{"id":15692,"date":"2024-06-10T17:48:00","date_gmt":"2024-06-10T10:48:00","guid":{"rendered":"https:\/\/blog.tinohost.com\/?p=892"},"modified":"2025-06-16T16:34:55","modified_gmt":"2025-06-16T09:34:55","slug":"rootkit-la-gi-bi-an-ve-ke-thu-tham-lang-trong-the-gioi-mang","status":"publish","type":"post","link":"https:\/\/tino.vn\/blog\/rootkit-la-gi-bi-an-ve-ke-thu-tham-lang-trong-the-gioi-mang\/","title":{"rendered":"Rootkit l\u00e0 g\u00ec? B\u00ed \u1ea9n v\u1ec1 k\u1ebb th\u00f9 th\u1ea7m l\u1eb7ng trong th\u1ebf gi\u1edbi m\u1ea1ng"},"content":{"rendered":"\n

Trong th\u1ebf gi\u1edbi c\u00f4ng ngh\u1ec7 \u0111\u1ea7y r\u1eaby nh\u1eefng m\u1ed1i nguy hi\u1ec3m ti\u1ec1m \u1ea9n, Rootkit n\u1ed5i l\u00ean nh\u01b0 m\u1ed9t “b\u00f3ng ma” \u0111\u00e1ng s\u1ee3, \u00e2m th\u1ea7m x\u00e2m nh\u1eadp v\u00e0 thao t\u00fang h\u1ec7 th\u1ed1ng m\u00e1y t\u00ednh m\u00e0 ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng h\u1ec1 hay bi\u1ebft. V\u1eady Rootkit l\u00e0 g\u00ec? K\u1ebb th\u00f9 th\u1ea7m l\u1eb7ng n\u00e0y \u1ea9n ch\u1ee9a nh\u1eefng b\u00ed m\u1eadt g\u00ec v\u00e0 l\u00e0m th\u1ebf n\u00e0o \u0111\u1ec3 b\u1ea3o v\u1ec7 b\u1ea3n th\u00e2n kh\u1ecfi n\u00f3? H\u00e3y c\u00f9ng TinoHost kh\u00e1m ph\u00e1 trong b\u00e0i vi\u1ebft n\u00e0y!<\/strong><\/p>\n\n\n\n

Rootkit l\u00e0 g\u00ec?<\/strong><\/h2>\n\n\n\n

Rootkit<\/a>\u00a0l\u00e0 m\u1ed9t d\u1ea1ng ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i (malware<\/a>) \u0111\u01b0\u1ee3c x\u00e2y d\u1ef1ng v\u1edbi m\u1ee5c ti\u00eau ch\u1ee7 y\u1ebfu l\u00e0 \u0111\u1ec3 \u1ea9n gi\u1ea5u c\u00e1c \u0111o\u1ea1n m\u00e3 \u0111\u1ed9c c\u00f3 kh\u1ea3 n\u0103ng g\u00e2y nguy hi\u1ec3m \u0111\u1ebfn m\u00e1y t\u00ednh c\u1ee7a ch\u00fang ta. S\u1edf h\u1eefu m\u1ed9t c\u00e1ch \u201cng\u1ee5y trang\u201d si\u00eau \u0111\u1eb7c bi\u1ec7t, rootkit khi \u0111\u00e3 \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t s\u1ebd \u201c\u0111\u00e1nh l\u1eeba\u201d sao cho c\u00e1c ph\u1ea7n m\u1ec1m di\u1ec7t virus th\u00f4ng th\u01b0\u1eddng khi qu\u00e9t qua ch\u1ec9 th\u1ea5y n\u00f3 m\u1ed9t l\u00e0 m\u1ed9t \u1ee9ng d\u1ee5ng v\u00f4 h\u1ea1i.<\/p>\n\n\n

\n
\"rootkit-la-gi\"
Rootkit l\u00e0 g\u00ec?<\/figcaption><\/figure>\n<\/div>\n\n\n

Th\u1ef1c ra, b\u1ea3n ch\u1ea5t rootkit kh\u00f4ng mang m\u00e3 \u0111\u1ed9c nh\u01b0ng khi \u0111i chung v\u1edbi c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh mang t\u00ednh \u201cph\u00e1 ho\u1ea1i\u201d nh\u01b0: virus, s\u00e2u, ph\u1ea7n m\u1ec1m gi\u00e1n \u0111i\u1ec7p, trojan,\u2026 th\u00ec l\u1ea1i nguy hi\u1ec3m h\u01a1n r\u1ea5t nhi\u1ec1u.<\/p>\n\n\n\n

