Rootkits: Subverting the Windows Kernel
Read an excerpt:
Chapter 1: Leave No Trace
Excerpt provided courtesy of Addison-Wesley Professional. Copyright © Addison-Wesley. Written permission from the publisher is required for any use of this material.
|
Be the First to Write a Review and tell the world about this title!People who purchase this book frequently purchase: - Reversing: Secrets of Reverse Engineering; Eldad Eilam, $24.95, 38% Off!
- The Art of Computer Virus Research and Defense; Peter Szor, $34.95, 36% Off!
- Microsoft Windows Internals, 4th Edition: Microsoft Windows Server 2003, Windows XP, and Windows 2000; Mark E. Russinovich, et al, $37.50, 37% Off!
- File System Forensic Analysis; Brian Carrier, $37.50, 37% Off!
Books on similar topics, in best-seller order:Books from the same publisher, in best-seller order:
Rootkit.com founder reveals never-before-told offensive aspects of rootkit technology.
Preface
A rootkit is the set of programs and code that allow a permanent and undetectable
presence on a computer.
Historical Background
We became interested in rootkits because of our professional work in computer
security, but the pursuit of the subject quickly expanded into a personal mission
(a.k.a., late nights and weekends). This led Hoglund to found rootkit.com, a
forum devoted to reverse engineering and rootkit development. Both of us are
deeply involved with rootkit.com. Butler first contacted Hoglund online through
this Web site because Butler had a new and powerful rootkit called 'FU' that
needed testing. Butler sent Hoglund some source code and a pre-compiled binary.
However, by accident, he did not send Hoglund the source code to the kernel
driver. To Butler's amazement, Hoglund just loaded the pre-compiled rootkit
on his workstation without question, and reported back that 'FU' seemed to be
working fine! Our trust in one another has only grown since then.
Both of us have long been driven by an almost perverse need to reverse-engineer
the Windows kernel. It's like when someone says we can't do something--then
we accomplish it. It is very satisfying learning how so-called 'computer security'
products work and finding ways around them. This inevitably leads to better
protection mechanisms. Just because a product claims to provide some level of
protection does not necessarily mean that it does. By playing the part of an
attacker, we are always at an advantage. As the attacker we must think of only
one thing that a defender didn't think of. Yet, as defenders we must think of
every possible thing an attacker might do. The numbers work in the attacker's
favor.
We teamed up a few years ago to offer the training class 'Offensive Aspects
of Rootkit Technology.' This training started as a single day of material that
since has grown into hundreds of pages of notes and example code. The material
for the class is what eventually became the foundation for this book. Now, we
offer the rootkit training class several times a year at the Black Hat security
conference, and also privately.
After training for a while, we decided to deepen our relationship, and we now
work together at HBGary, Inc. At HBGary, we tackle very complex rootkit problems
on a daily basis. In this book, we use our experience to cover the threats that
face Windows users today and only appear to be increasing in the future.
Introduction
Target Audience
This book is intended for those who are interested in computer security and
want a truer perspective concerning security threats. A lot has been written
on how intruders gain access to computer systems but little has been said regarding
what can happen once an intruder gains that initial access. Like the title implies,
this book will cover what an intruder can do to cover her presence on a compromised
machine.
We believe that most software vendors, including Microsoft, do not take rootkits
seriously. That is why we are publishing this book. The material in this book
is not groundbreaking for someone who has worked with rootkits or operating
systems for years--but for most people this book should prove that rootkits
are a serious threat. It should prove that your virus scanner or desktop firewall
is never good enough. It should prove that a rootkit can get into your computer
and stay there for years, and you will never know about it.
To best convey rootkit information we wrote most of this book from an attacker's
perspective; however, we end the book on a defensive posture. As you begin to
learn your attackers' goals and techniques, you will begin to learn your own
system's weaknesses and how to mitigate its shortcomings. Reading this book
will help you improve the security of your system or help you make informed
decisions when it comes to purchasing security software.
Prerequisites
As all of the code samples are written in C, you will gain more insight if
you already understand basic C concepts--the most important one being pointers.
