In Mr. Robot, Season 1, Episode 1, Elliott stopped a DDoS attack, but how exactly did he do it?

If I understand well, he notices that everything was being infected, all the servers, so he goes​ to some "main" server, I guess. Then he cuts the connection between this main server and all the rest that was infected. But I'm not sure about my understanding.

Can someone explain what was going on at this part of the show?

1 Answer 1


The servers were not just being DDoSed, there was a rootkit installed on the network, which was part of the server startup sequence, causing them to crash over and over every time Elliot or Lloyd restarted them. Elliot explains they need to take the servers down and wipe/reinstall them in order to clear out the rootkits.

Gideon (Allsafe owner) takes Elliot with him to the server farm where the machines are physically hosted. While they are en route, the servers are being wiped/restored.

Elliot notices that one of the infected servers was missed and is in the process of being brought back up - if this happens, it will reinfect the network with the rootkit and undo all the progress in stopping the hack so far, so he redirects the connections to that server's backup server instead, leaving the infected one offline. This gets the network back up and running in a clean state.

He then investigates the infected machine and locates the infection/malware. He is about to delete it and then decides not to, instead changing the file's permissions so that the only user who can access the file is his user id.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .