深度剖析Windows内核的Rootkit威胁：最新技术揭秘

需积分: 10 83 浏览量更新于2024-07-29 1 收藏 2.18MB PDF 举报

《根kit：颠覆Windows内核》是一本由Greg Hoglund和James Butler合著的专业书籍，于2005年7月22日由Addison Wesley Professional出版社发行，ISBN号为0-321-29431-9。全书共352页，深入探讨了在Windows操作系统环境下，如何通过高级技术手段（如HOOK）潜入系统底层（即内核），创建和隐藏后门，从而对系统的安全性构成威胁。本书的重要性在于，它揭示了随着网络安全领域的发展，rootkit（根kit）这一技术日益增长的影响力。对于任何致力于网络安全的专家或程序员来说，它是不可或缺的参考资料，因为它是该领域唯一的专著，涵盖了最新的技术和策略。作者们以其详尽的研究、严谨的技术分析以及精心设计的相关示例，展现了他们在这个复杂主题上的深厚功底。书中内容包括rootkit的基本原理、构造方法、检测与防御策略，以及实战案例分析，使得无论是系统管理员、安全专业人士还是软件开发者，都能从中了解到rootkit作者使用的高级技术手段。特别是对于那些在信息技术和安全管理领域工作，但仍对rootkit威胁感到担忧的专业人士而言，这本书提供了及时且实用的知识，帮助他们提升对系统安全的认识，应对不断演变的威胁。 Mark Russinovich，Windows IT Pro/Windows & .NET Magazine的编辑，强烈推荐这本书，认为它是所有从事网络安全工作的人员了解rootkit威胁的必要读物。而Tony Bautts，作为安全顾问和Xtivix Inc.的CEO，也给出了高度评价，称其技术细节出色，研究深入，实例开发投入大，堪称卓越之作。《根kit：颠覆Windows内核》不仅是一本技术指南，也是一份深度剖析rootkit现象的实战手册，对于提升Windows系统的安全防护水平具有深远的影响。阅读这本书，将有助于读者理解并掌握这一新兴威胁，从而更好地保护网络安全。

About the Cover

The front cover of this book holds a lot of significance for Jamie and me. We designed this cover ourselves,

with the help of a wonderfully talented Brazilian artist named Paulo. The person depicted on the front is a

historical Japanese figure called a Samurai. (We mean no disrespect by taking some creative license in

depicting the character.) We chose him because he represents the artistry of his craft, strength of character,

and the fact that his art was essential to his culture and its leaders. He also represents the importance of

recognizing the interconnectedness of the world in which we live.

The sword is the tool of the Samurai, the object of his skill. You'll notice that his sword is centered in the

picture, and driven into the ground. From the sword springs roots that signify growth and depth of knowledge.

The roots become circuits to represent knowledge of computer technology and the tools of the rootkit

developer. The kanji characters behind him mean "to gain knowledge."

We think this is an apt description of our work. Jamie and I are continually learning and updating our

knowledge. We are pleased to be able to impart what we've learned to others. We want you to see the

incredible power that rests in the roots you can create.

—Greg Hoglund

Understanding Attackers' Motives

A back door in a computer is a secret way to get access. Back doors have been popularized in many

Hollywood movies as a secret password or method for getting access to a highly secure computer system. But

back doors are not just for the silver screen—they are very real, and can be used for stealing data, monitoring

users, and launching attacks deep into computer networks.

An attacker might leave a back door on a computer for many reasons. Breaking into a computer system is

hard work, so once an attacker succeeds, she will want to keep the ground she has gained. She may also want

to use the compromised computer to launch additional attacks deeper into the network.

A major reason attackers penetrate computers is to gather intelligence. To gather intelligence, the attacker will

want to monitor keystrokes, observe behavior over time, sniff packets from the network, and exfiltrate

[4]

data

from the target. All of this requires establishing a back door of some kind. The attacker will want to leave

software running on the target system that can perform intelligence gathering.

[4]

Exfiltrate: To transport out of, to remove from a location; to transport a copy of data from one location to

another.

Attackers also penetrate computers to destroy them, in which case the attacker might leave a logic bomb on

the computer, which she has set to destroy the computer at a specific time. While the bomb waits, it needs to

stay undetected. Even if the attacker does not require subsequent back-door access to the system, this is a case

where software is left behind and it must remain undetected.

The Role of Stealth

To remain undetected, a back-door program must use stealth. Unfortunately, most publicly available "hacker"

back-door programs aren't terribly stealthy. Many things can go wrong. This is mostly because the developers

want to build everything including the proverbial kitchen sink into a back-door program. For example, take a

look at the Back Orifice or NetBus programs. These back-door programs sport impressive lists of features,

some as foolish as ejecting your CD-ROM tray. This is fun for office humor, but not a function that would be

used in a professional attack operation.

[5]

If the attacker is not careful, she may reveal her presence on the

network, and the whole operation may sour. Because of this, professional attack operations usually require

specific and automated back-door programs—programs that do only one thing and nothing else. This provides

assurance of consistent results.

[5]

Professional in this case indicates a sanctioned operation of some kind, as performed, for example, by

law enforcement, pen testers, red teams, or the equivalent.

If computer operators suspect that their computer or network has been penetrated, they may perform forensic

discovery, looking for unusual activity or back-door programs.

[6]

The best way to counter forensics is with

stealth: If no attack is suspected, then no forensics are likely to be applied to the system. Attackers may use

stealth in different ways. Some may simply try to step lightly by keeping network traffic to a minimum and

avoiding storing files on the hard drive. Others may store files but employ obfuscation techniques that make

forensics more difficult. If stealth is used properly, forensics will never be applied to a compromised system,

because the intrusion will not have been detected. Even if an attack is suspected and forensics end up being

used a good stealth attack will store data in obfuscated ways to escape detection.

[6]

For a good text on computer forensics, see D. Farmer and W. Venema, Forensic Discovery (Boston:

Addison-Wesley, 2004).

剩余362页未读，继续阅读

ohshitl

粉丝: 5
资源: 36

深度剖析Windows内核的Rootkit威胁：最新技术揭秘

Rootkits Subverting the Windows Kernel.rar

RootKits Windows内核驱动安全防护教程(Rootkits Subverting the Windows Kernel).zip

rootkits--windows内核的安全防护电子书

rootkits——windows内核的安全防护 pdf

windows api hook & rootkits资料大全

rootkis windows内核安全防护下载

linux和windows的应急响应的恶意进程和编码

linux 检查病毒和恶意软件

电视节目包装与编排笔记.doc

2022爱奇亿研发工程师笔试资料2022爱奇亿研发工程师笔试资料

最新资源