Nh\u1eefng malware n\u00e0o s\u1eed d\u1ee5ng k\u0129 thu\u1eadt rootkit?<\/strong><\/h2>\n\n\n\n

V\u00e0i Rootkit mang \u0111\u00fang \u00fd ngh\u0129a v\u00e0 t\u00ednh ch\u1ea5t c\u1ee7a rootkit \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn nh\u01b0: Hacker Defender v\u00e0 FU.<\/p>\n\n\n\n

M\u1ed9t s\u1ed1 ph\u1ea7n m\u1ec1m gi\u00e1n \u0111i\u1ec7p, qu\u1ea3ng c\u00e1o c\u00f3 s\u1eed d\u1ee5ng rootkit: EliteToolbar, ProAgent, and Probot SE.<\/p>\n\n\n\n

C\u00e1c trojan nh\u01b0: Berbew\/Padodor v\u00e0 Feutel\/Hupigon v\u00e0 m\u1ed9t s\u1ed1 s\u00e2u nh\u01b0: Myfip.h v\u00e0 h\u1ecd s\u00e2u Maslan c\u0169ng s\u1eed d\u1ee5ng rootkit.<\/p>\n\n\n\n

C\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a rootkit?<\/strong><\/h2>\n\n\n\n

B\u1ea3n th\u00e2n kh\u00f4ng c\u00f3 nh\u1eefng \u0111o\u1ea1n code \u0111\u1eb7c bi\u1ec7t \u0111\u1ec3 c\u00f3 th\u1ec3 t\u1ef1 nh\u00e2n b\u1ea3n v\u00e0 ph\u00e1t t\u00e1n. Th\u1ef1c s\u1ef1, rootkit ph\u00e1t t\u00e1n c\u00f9ng v\u1edbi nh\u1eefng ch\u01b0\u01a1ng tr\u00ecnh ph\u00e1 ho\u1ea1i c\u00f3 k\u00e8m theo n\u00f3 (th\u00f4ng qua nh\u1eefng l\u1ed7 h\u1ed5ng h\u1ec7 th\u1ed1ng c\u1ee7a\u00a0windows<\/a>\u00a0v\u00e0 nh\u1eefng ch\u01b0\u01a1ng tr\u00ecnh s\u1eed d\u1ee5ng). \u201cCon \u0111\u01b0\u1eddng ph\u00e1t t\u00e1n\u201d ph\u1ed5 bi\u1ebfn nh\u1ea5t l\u00e0 qua th\u01b0 \u0111i\u1ec7n t\u1eed. Ngo\u00e0i ra, hi\u1ec7n nay, hacker \u0111\u00e3 ph\u00e1t tri\u1ec3n r\u1ea5t nhi\u1ec1u k\u0129 thu\u1eadt tinh vi \u0111\u1ec3 ph\u00e1n t\u00e1n.
M\u1ed9t ph\u1ea7n l\u1edbn nh\u1eefng rootkits \u0111\u01b0\u1ee3c b\u00e1n tr\u00ean m\u1ea1ng d\u01b0\u1edbi d\u1ea1ng m\u00e3 ngu\u1ed3n. \u0110a s\u1ed1 nh\u1eefng ch\u01b0\u01a1ng tr\u00ecnh spyware \u0111\u1ec1u s\u1eed d\u1ee5ng ph\u01b0\u01a1ng th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a Rootkit. Nh\u1eefng spyware n\u00e0y s\u1ebd ho\u1ea1t \u0111\u1ed9ng tr\u00ean m\u00e1y c\u1ee7a ng\u01b0\u1eddi s\u1eed d\u1ee5ng m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n. L\u1ee3i \u00edch cu\u1ed1i c\u00f9ng l\u00e0 ch\u00fang c\u00f3 th\u1ec3 ki\u1ebfm \u0111\u01b0\u1ee3c ti\u1ec1n nh\u1edd nh\u1eefng th\u00f4ng tin thu th\u1eadp \u0111\u01b0\u1ee3c tr\u00ean m\u00e1y ng\u01b0\u1eddi s\u1eed d\u1ee5ng.<\/p>\n\n\n

