Free PDF Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund
When someone involves you to visit the collection and obtain some books to check out, exactly what's your response? In some cases, that's not the appropriate time to visit it. Yeah, careless is the big factor of why lots of people decide to go to the collection. You could likewise have no adequate time to select. Currently, we present for you schedule soft file or on-line book to review. Without going to the library, without spending time for mosting likely to the book shops, this type of book is served by on-line with net link in the beginning.
Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund
Free PDF Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund
Don't you assume that checking out books will give you more benefits? For all sessions and also kinds of books, this is taken into consideration as one way that will certainly lead you to get finest. Each publication will certainly have different statement and also different diction. Is that so? What concerning guide qualified Rootkits: Subverting The Windows Kernel: Subverting The Windows Kernel, By Greg Hoglund Have you read about this publication? Begin; don't be so careless to know more about a book.
Reading will not give you many points. Yet, reviewing will certainly offer exactly what you require. Every book has specific topic and also lesson to take. It will certainly make everyone desire to pick exactly what publication they will review. It makes the lesson to take will truly connect to how the individual needs. In this case, the visibility of this site will really aid visitors to locate several books. So, really, there is not just the Rootkits: Subverting The Windows Kernel: Subverting The Windows Kernel, By Greg Hoglund, there are still great deals of type of the books to collect.
Correct feels, correct facts, and also appropriate topics may end up being the factors of why you read a book. However, to make you feel so completely satisfied, you can take Rootkits: Subverting The Windows Kernel: Subverting The Windows Kernel, By Greg Hoglund as one of the sources. It is actually matched to be the reading book for a person like you, that really require sources about the topic. The subject is actually booming currently as well as obtaining the most up to date publication could aid you locate the latest answer and facts.
When his is the moment for you to always make take care of the feature of guide, you can make deal that the book is actually suggested for you to get the very best concept. This is not just best suggestions to obtain the life but additionally to undertake the life. The lifestyle is in some cases conformed to the case of excellences, but it will be such thing to do. And also currently, guide is once again advised right here to check out.
From the Back Cover
"It's imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits.""--Mark Russinovich, editor, " Windows IT Pro / Windows & .NET Magazine"This material is not only up-to-date, it defines up-to-date. It is truly cutting-edge. As the only book on the subject, "Rootkits" will be of interest to any Windows security researcher or security programmer. It's detailed, well researched and the technical information is excellent. The level of technical detail, research, and time invested in developing relevant examples is impressive. In one word: Outstanding.""--Tony Bautts, Security Consultant; CEO, Xtivix, Inc.""This book is an essential read for anyone responsible for Windows security. Security professionals, Windows system administrators, and programmers in general will want to understand the techniques used by rootkit authors. At a time when many IT and security professionals are still worrying about the latest e-mail virus or how to get all of this month's security patches installed, Mr. Hoglund and Mr. Butler open your eyes to some of the most stealthy and significant threats to the Windows operating system. Only by understanding these offensive techniques can you properly defend the networks and systems for which you are responsible.""--Jennifer Kolde, Security Consultant, Author, and Instructor""What's worse than being owned? Not knowing it. Find out what it means to be owned by reading Hoglund and Butler's first-of-a-kind book on rootkits. At the apex the malicious hacker toolset--which includes decompilers, disassemblers, fault-injection engines, kernel debuggers, payload collections, coverage tools, and flow analysis tools--is the rootkit. Beginning where Exploiting Software left off, this book shows how attackers hide in plain sight. "Rootkits are extremely powerful and are the next wave of attack technology. Like other types of malicious code, rootkits thrive on stealthiness. They hide away from standard system observers, employing hooks, trampolines, and patches to get their work done. Sophisticated rootkits run in such a way that other programs that usually monitor machine behavior can't easily detect them. A rootkit thus provides insider access only to people who know that it is running and available to accept commands. Kernel rootkits can hide files and running processes to provide a backdoor into the target machine. "Understanding the ultimate attacker's tool provides an important motivator for those of us trying to defend systems. No authors are better suited to give you a detailed hands-on understanding of rootkits than Hoglund and Butler. Better to own this book than to be owned.""--Gary McGraw, Ph.D., CTO, Cigital, coauthor of" Exploiting Software "(2004) and" Building Secure Software "(2002), both from Addison-Wesley""Greg and Jamie are unquestionably the go-to experts when it comes to subverting the Windows API and creating rootkits. These two masters come together to pierce the veil of mystery surrounding rootkits, bringing this information out of the shadows. Anyone even remotely interested in security for Windows systems, including forensic analysis, should include this book very high on their must-read list.""--Harlan Carvey, author of" Windows Forensics and Incident Recovery "(Addison-Wesley, 2005)"Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them. Rootkit.com's Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology--learn how attackers can get in and stay in for years, without detection. Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. Using extensive downloadable examples, they teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers.After reading this book, readers will be able toUnderstand the role of rootkits in remote command/control and software eavesdroppingBuild kernel rootkits that can make processes, files, and directories invisibleMaster key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objectsWork with layered drivers to implement keyboard sniffers and file filtersDetect rootkits and build host-based intrusion prevention software that resists rootkit attacksVisit rootkit.com for code and programs from this book. The site also contains enhancements to the book's text, such as up-to-the-minute information on rootkits available nowhere else.
