Rating:
Author: Greg Hoglund
ISBN : B000OZ0N76
New from $38.39
Format: PDF
Download electronic versions of selected books Free Rootkits: Subverting the Windows Kernel [Kindle Edition] from with Mediafire Link Download Link
Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them. Rootkit.com's Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology--learn how attackers can get in and stay in for years, without detection.
Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. They teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers.
After reading this book, readers will be able to
- Understand the role of rootkits in remote command/control and software eavesdropping
- Build kernel rootkits that can make processes, files, and directories invisible
- Master key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objects
- Work with layered drivers to implement keyboard sniffers and file filters
- Detect rootkits and build host-based intrusion prevention software that resists rootkit attacks
Direct download links available for Free Rootkits: Subverting the Windows Kernel [Kindle Edition]
- File Size: 1501 KB
- Print Length: 352 pages
- Simultaneous Device Usage: Up to 5 simultaneous devices, per publisher limits
- Publisher: Addison-Wesley Professional; 1 edition (July 22, 2005)
- Sold by: Amazon Digital Services, Inc.
- Language: English
- ASIN: B000OZ0N76
- Text-to-Speech: Enabled
X-Ray:
- Lending: Not Enabled
- Amazon Best Sellers Rank: #547,112 Paid in Kindle Store (See Top 100 Paid in Kindle Store)
Free Rootkits: Subverting the Windows Kernel
Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.
The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.
The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).
By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided.
A brilliantly written book on everything one would want to know about Rootkits in the Microsoft Windows world. Greg is the industry expert who shares his knowledge through many examples and illustrations that would help almost any level of reader grasp a better understanding of Rootkits.
The authors start with `Understanding Attackers' Motives' and what Rootkits are and aren't, and work they way through Rootkit designs, hardware interaction, hooking into kernel and user, `Direct Kernel Object Manipulation', `Hardware Manipulation', covert techniques and ways to identify Rootkits on your systems.
The authors in-depth knowledge of Rootkits is clearly demonstrated early on when they walk through creating a loadable module, or device/kernel driver. Through this process, they take the time to explain each line, how it manipulates the system, and how it could be used maliciously.
Throughout most of the book, the authors give very detailed examples, lines of code and other evidence supporting the theories and processes presented here. The book is written in a way that they leave little to the imagination and provide hard evidence to support the thought.
The book ends with Rootkit detection, which is the only way to end a book on malicious software. Now that they have taught one how to manipulate and hijack system, here is what one can do to protect the systems they are responsible for, and identify these malicious codes on ones systems. They describe scanning memory, identifying different types of hooks, and again provide some code for one to use to help with these processes.
-
Download Link 2