\n
\"cach-thuc-hoat-dong-cua-rootkit\"
C\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a Rootkit<\/figcaption><\/figure>\n<\/div>\n\n\n

B\u1eb1ng k\u1ef9 thu\u1eadt c\u1ee7a Rootkit, c\u00f3 r\u1ea5t nhi\u1ec1u trojan \u0111\u00e3 \u0111\u01b0\u1ee3c ph\u00e1t t\u00e1n. Nh\u1eefng trojan n\u00e0y bi\u1ebfn m\u00e1y b\u1ea1n th\u00e0nh m\u1ed9t b\u1ed9 m\u00e1y c\u00f3 th\u1ec3 \u0111i\u1ec1u khi\u1ec3n t\u1eeb xa v\u00e0 ng\u01b0\u1eddi \u0111i\u1ec1u khi\u1ec3n ch\u00fang c\u00f3 th\u1ec3 d\u00f9ng m\u00e1y b\u1ea1n \u0111\u1ec3 ph\u00e1t t\u00e1n Spam ho\u1eb7c l\u1ea1m d\u1ee5ng m\u00e1y b\u1ea1n \u0111\u1ec3 l\u00e0m nh\u1eefng chuy\u1ec7n c\u00f3 m\u1ee5c \u0111\u00edch x\u1ea5u.\u00a0<\/p>\n\n\n\n

Rootkit c\u00f3 t\u00e1c h\u1ea1i g\u00ec?<\/strong><\/h2>\n\n\n\n

B\u1ea1n c\u00f3 bi\u1ebft, m\u1ed9t s\u1ed1 th\u1ee9 trong PC c\u1ee7a b\u1ea1n b\u1ecb ch\u1eb7n \u0111\u1ec1u l\u00e0 do rootkit. \u0110i\u1ec1u n\u00e0y c\u00f3 ngh\u0129a l\u00e0 sau khi m\u1ed9t rootkit \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t, b\u1ea1n s\u1ebd kh\u00f4ng th\u1ec3 tin t\u01b0\u1edfng \u0111\u01b0\u1ee3c b\u1ea5t k\u1ef3 th\u00f4ng tin n\u00e0o m\u00e0 PC c\u1ee7a b\u1ea1n b\u00e1o c\u00e1o.<\/p>\n\n\n\n

V\u00ed d\u1ee5: n\u1ebfu b\u1ea1n y\u00eau c\u1ea7u PC c\u1ee7a m\u00ecnh li\u1ec7t k\u00ea t\u1ea5t c\u1ea3 c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh \u0111ang kh\u1edfi ch\u1ea1y, rootkit c\u00f3 th\u1ec3 l\u00e9n l\u00fat x\u00f3a b\u1ea5t k\u1ef3 ch\u01b0\u01a1ng tr\u00ecnh n\u00e0o m\u00e0 n\u00f3 kh\u00f4ng mu\u1ed1n cho b\u1ea1n bi\u1ebft.<\/p>\n\n\n\n

Ch\u1ee7 \u0111\u1ed9ng \u201ct\u00e0ng h\u00ecnh\u201d kh\u1ecfi c\u1eb7p m\u1eaft c\u1ee7a ng\u01b0\u1eddi d\u00f9ng, h\u1ec7 \u0111i\u1ec1u h\u00e0nh v\u00e0 c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh anti-virus\/anti-malware, rootkit l\u00e0 ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i r\u1ea5t kh\u00f3 b\u1ecb ph\u00e1t hi\u1ec7n.  Rootkit che gi\u1ea5u \u0111i t\u1ea5t c\u1ea3 m\u1ecdi th\u1ee9. Ch\u00fang \u1ea9n m\u00ecnh tr\u00ean m\u00e1y t\u00ednh c\u1ee7a b\u1ea1n v\u00e0 c\u0169ng \u1ea9n ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i tr\u00ean PC c\u1ee7a b\u1ea1n.<\/p>\n\n\n\n

Rootkit c\u00f3 nh\u1eefng d\u1ea1ng ph\u1ed5 bi\u1ebfn n\u00e0o?<\/strong><\/h2>\n\n\n\n

