Rootkits: Subverting the Windows Kernel

Paperback (Print)
Used and New from Other Sellers
Used and New from Other Sellers
from $3.95
Usually ships in 1-2 business days
(Save 93%)
Other sellers (Paperback)
  • All (15) from $3.95   
  • New (8) from $36.44   
  • Used (7) from $3.95   

Overview

"Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them. Rootkit.com's Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology - learn how attackers can get in and stay in for years, without detection." Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. Using extensive downloadable examples, they teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers.
Read More Show Less

Editorial Reviews

From Barnes & Noble
The Barnes & Noble Review
Install a rootkit on someone’s system, and you own it. Not just now: indefinitely, because rootkits are virtually undetectable. Their power and stealthiness may make them the most dangerous form of malware ever created. You’d think you’d have heard more about them, but very few people really understand rootkit technology. To become one of them, read Rootkits: Subverting the Windows Kernel.

For years, the best way to learn about rootkits has been to take Greg Hoglund and James Butler’s course at Black Hat, the legendary annual hacker event. Now, for those who can’t make it to Vegas, Hoglund and Butler have organized their unique knowledge into this book. Notwithstanding its title, its principles apply to any operating system, including Linux and Unix. The authors focus on kernel rootkits, the hardest kind to detect. While it’s written primarily from an attacker’s perspective, it’ll be valuable to attackers, defenders, and researchers alike.

The authors first explain what rootkits are (and aren’t), and how they typically function. You’ll walk through the basic steps involved in writing a Windows rootkit; then understand the hardware mechanisms that work behind the scenes to enforce security and memory access: mechanisms attackers must evade or corrupt.

You’ll master both approaches to maintaining uninterrupted, hidden access to a computer: altering its operating system’s execution path, or directly manipulating kernel objects to attack stored information about processes, drivers, or network connections. Along the way, Hoglund and Butler cover hooking, runtime patching, layered drivers, covert channels, and much more. They conclude with today’s best countermeasures: systematic ways to search for hooks, detect suspicious behavior, and reveal hidden files, registry keys, or processes. Bill Camarda, from the September 2005 Read Only

Slashdot.org
Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult.... If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.
Read More Show Less

Product Details

  • ISBN-13: 9780321294319
  • Publisher: Addison-Wesley
  • Publication date: 7/28/2005
  • Series: Addison-Wesley Software Security Series
  • Pages: 352
  • Sales rank: 240,332
  • Product dimensions: 6.96 (w) x 9.26 (h) x 0.58 (d)

Meet the Author

Greg Hoglund has been a pioneer in the area of software security. He is CEO of HBGary, Inc., a leading provider of software security verification services. After writing one of the first network vulnerability scanners (installed in over half of all Fortune 500 companies), he created and documented the first Windows NT-based rootkit, founding rootkit.com in the process. Greg is a frequent speaker at Black Hat, RSA, and other security conferences.

James Butler, Director of Engineering at HBGary, has a world-class talent for kernel programming and rootkit development and extensive experience in host-based intrusion-detection systems. He is the developer of VICE, a rootkit detection and forensics system. Jamie's previous positions include Senior Security Software Engineer at Enterasys and Computer Scientist at the National Security Agency. He is a frequent trainer and speaker at Black Hat security conferences. He holds a masters of computer science from the University of Maryland, Baltimore County. He has published articles in the IEEE Information Assurance Workshop, Phrack, USENIX ;login:, and Information Management and Computer Security.

Read More Show Less

Table of Contents

1 Leave no trace 1
2 Subverting the kernel 21
3 The hardware connection 49
4 The age-old art of hooking 71
5 Runtime patching 113
6 Layered drivers 135
7 Direct kernel object manipulation 169
8 Hardware manipulation 213
9 Covert channels 239
10 Rootkit detection 295
Read More Show Less

Preface

A rootkit is a set of programs and code that allows a permanent and undetectable presence on a computer.

Historical Background

We became interested in rootkits because of our professional work in computer security, but the pursuit of the subject quickly expanded into a personal mission (also known as late nights and weekends). This led Hoglund to found rootkit.com, a forum devoted to reverse engineering and rootkit development. Both of us are deeply involved with rootkit.com. Butler first contacted Hoglund online through this Web site because Butler had a new and powerful rootkit called FU that needed testing, 1 Butler sent Hoglund some source code and a pre-compiled binary. However, by accident, he did not send Hoglund the source code to the kernel driver. To Butler's amazement, Hoglund just loaded the pre-compiled rootkit onto his workstation without question, and reported back that FU seemed to be working fine! Our trust in one another has only grown since then. 2

Both of us have long been driven by an almost perverse need to reverse-engineer the Windows kernel. It's like when someone says we can't do something--then we accomplish it. It is very satisfying learning how so-called computer security products work and finding ways around them. This inevitably leads to better protection mechanisms.

