22.03.2013 Views

The Rootkit Primer - Below Gotham Labs

The Rootkit Primer - Below Gotham Labs

The Rootkit Primer - Below Gotham Labs

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Do We Need to Hide?<br />

Traditional rootkits tend to actively conceal things:<br />

TCP/IP Port<br />

File<br />

Registry Key<br />

Concealment is based on a trick<br />

Once trick is known, it loses its effectiveness<br />

Is there a better way, one that doesn’t rely on a trick?<br />

© <strong>Below</strong> <strong>Gotham</strong> <strong>Labs</strong>, 2009<br />

Process<br />

Driver<br />

Service<br />

27

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!