D\u1ef1a tr\u00ean s\u1ef1 duy tr\u00ec sau khi kh\u1edfi \u0111\u1ed9ng l\u1ea1i ho\u1eb7c ho\u1ea1t \u0111\u1ed9ng \u1edf ch\u1ebf \u0111\u1ed9 ng\u01b0\u1eddi d\u00f9ng (user mode) hay \u1edf ch\u1ebf \u0111\u1ed9 c\u1ea5p h\u1ec7 th\u1ed1ng (kernel mode), rootkit \u0111\u01b0\u1ee3c chia ra nhi\u1ec1u lo\u1ea1i kh\u00e1c nhau.<\/p>\n\n\n\n

Theo th\u1eddi gian t\u1ed3n t\u1ea1i: chia l\u00e0m hai lo\u1ea1i<\/strong><\/h3>\n\n\n\n

Rootkit b\u00e1m dai (Persistent Rootkits)<\/strong><\/h4>\n\n\n\n

Persistent root kit l\u00e0 m\u1ed9t lo\u1ea1i rootkit k\u1ebft h\u1ee3p v\u1edbi c\u00e1c malware kh\u00e1c ho\u1ea1t \u0111\u1ed9ng m\u1ed7i khi h\u1ec7 th\u1ed1ng kh\u1edfi \u0111\u1ed9ng. V\u1edbi \u0111\u1eb7c t\u00ednh malware ch\u1ee9a m\u00e3 ph\u00e1 ho\u1ea1i s\u1ebd \u0111\u01b0\u1ee3c th\u1ef1c thi t\u1ef1 \u0111\u1ed9ng m\u1ed7i khi h\u1ec7 th\u1ed1ng kh\u1edfi \u0111\u1ed9ng ho\u1eb7c khi ng\u01b0\u1eddi s\u1eed d\u1ee5ng \u0111\u0103ng nh\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng, ch\u00fang c\u1ea7n ph\u1ea3i l\u01b0u tr\u1eef c\u00e1c \u0111o\u1ea1n m\u00e3 th\u1ef1c thi ch\u01b0\u01a1ng tr\u00ecnh trong Registry, c\u00e1c t\u1eadp tin h\u1ec7 th\u1ed1ng v\u00e0 c\u00e1c ph\u01b0\u01a1ng ph\u00e1p cho ph\u00e9p \u00e2m th\u1ea7m ch\u1ea1y c\u00e1c \u0111o\u1ea1n m\u00e3 m\u00e0 ng\u01b0\u1eddi s\u1eed d\u1ee5ng kh\u00f4ng hay bi\u1ebft.<\/p>\n\n\n\n

Rootkit tr\u00ean b\u1ed9 nh\u1edb (Memory-Based Rootkits )<\/strong><\/h4>\n\n\n\n

B\u1ea3n ch\u1ea5t c\u1ee7a rootkit n\u00e0y l\u00e0 c\u00e1c malware kh\u00f4ng c\u00f3 nh\u1eefng \u0111o\u1ea1n m\u00e3 \u201cdai d\u1eb3ng\u201d \u2013 ch\u1ec9 l\u01b0u trong b\u1ed9 nh\u1edb.  Do \u0111\u00f3 lo\u1ea1i rootkit n\u00e0y kh\u00f4ng t\u1ed3n t\u1ea1i sau khi kh\u1edfi \u0111\u1ed9ng l\u1ea1i m\u00e1y.<\/p>\n\n\n\n

Theo m\u1ee9c \u0111\u1ed9 x\u00e2m nh\u1eadp h\u1ec7 th\u1ed1ng: chia l\u00e0m hai lo\u1ea1i<\/strong><\/h3>\n\n\n\n

Rootkit ch\u1ebf \u0111\u1ed9 ng\u01b0\u1eddi d\u00f9ng (User-mode Rootkits)<\/strong><\/h4>\n\n\n\n

