Loading ...
Sorry, an error occurred while loading the content.

REVIEW: "Rootkits", Greg Hoglund/James Butler

Expand Messages
  • Rob, grandpa of Ryan, Trevor, Devon & Ha
    BKROOTKT.RVW 20051023 Rootkits , Greg Hoglund/James Butler, 2006, 0-321-29431-9, U$44.99/C$62.99 %A Greg Hoglund %A James Butler %C P.O. Box 520, 26
    Message 1 of 1 , Jan 9, 2006
    View Source
    • 0 Attachment
      BKROOTKT.RVW 20051023

      "Rootkits", Greg Hoglund/James Butler, 2006, 0-321-29431-9,
      %A Greg Hoglund
      %A James Butler
      %C P.O. Box 520, 26 Prince Andrew Place, Don Mills, Ontario M3C 2T8
      %D 2006
      %G 0-321-29431-9
      %I Addison-Wesley Publishing Co.
      %O U$44.99/C$62.99 416-447-5101 fax: 416-443-0948 bkexpress@...
      %O http://www.amazon.com/exec/obidos/ASIN/0321294319/robsladesinterne
      %O http://www.amazon.ca/exec/obidos/ASIN/0321294319/robsladesin03-20
      %O Audience s+ Tech 3 Writing 2 (see revfaq.htm for explanation)
      %P 324 p.
      %T "Rootkits: Subverting the Windows Kernel"

      The preface (and therefore the book) begins with a definition of a
      rootkit. The authors proceed to outline their initial interest in the
      phenomenon, and any security professional who understands the
      centrality of system internals can begin to see the importance of the

      Chapter one addresses a major selling point (in the blackhat mindset)
      for rootkits: the evasion of detection. Concentrating on this aspect,
      the material outlines what a rootkit is, and is not, noting also that
      the programs need not be limited to illegal activities but do have
      legitimate uses. Subversion of the core of the operating system is
      examined in chapter two, although this is limited to the creation of
      device drivers. (This chapter again raises the issue of whether a
      book investigating the breaking of a system can provide valuable
      advice when it comes to protecting computers. While some works do;
      Hoglund, along with Gary McGraw, having created an example in
      "Exploiting Software" [cf. BKEXPLSW.RVW]; this particular material
      concentrates on items of interest in the process of producing
      rootkits. The limited sections dealing with more theoretical
      considerations would be those of greater interest to the security
      community.) Chapter three explores some hardware related items,
      although there are others that could be perused, and most of those
      surveyed may be initiated in hardware, but operate primarily in the
      software realm.

      Hooking of interrupts and functions is covered in chapter four, at
      both a kernel and user level. Chapter five reviews various means of
      directly patching software. (Much of this material should be familiar
      for those who have studied operations of older viruses.) The
      interception techniques addressed in chapter four are extended, in
      chapter six, to include adding new "layers" to existing device
      drivers. The operating system kernel uses data and other resources in
      order to perform properly, and chapter seven shows that manipulating
      these objects can modify the actions of the machine. Although
      nominally about hardware, chapter eight really concentrates on the
      patching of firmware. Chapter nine examines covert channels, but the
      explanation is quite poor, and most of the space is dedicated to
      listings of program code. Rootkit detection is discussed in chapter
      ten. It is interesting to note that analogies of antiviral change
      detection and activity monitoring are mentioned, but there is no
      consideration of signature scanning.

      "Rootkits" does raise a number of interesting topics, and much of the
      material could be of use to those charged with protecting systems.
      However, the content is not as valuable as that presented in
      "Exploiting Software." There is, of course, much that will be of
      assistance for those writing legitimate rootkits, but this would be a
      fairly limited audience.

      copyright Robert M. Slade, 2005 BKROOTKT.RVW 20051023

      ====================== (quote inserted randomly by Pegasus Mailer)
      rslade@... slade@... rslade@...
      That was Zen. This is Tao.
      http://victoria.tc.ca/techrev or http://sun.soci.niu.edu/~rslade
    Your message has been successfully submitted and would be delivered to recipients shortly.