explanation for the observed behavior.
D) Rootkit
A rootkit is specifically designed to gain unauthorized access and maintain control over a computer while remaining hidden. This aligns perfectly with the unresponsiveness after applying a patch from an unknown source, as rootkits often modify system files, resulting in hash changes detected by the FIM platform.
Conclusion
The evidence strongly points to a rootkit as the cause of the system's unresponsiveness and the simultaneous hash changes. Other options, such as logic bombs, keyloggers, and ransomware, do not adequately explain the observed behavior and compromise, making the rootkit the most plausible explanation for this incident.