Xcon2005_Profiling_Malware_and_Rootkits_from_Ke..

More documents

Recommendations

Info

Rootkit DetectionProblems with Host IPSMany weaknesses outlined in a Phrack 62 (Butler)API hooks are easy to evadeMost HIPS cover only those that are likely to beused by an exploitHard to cover all ways a rootkit can be introduced:Crazylord evaded a rootkit detector by using asymbolic link \Device\PhysicalMemoryDefenseless against use of new kernel privilegeescalation vulnerabilities
Rootkit DetectionExecution Path Analysis (EPA)Discussed at BlackHat Las Vegas 2003 by JoannaRutkowskiAn old idea now applied specifically to rootkitsUses instruction trapping to profile system callsGoes through a learning period when the systemis known to be cleanRemembers the instruction counts or code pathsof the system callsDetects rootkit when the execution path of a systemcall differs
Page 2: AgendaBasics about RootkitsCurrent
Page 5 and 6: Rootkit DetectionAt the beginning o
Page 7 and 8: Rootkit Detection Anti-VirusVery ef
Page 9: Rootkit Detection Host IPSTwo layer
Page 13 and 14: Rootkit Detection DifferentialQuery
Page 15 and 16: Rootkit Technologies IntroductionUs
Page 17 and 18: Rootkit TechnologiesGetting into Ke
Page 19 and 20: Rootkit TechnologiesGetting into Ke
Page 21 and 22: Better Method…IntroductionCan be
Page 23 and 24: Better Method…Windows Executive O
Page 25 and 26: Better Method…ExampleDuring syste
Page 27 and 28: Better Method…In the callback, we
Page 29 and 30: Better Method…How ToIf we want to
Page 31 and 32: Detecting Driver LoadingCreating se
Page 33 and 34: Detecting Dispatch HooksEnumerate D
Page 35 and 36: Removing a Rootkit…Still experime
Page 37 and 38: Self-Preservation: Step 1Prevent a
Page 39 and 40: Self-Preservation: Step 3Ensure no
Page 41 and 42: SummaryPresented a method of observ
Page 43 and 44: STKIT- Shok Toolkit JRemember this

Xcon2005_Profiling_Malware_and_Rootkits_from_Ke..

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?