Rootkit \u1edf ch\u1ebf \u0111\u1ed9 ng\u01b0\u1eddi d\u00f9ng s\u1eed d\u1ee5ng nhi\u1ec1u ph\u01b0\u01a1ng ph\u00e1p kh\u00e1c nhau \u0111\u1ec3 l\u1ea9n tr\u1ed1n kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n. N\u00f3 ho\u1ea1t \u0111\u1ed9ng \u1edf m\u1ee9c cao h\u01a1n trong c\u00e1c t\u1ea7ng b\u1ea3o m\u1eadt c\u1ee7a h\u1ec7 th\u1ed1ng m\u00e1y t\u00ednh, c\u00f9ng t\u1ea7ng v\u1edbi nh\u1eefng \u1ee9ng d\u1ee5ng b\u00ecnh th\u01b0\u1eddng kh\u00e1c m\u00e0 ch\u00fang ta hay s\u1eed d\u1ee5ng. Ch\u00fang c\u00f3 nhi\u1ec1u c\u00e1ch th\u1ee9c t\u1ea5n c\u00f4ng kh\u00e1c nhau v\u00e0 s\u1ebd thay \u0111\u1ed5i nh\u1eefng giao di\u1ec7n l\u1eadp tr\u00ecnh \u1ee9ng d\u1ee5ng (API). C\u1ee5 th\u1ec3 h\u01a1n, n\u00f3 s\u1ebd ch\u1ec9nh s\u1eeda m\u1ed9t h\u00e0m API sao cho khi m\u1ed9t \u1ee9ng d\u1ee5ng n\u00e0o \u0111\u00f3 g\u1ecdi h\u00e0m n\u00e0y, thay v\u00ec th\u1ef1c hi\u1ec7n t\u00ednh n\u0103ng v\u1ed1n c\u00f3, n\u00f3 s\u1ebd \u0111\u01b0\u1ee3c chuy\u1ec3n h\u01b0\u1edbng \u0111\u1ec3 th\u1ef1c thi m\u00e3 \u0111\u1ed9c trong rootkit.<\/p>\n\n\n\n

User-mode app c\u00f3 th\u1ec3 k\u1ec3 \u0111\u1ebfn nh\u01b0 nh\u1eefng \u1ee9ng d\u1ee5ng v\u0103n ph\u00f2ng, tr\u00ecnh duy\u1ec7t, game,\u2026<\/p>\n\n\n\n

Rootkit ch\u1ebf \u0111\u1ed9 nh\u00e2n (Kernel-mode Rootkits)<\/strong><\/h4>\n\n\n\n

Lo\u1ea1i n\u00e0y kh\u00f3 b\u1ecb ph\u00e1t hi\u1ec7n v\u00e0 c\u0169ng kh\u00f3 b\u1ecb di\u1ec7t v\u00ec n\u00f3 \u1ea9n sau b\u00ean trong h\u1ec7 \u0111i\u1ec1u h\u00e0nh. Khi b\u1ea1n v\u1eeba b\u1eadt m\u00e1y l\u00ean, nh\u1eefng con rootkit n\u00e0y s\u1ebd t\u1ea3i b\u1ea3n th\u00e2n n\u00f3 l\u00ean tr\u01b0\u1edbc c\u00e1c driver m\u00e1y t\u00ednh v\u00e0 t\u1ea5t nhi\u00ean l\u00e0 tr\u01b0\u1edbc lu\u00f4n c\u1ea3 nh\u1eefng bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt th\u00f4ng th\u01b0\u1eddng v\u1ed1n \u0111\u01b0\u1ee3c t\u00edch h\u1ee3p \u1edf t\u1ea7ng user-mode.<\/p>\n\n\n\n

\u0110\u1ec3 th\u1ef1c hi\u1ec7n \u0111\u01b0\u1ee3c m\u1ee5c \u0111\u00edch c\u1ee7a m\u00ecnh, kernel-mode rootkit s\u1ebd t\u00e1c \u0111\u1ed9ng v\u00e0o kernel, b\u1ed9 nh\u1edb v\u00e0 c\u00e1c th\u00e0nh ph\u1ea7n h\u1ec7 th\u1ed1ng kh\u00e1c.<\/p>\n\n\n

\n
\"cac-loai-rootkit-pho-bien\"
C\u00e1c lo\u1ea1i Rootkit ph\u1ed5 bi\u1ebfn<\/figcaption><\/figure>\n<\/div>\n\n\n

C\u00e1ch qu\u00e9t rootkit nhanh v\u00e0 hi\u1ec7u qu\u1ea3<\/strong><\/h2>\n\n\n\n

Gi\u1ed1ng nh\u01b0 b\u1ea5t k\u1ef3 lo\u1ea1i ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i n\u00e0o kh\u00e1c, c\u00e1ch t\u1ed1t nh\u1ea5t \u0111\u1ec3 tr\u00e1nh rootkit l\u00e0 ng\u0103n kh\u00f4ng cho n\u00f3 \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t ngay t\u1eeb \u0111\u1ea7u.<\/p>\n\n\n\n

Ng\u0103n ch\u1eb7n rootkit<\/strong><\/h3>\n\n\n\n