Definition
A bootkit is a type of malware designed to infect the boot process of a computer, typically targeting the Master Boot Record (MBR) or Volume Boot Record (VBR). Unlike traditional malware, bootkits load before the operating system, allowing them to gain deep control and hide their presence from security software. This early execution enables them to intercept system calls, modify kernel functions, and evade detection by antivirus programs. Bootkits are a significant threat because their persistent nature makes them extremely difficult to remove once established. For instance, a bootkit could be used to disable security controls or steal sensitive data by compromising the system at its most fundamental level. They are distinct from rootkits, which typically infect the running operating system rather than the boot sector. Understanding bootkits is crucial for cybersecurity professionals and is covered in certifications like CompTIA Security+ and CISSP.