The fact that a product claims to provide some level of protection does not necessarily mean it actually does. By playing the part of an attacker, we are always at an advantage. As the attacker we must think of only one thing that a defender didn't consider. Defenders, on the other hand, must think of every possible thing an attacker might do. The numbers work in the attacker's favor.

We teamed up a few years ago to offer the training class "Offensive Aspects of Rootkit Technology." This training started as a single day of material that since has grown to include hundreds of pages of notes and example code. The material for the class eventually became the foundation for this book. We now offer the rootkit training class several times a year at the Black Hat security conference, and also privately.

After training for awhile, we decided to deepen our relationship, and we now work together at HBGary, Inc. At HBGary, we tackle very complex rootkit problems on a daily basis. In this book, we use our experience to cover the threats that face Windows users today, and likely will only increase in the future.

Target Audience

This book is intended for those who are interested in computer security and want a truer perspective concerning security threats. A lot has been written on how intruders gain access to computer systems, but little has been said regarding what can happen once an intruder gains that initial access. Like the title implies, this book will cover what an intruder can do to cover her presence on a compromised machine.

We believe that most software vendors, including Microsoft, do not take rootkits seriously. That is why we are publishing this book. The material in this book is not groundbreaking for someone who has worked with rootkits or operating systems for years--but for most people this book should prove that rootkits are a serious threat. It should prove that your virus scanner or desktop firewall is never good enough. It should prove that a rootkit can get into your computer and stay there for years without you ever knowing about it.

To best convey rootkit information, we wrote most of this book from an attacker's perspective; however, we end the book on a defensive posture. As you begin to learn your attackers' goals and techniques, you will begin to learn your own system's weaknesses and how to mitigate its shortcomings. Reading this book will help you improve the security of your system or help you make informed decisions when it comes to purchasing security software.

Prerequisites

As all of the code samples are written in C, you will gain more insight if you already understand basic C concepts--the most important one being pointers. If you have no programming knowledge, you should still be able to follow along and understand the threats without needing to understand the particular implementation details. Some areas of the book draw on principles from the Windows device driver architecture, but experience writing device drivers is not required. We will walk you through writing your first Windows device driver and build from there.

Scope

This book covers Windows rootkits, although most of the concepts apply to other operating systems as well, such as LINUX. We focus on kernel rootkits because these are the most difficult to detect. Many public rootkits for Windows are userland rootkits 3 because these are the easiest to implement, since they do not involve the added complexity of understanding how the undocumented kernel works.

This book is not about specific real-world rootkits. Rather, it teaches the generic approaches used by all rootkits. In each chapter, we introduce a basic technique, explain its purposes, and show how it's implemented using code examples. Armed with this information, you should be able to expand the examples in a million different ways to perform a variety of tasks. When working in the kernel, you are really limited only by your imagination.

You can download most of the code in this book from rootkit.com. Throughout the book, we will reference the particular URL for each individual example. Other rootkit authors also publish research at rootkit.com that you may find useful for keeping up with the latest discoveries.

1. Butler was not interested in rootkits for malicious purposes. He was instead fascinated with the power of kernel modifications. This led Butler to develop one of the first rootkit-detection programs, VICE.

2. Hoglund still wonders, from time to time, whether that original version of FU is still running on his workstation.

3. Userland rootkits are rootkits that do not employ kernel-level modifications, but instead rely only upon user-program modifications.

0321294319P07072005

Read More Show Less

Introduction

A rootkit is the set of programs and code that allow a permanent and undetectable presence on a computer.

Historical Background

We became interested in rootkits because of our professional work in computer security, but the pursuit of the subject quickly expanded into a personal mission (a.k.a., late nights and weekends). This led Hoglund to found rootkit.com, a forum devoted to reverse engineering and rootkit development. Both of us are deeply involved with rootkit.com. Butler first contacted Hoglund online through this Web site because Butler had a new and powerful rootkit called 'FU' that needed testing. Butler sent Hoglund some source code and a pre-compiled binary. However, by accident, he did not send Hoglund the source code to the kernel driver. To Butler's amazement, Hoglund just loaded the pre-compiled rootkit on his workstation without question, and reported back that 'FU' seemed to be working fine! Our trust in one another has only grown since then.

Both of us have long been driven by an almost perverse need to reverse-engineer the Windows kernel. It's like when someone says we can't do something--then we accomplish it. It is very satisfying learning how so-called 'computer security' products work and finding ways around them. This inevitably leads to better protection mechanisms. Just because a product claims to provide some level of protection does not necessarily mean that it does. By playing the part of an attacker, we are always at an advantage. As the attacker we must think of only one thing that a defender didn't think of. Yet, as defenders we must think of every possible thing an attacker might do. The numbers work in the attacker'sfavor.