Read more
About the Author
Greg Hoglund has been a pioneer in the area of software security. He is CEO of HBGary, Inc., a leading provider of software security verification services. After writing one of the first network vulnerability scanners (installed in over half of all Fortune 500 companies), he created and documented the first Windows NT-based rootkit, founding rootkit.com in the process. Greg is a frequent speaker at Black Hat, RSA, and other security conferences. James Butler, Director of Engineering at HBGary, has a world-class talent for kernel programming and rootkit development and extensive experience in host-based intrusion-detection systems. He is the developer of VICE, a rootkit detection and forensics system. Jamie's previous positions include Senior Security Software Engineer at Enterasys and Computer Scientist at the National Security Agency. He is a frequent trainer and speaker at Black Hat security conferences. He holds a masters of computer science from the University of Maryland, Baltimore County. He has published articles in the IEEE Information Assurance Workshop, Phrack, USENIX ;login:, and Information Management and Computer Security.
Read more
See all Editorial Reviews
Product details
Paperback: 352 pages
Publisher: Addison-Wesley Professional; 1st. Ed. edition (August 1, 2005)
Language: English
ISBN-10: 9780321294319
ISBN-13: 978-0321294319
ASIN: 0321294319
Product Dimensions:
7.4 x 0.8 x 9.2 inches
Shipping Weight: 1.4 pounds (View shipping rates and policies)
Average Customer Review:
3.6 out of 5 stars
28 customer reviews
Amazon Best Sellers Rank:
#484,446 in Books (See Top 100 in Books)
Great help
This book is a must have for anyone working in it security. it is a sort of dark knowledge of windows programming. it contain good examples on how to hide processes, hook anything in windows, hide files. i read it 3 times, highly recommended!
It's old, got to check dates on these things.
Nice cover. Not recommended. Poorly written. Reads like a gamer wrote it, not a professional programmer. Neato ideas with a lot of fluff, no substance.
I read Rootkits: Subverting the Windows Kernel last year, but waited until I read Joseph Kong's Designing BSD Rootkits before reviewing both books. In a head-to-head comparison, I thought Kong's book was easier to comprehend and directly covered the key techniques I wanted to see. If I could give this book 4 1/2 stars I would, but Amazon doesn't allow that luxury.Hoglund and Butler should be commended for writing this book. It really does assemble the parts (meaning techniques and code) necessary to implement a Windows rootkit, at least prior to Windows Vista. My only concern is that, at times, the authors are not as clear as I hoped they might be. This is probably due to the fact that they are two of the best rootkit writers on the planet, so they probably do not remember what it was like to not understand "hooking" and other techniques.In some ways Rootkits is probably a book best suited for other experts (like many who wrote reviews here). That leaves beginners (like myself) wishing for a little more foundation or direct language prior to reading about implementation tricks.One of the greatest strengths of this book, however, is the degree to which it exposes the internal workings of Windows. For greatest effect it's probably worth reading Microsoft Windows Internals, Fourth Edition by Russinovich and Solomon first.Note that although I found the direct approach of the BSD rootkits book better for my learning style, this book by Hoglund and Butler is deeper in several areas. In fact, those who liked the BSD rootkits book would do well to read its Windows counterpart to learn tricks from Hoglund and Butler.
I had read this book with the intentions of gaining a better understanding how advanced malware works on the Windows OS. Coupled with Windows Internals, this book has given me a better knowledge of how deal with malware outbreaks at my job. This book provides you with code to build your own rudimentary rootkit, kind of a rootkit "Hello World" program. This book was published in 2005, so the rootkit design would be pre-Vista/Win7. Going from XP to Vista/Win7 represents a quantum leap in terms of resistance to malware, as a large number of security mechanisms were introduced since then, so I doubt the rootkit code would hold water today.However, this book is still a good read for a Windows administrator who wants to know how to better deal with malware outbreaks, and in gauging the potential impact on the enterprise.As for practical application; this book has helped me understand the analysis of a ZeroAccess persistent rootkit, something that I had been dealing with at work.[...]
Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up rootkit.com, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.
Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund PDF
Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund EPub
Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund Doc
Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund iBooks
Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund rtf
Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund Mobipocket
Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel, by Greg Hoglund Kindle
0 comments:
Post a Comment