If you have no programming knowledge, you should still be able to follow along
and understand the threats without needing to understand the particular implementation
details. Some areas of the book draw on principles from the Windows device driver
architecture, but experience writing device drivers is not required. We will
walk you through writing your first Windows device driver and build from there.
Scope
This book covers Windows rootkits, although most of the concepts apply to other
operating systems as well, such as LINUX. We focus on kernel rootkits because
these are the most difficult to detect. Many public rootkits for Windows are
userland rootkits because these are the easiest to implement since they do add
the complexity of understanding how the undocumented kernel works. This book
is not about specific real-world rootkits--but instead teaches the generic approaches
used by all rootkits. In each chapter, we introduce the basic technique, explain
its goals, and show how it's implemented using code examples. Armed with this
information, you should be able to expand the examples in a million different
ways to perform a variety of tasks. When working in the kernel, you are really
limited only by your imagination.
You can download most of the code in this book from rootkit.com. Throughout
the book, we will reference the particular URL for an individual example. Other
rootkit authors also publish research at rootkit.com, which you may find useful
to keep up with the latest discoveries.
Table of Contents
Preface.
1. Introduction.
Understanding Attackers' Motives
What Is a Rootkit?
Why do Rootkits Exist?
How Long Have Rootkits Been Around?
How do Rootkits Work?
What a Rootkit Is Not
Rootkits and Software Exploits
Offensive Rootkit Technologies
Conclusion
2. Subverting the Kernel.
Important Kernel Components
Rootkit Design
Introducing Code into the Kernel
Building the Windows Device Driver
Loading and Unloading the Driver
Logging the Debug Statements
Fusion Rootkits: Bridging User and Kernel Modes
Loading the Rootkit
Decompressing the .sys File from a Resource
Surviving Reboot
Conclusion
3. The Hardware Connection.
Ring Zero
Tables, Tables, and more Tables
Memory Pages
The Memory Descriptor Tables
The Interrupt Descriptor Table
The System Service Descriptor Table
The Control Registers
Multi-processor systems
Conclusion
4. Hooking.
Userland Hooks
Kernel Hooks
Conclusion
5. Runtime Patching.
Detour Patching
Jump Templates
Variations on the Method
Conclusion
6. Layered Drivers.
A Keyboard Sniffer
Walkthrough of KLOG
File Filter Drivers
Conclusion
7. Direct Kernel Object Manipulation.
DKOM Benefits and Drawbacks
Determining the Version of the Operating System
Communicating with the Device Driver from Userland
Hiding with DKOM
Token Privilege and Group Elevation with DKOM
Conclusion
8. Hardware Manipulation.
Why Hardware?
Modifying the Firmware
Accessing the Hardware
Example: Accessing the Keyboard Controller
How Low Can You Go?: Microcode Update
Conclusion
9. Covert Channels.
Remote Command, Control, and Exfiltration of Data
Disguised TCP/IP Protocols
Kernel TCP/IP Support for Your Rootkit Using TDI
Raw Network Manipulation
Kernel TCP/IP Support for Your Rootkit Using NDIS
Host Emulation
Conclusion
10. Rootkit Detection.
Detecting Presence
Detecting Behavior
Conclusion
Index.
About the Authors
Greg Hoglund has been a pioneer in the area of software security.
After writing one of the first network vulnerability scanners (installed in
over half of all Fortune 500 companies), he created and documented the first
Windows NT-based rootkit, founding www.rootkit.com in the process. Greg went
on to co-found Cenzic, Inc. (formerly known as ClickToSecure, Inc.) through
which he orchestrated numerous innovations in the area of software fault injection.
Greg is a frequent speaker at Black Hat, RSA and other security conferences.
James Butler brings world-class talent for kernel programming
and rootkit development. He has extensive experience in host based intrusion
detection systems. He is the developer of VICE, a rootkit detection and forensics
system. Jamies previous positions include Senior Security Software Engineer
at Enterasys and Computer Scientist at National Security Agency. He is a frequent
trainer and speaker at Black Hat security conferences. He holds a Masters of
Computer Science from University of Maryland and a Bachelor of Science, Computer
Science from James Madison University. He has published articles in IEEE, Information
Management and Computer Security.
|
