Rootkits, papers, security, rootkits

[ Pobierz całość w formacie PDF ]
ISA 564
SECURITY LAB
Rootkits: Attacks and Defense
Outline

 
Introduction

 
Rootkit Basics

 
Advanced Rootkit Techniques

 
Defense
What is a Rootkit?

 
“
A rootkit is a set of programs and code that allows
a permanent or consistent, undetectable presence
on a computer
”

 
Goals:

 
Hide malicious resources
(
e.g., processes, ﬁles, registry
keys, open ports, etc.
)

 
Provide hidden backdoor access
What a Rootkit Is & Isn’t

 
A rootkit does
NOT
compromise a host by itself

 
An exploit must be used to gain access to the host before a
rootkit can be deployed

 
The purpose of a rootkit is
NOT
to gain access to a
system, but to preserve existing access

 
Rootkits hide processes, ports, ﬁles, and other resources
from the OS and security programs
Brief History

 
Early rootkits targeted UNIX OSes

 
First “rootkit” appeared on SunOS in 1994

 
Replaced
login
,
ls
,
ps
,
netstat
, etc. to give an attacker hidden
access

 
“Kits” to attain and maintain “root” access to machines

 
Eventually moved towards other platforms and kernel

 
Windows popularity brought Windows rootkits
[ Pobierz całość w formacie PDF ]

Rootkits, papers, security, rootkits

Tematy