Lesson 4 of 7 · 8 min
Rootkits: malicious software that hides from you
A rootkit’s job is to stay hidden and stay put. See how rootkits work, why the deeper they sit the more dangerous they are, and how modern macOS makes their job much harder.
Most malicious software wants to do something: steal, encrypt, spy. A rootkit wants to not be seen while that happens. NIST defines a rootkit as a set of tools used by an attacker after gaining root-level access to a host, to conceal the attacker’s activities and to maintain privileged access through covert means. The name comes from Unix, where “root” is the all-powerful administrator account, and a “kit” was the bundle of modified tools an intruder left behind to keep that power quietly.
Two jobs: persistence and concealment
A rootkit usually combines two abilities. Persistence means surviving restarts and updates, so the attacker does not lose access. Concealment means hiding files, processes and network connections from the very tools you would use to look for them. MITRE ATT&CK describes the second trick directly: rootkits hide the presence of programs, files, network connections and services by intercepting and modifying the operating system calls that report on them. If the part of the system you ask “what is running?” has been tampered with, it can simply leave the answer out.
The deeper, the harder to find
| Level | Where it lives | How hard it is to detect and remove |
|---|---|---|
| User level | Replaces or hooks ordinary programs and libraries that run with your account | Hard, but tools running with higher privileges can often spot the tampering |
| Kernel level | Loads into the operating system’s core, where it can lie to every program | Very hard: the system itself reports false information |
| Boot and firmware level | Starts before the operating system, in the boot process or device firmware | Hardest: can survive a full reinstall of the operating system |
The general rule is that code running at a lower, more privileged level can deceive code running above it. That is why rootkits aim as low as they can, and why defenders put so much effort into making the lowest levels of a computer resistant to tampering.
How macOS fights back
Modern macOS is built to deny rootkits the places they used to hide. Apple documents several layers in its Platform Security guide:
- System Integrity Protection (SIP) prevents even the administrator account from modifying protected parts of the system, such as system folders and system processes. Apple recommends leaving it on.
- The system volume is sealed and signed: at startup, macOS checks that the system files are exactly what Apple shipped, and refuses to use a modified system.
- Secure boot on Apple silicon (and Macs with the T2 chip) verifies each stage of the boot process before running it, so code cannot slip in before the operating system.
- Third-party kernel extensions are restricted and require explicit approval; Apple has moved most of what they did into system extensions, which run outside the kernel.
Together, these make the classic kernel rootkit far harder to install on a current Mac with default settings. That is also the reason attackers now tend to stay at the user level and rely on persistence tricks such as login items and launch agents, which do not need to break the system’s seals.
Persistence you can check yourself
Because deep rootkits are hard to install, most persistence on Macs today is visible if you know where to look. macOS lists login items and background items in System Settings, under General, then Login Items & Extensions, and it notifies you when a new background item is added. Anything there that you do not recognise deserves a closer look. MITRE ATT&CK catalogues launch agents and launch daemons as common persistence techniques on macOS for exactly this reason.
Why the network still tells the truth
A rootkit can lie to programs on the same machine, but it still usually needs to talk to its operator. That traffic has to cross the network. A per-app firewall that sits in the operating system’s own filtering layer sees connections as the system handles them, and a router or another device on the network sees them from outside, where the rootkit has no control. FireAI’s network filter is an Apple system extension; it shows which app is behind each connection and asks before new apps connect. It is not a rootkit detector and cannot see through a compromised kernel, but unexplained traffic from a process you cannot account for is one of the classic signs that something is hiding.
Not only computers: routers and other devices
Rootkit-style implants are not limited to laptops. Home routers, network storage boxes and other always-on devices run their own small operating systems, often updated rarely or never. Attackers have repeatedly targeted them because they sit on every connection and few people ever check them. Keeping the router’s firmware up to date, changing its default administrator password and turning off remote administration you do not use closes the most common doors. It also explains why looking at traffic from more than one place is valuable: a problem that lives on the router will not show up in any scan of the Mac.
If you suspect a rootkit
- Assume the system’s own tools may not tell the truth; examine it from outside where possible.
- Check that System Integrity Protection is on (Apple documents how) and keep macOS up to date.
- Review Login Items & Extensions for unknown entries.
- For a serious suspicion, the reliable fix is to back up your documents (not apps or system files), erase the Mac, reinstall macOS from Apple and restore only your data.
- If the threat is targeted, for example against a journalist or activist, get expert help and consider Lockdown Mode.
Key takeaways
- A rootkit’s purpose is to hide an attacker’s presence and keep privileged access.
- The lower a rootkit sits (user, kernel, boot, firmware), the harder it is to detect and remove.
- System Integrity Protection, the signed system volume and secure boot make classic kernel rootkits much harder on modern Macs.
- A rootkit can lie to the computer, but its network traffic can still be seen from outside.
Check yourself
1. What are the two main jobs of a rootkit?
- Encrypting files and demanding payment
- Keeping privileged access (persistence) and hiding the attacker’s activity (concealment) — Right.
- Sending spam and mining cryptocurrency
- Displaying adverts and changing the home page
NIST defines rootkits as tools that conceal an attacker’s activity and maintain privileged access covertly.
2. Why are kernel-level rootkits so hard to detect?
- They are very small files
- They run in the operating system’s core and can make the system report false information to every program — Right.
- They only run at night
- They delete themselves after every restart
Code at a more privileged level can deceive the programs above it, including the tools you would use to look for it.
3. Which macOS feature prevents even an administrator from modifying protected system files?
- FileVault
- System Integrity Protection — Right.
- AirDrop
- Time Machine
SIP protects system folders and processes from modification, even by the administrator account, which blocks a classic rootkit technique.
Do it with FireAI
Put this lesson into practice on your own Mac.
- Rules: app, website, domain, IP or a range, forever or until you restart — Write a rule as precise as one address or as broad as an entire domain.
- The World map — See where your data actually goes, not just a hostname you’d have to look up yourself.
- Threat lists (opt-in) — Check your traffic against public threat data without sending it anywhere.
- Investigate a connection — Decide with the facts in front of you, not a vague warning.
- Security modes: Home, Coffee shop, Paranoid, Under attack — Match FireAI’s strictness to where your Mac actually is, in one tap.
- USB Network Protection: nothing from a USB drive goes online unasked — Plug in a drive someone handed you without letting what’s on it phone home.
Sources
- NIST Computer Security Resource Center Glossary: rootkit
- MITRE ATT&CK T1014: Rootkit
- MITRE ATT&CK T1543.001: Create or Modify System Process: Launch Agent
- Apple Support: About System Integrity Protection on your Mac
- Apple Platform Security: System security overview
- Apple Support: About Lockdown Mode
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.