We teamed up a few years ago to offer the training class 'Offensive Aspects of Rootkit Technology.' This training started as a single day of material that since has grown into hundreds of pages of notes and example code. The material for the class is what eventually became the foundation for this book. Now, we offer the rootkit training class several times a year at the Black Hat security conference, and also privately.

After training for a while, we decided to deepen our relationship, and we now work together at HBGary, Inc. At HBGary, we tackle very complex rootkit problems on a daily basis. In this book, we use our experience to cover the threats that face Windows users today and only appear to be increasing in the future.

Introduction

Target Audience

This book is intended for those who are interested in computer security and want a truer perspective concerning security threats. A lot has been written on how intruders gain access to computer systems but little has been said regarding what can happen once an intruder gains that initial access. Like the title implies, this book will cover what an intruder can do to cover her presence on a compromised machine.

We believe that most software vendors, including Microsoft, do not take rootkits seriously. That is why we are publishing this book. The material in this book is not groundbreaking for someone who has worked with rootkits or operating systems for years--but for most people this book should prove that rootkits are a serious threat. It should prove that your virus scanner or desktop firewall is never good enough. It should prove that a rootkit can get into your computer and stay there for years, and you will never know about it.

To best convey rootkit information we wrote most of this book from an attacker's perspective; however, we end the book on a defensive posture. As you begin to learn your attackers' goals and techniques, you will begin to learn your own system's weaknesses and how to mitigate its shortcomings. Reading this book will help you improve the security of your system or help you make informed decisions when it comes to purchasing security software.

Prerequisites

As all of the code samples are written in C, you will gain more insight if you already understand basic C concepts--the most important one being pointers. If you have no programming knowledge, you should still be able to follow along and understand the threats without needing to understand the particular implementation details. Some areas of the book draw on principles from the Windows device driver architecture, but experience writing device drivers is not required. We will walk you through writing your first Windows device driver and build from there.

Scope

This book covers Windows rootkits, although most of the concepts apply to other operating systems as well, such as LINUX. We focus on kernel rootkits because these are the most difficult to detect. Many public rootkits for Windows are userland rootkits because these are the easiest to implement since they do add the complexity of understanding how the undocumented kernel works. This book is not about specific real-world rootkits--but instead teaches the generic approaches used by all rootkits. In each chapter, we introduce the basic technique, explain its goals, and show how it's implemented using code examples. Armed with this information, you should be able to expand the examples in a million different ways to perform a variety of tasks. When working in the kernel, you are really limited only by your imagination.

You can download most of the code in this book from rootkit.com. Throughout the book, we will reference the particular URL for an individual example. Other rootkit authors also publish research at rootkit.com, which you may find useful to keep up with the latest discoveries.

0321294319P04292005

Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star

(0)

4 Star

(0)

3 Star

(0)

2 Star

(0)

1 Star

(0)

Your Rating:

Your Name: Create a Pen Name or

Barnes & Noble.com Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & Noble.com that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & Noble.com does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at BN.com or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation

Reminder:

  • - By submitting a review, you grant to Barnes & Noble.com and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Noble.com Terms of Use.
  • - Barnes & Noble.com reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & Noble.com also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on BN.com. It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

 
Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously
Sort by: Showing all of 2 Customer Reviews
  • Anonymous

    Posted August 26, 2005

    um, yeah

    I just finished reading the first 21 or so pages from this book entitled 'Microsoft Spin Doctors at Work' .... I mean Rootkits:Subverting the Windows Kernel. I stopped reading after an attempt was made to convince the reader that it is ok for a software vendor to take 60 days or more to patch a security issue and that the best way to handle a security issue is to make sure no one knows about it. This book is a crock in my opinion. Wish I could get my 35 bucks back.

    Was this review helpful? Yes  No   Report this review
  • Anonymous

    Posted September 3, 2005

    who exactly will use this book?

    It is rare to see a book as detailed as this on infiltrating a Microsoft machine. Hoglund and Butler give a serious, hard core technical account of several ways to subvert the operating system by the successful installation and running of a rootkit. A slight irony here. The 'root' in rootkit refers to the super user's account name on a unix machine. But the market reality is that Microsoft machines dominate the desktop. A key appeal of the book is the amount of example code that helps you, the programmer, understand how a rootkit works. Plus, the authors also run rootkit.com, from which you can download these and other example codes. While the book certainly gives good high level descriptions of rootkit strategies, the examples make these flesh. To some of you, it will be saddening to see that certain sections of the book omit those examples. Possibly the authors wanted to veer on the side of caution on those topics. There does seem to be a sligh

    Was this review helpful? Yes  No   Report this review
Sort by: Showing all of 2 Customer Reviews

If you find inappropriate content, please report it to Barnes & Noble
Why is this product inappropriate?
Comments (optional)