深入解析：Windows内核中的Rootkits安全防御

需积分: 16 149 浏览量更新于2024-07-24 收藏 2.03MB PDF 举报

"Rootkits--Windows内核的安全防护(带目录书签)" 《Rootkits--Windows内核的安全防护》是一本由Greg Hoglund和James Butler共同撰写的书籍，由Addison Wesley Professional出版，发布于2005年7月22日，ISBN号为0-321-29431-9，共352页。这本书深入探讨了针对Windows内核的Rootkits技术及其安全防护措施，包含详细的目录和书签，便于读者查阅。 Rootkits是一种高级的恶意软件工具，其主要目标是隐藏在操作系统的核心层，使得攻击者能够秘密地控制受感染的系统，同时逃避常规的安全检测。书中详细阐述了Rootkits的工作原理、它们如何潜入Windows内核，以及如何利用各种技术来隐藏自己的存在。对于网络安全专业人士、Windows系统管理员以及安全程序员来说，理解Rootkit的威胁和应对策略至关重要。书中的内容不仅与时俱进，而且定义了最新的安全威胁。作者们通过深入研究和技术实践，提供了丰富的案例和详尽的技术细节，使读者能够深入了解Rootkit的构造和操作方式。书中涵盖的主题可能包括但不限于： 1. Rootkit的基础概念：介绍Rootkit的概念，解释它如何与普通病毒或木马区别开来。 2. Windows内核架构：深入讲解Windows操作系统内核的工作机制，这是理解Rootkit如何潜伏和操作的关键。 3. Rootkit的创建与部署：揭示攻击者如何构建和植入Rootkit到目标系统，以及如何避免被检测。 4. 隐藏技术：讨论Rootkit使用的各种技术，如钩子（Hooking）技术、内存篡改和文件系统篡改等，以便在系统中隐藏自身。 5. 检测与防御：介绍现有工具和技术，帮助用户检测和移除Rootkit，同时提供预防策略，以提高系统的安全性。 6. 实战案例分析：通过实际的Rootkit案例，分析其攻击模式和防御方法，增强读者的实战经验。 7. 最新趋势与未来挑战：探讨Rootkit技术的发展趋势，以及网络安全领域面临的持续挑战。本书得到了行业内专家的高度评价，认为它是了解和对抗Rootkit威胁的必备读物。对于任何负责Windows系统安全的人来说，这是一份全面且深入的参考资料，有助于提升对Rootkit威胁的理解和应对能力。

About the Cover

The front cover of this book holds a lot of significance for Jamie and me. We designed this cover ourselves,

with the help of a wonderfully talented Brazilian artist named Paulo. The person depicted on the front is a

historical Japanese figure called a Samurai. (We mean no disrespect by taking some creative license in

depicting the character.) We chose him because he represents the artistry of his craft, strength of character,

and the fact that his art was essential to his culture and its leaders. He also represents the importance of

recognizing the interconnectedness of the world in which we live.

The sword is the tool of the Samurai, the object of his skill. You'll notice that his sword is centered in the

picture, and driven into the ground. From the sword springs roots that signify growth and depth of knowledge.

The roots become circuits to represent knowledge of computer technology and the tools of the rootkit

developer. The kanji characters behind him mean "to gain knowledge."

We think this is an apt description of our work. Jamie and I are continually learning and updating our

knowledge. We are pleased to be able to impart what we've learned to others. We want you to see the

incredible power that rests in the roots you can create.

—Greg Hoglund

Understanding Attackers' Motives

A back door in a computer is a secret way to get access. Back doors have been popularized in many

Hollywood movies as a secret password or method for getting access to a highly secure computer system. But

back doors are not just for the silver screen—they are very real, and can be used for stealing data, monitoring

users, and launching attacks deep into computer networks.

An attacker might leave a back door on a computer for many reasons. Breaking into a computer system is

hard work, so once an attacker succeeds, she will want to keep the ground she has gained. She may also want

to use the compromised computer to launch additional attacks deeper into the network.

A major reason attackers penetrate computers is to gather intelligence. To gather intelligence, the attacker will

want to monitor keystrokes, observe behavior over time, sniff packets from the network, and exfiltrate

[4]

data

from the target. All of this requires establishing a back door of some kind. The attacker will want to leave

software running on the target system that can perform intelligence gathering.

[4]

Exfiltrate: To transport out of, to remove from a location; to transport a copy of data from one location to

another.

Attackers also penetrate computers to destroy them, in which case the attacker might leave a logic bomb on

the computer, which she has set to destroy the computer at a specific time. While the bomb waits, it needs to

stay undetected. Even if the attacker does not require subsequent back-door access to the system, this is a case

where software is left behind and it must remain undetected.

The Role of Stealth

To remain undetected, a back-door program must use stealth. Unfortunately, most publicly available "hacker"

back-door programs aren't terribly stealthy. Many things can go wrong. This is mostly because the developers

want to build everything including the proverbial kitchen sink into a back-door program. For example, take a

look at the Back Orifice or NetBus programs. These back-door programs sport impressive lists of features,

some as foolish as ejecting your CD-ROM tray. This is fun for office humor, but not a function that would be

used in a professional attack operation.

[5]

If the attacker is not careful, she may reveal her presence on the

network, and the whole operation may sour. Because of this, professional attack operations usually require

specific and automated back-door programs—programs that do only one thing and nothing else. This provides

assurance of consistent results.

[5]

Professional in this case indicates a sanctioned operation of some kind, as performed, for example, by

law enforcement, pen testers, red teams, or the equivalent.

If computer operators suspect that their computer or network has been penetrated, they may perform forensic

discovery, looking for unusual activity or back-door programs.

[6]

The best way to counter forensics is with

stealth: If no attack is suspected, then no forensics are likely to be applied to the system. Attackers may use

stealth in different ways. Some may simply try to step lightly by keeping network traffic to a minimum and

avoiding storing files on the hard drive. Others may store files but employ obfuscation techniques that make

forensics more difficult. If stealth is used properly, forensics will never be applied to a compromised system,

because the intrusion will not have been detected. Even if an attack is suspected and forensics end up being

used a good stealth attack will store data in obfuscated ways to escape detection.

[6]

For a good text on computer forensics, see D. Farmer and W. Venema, Forensic Discovery (Boston:

Addison-Wesley, 2004).

剩余362页未读，继续阅读

鱼泡范

粉丝: 3
资源: 9

深入解析：Windows内核中的Rootkits安全防御

Rootkits_Windows内核的安全防护 电子书及源码

《Rootkits--Windows内核的安全防护》_Rootkits；_Windows内核的安全防护_

Rootkits--Windows内核的安全防护.pdf

Rootkits--Windows内核的安全防护

Rootkits--Windows内核的安全防护 2

Rootkits--Windows内核的安全防护（电子版）

rootkits--windows内核的安全防护电子书

《Rootkits--Windows内核的安全防护》.(Hoglund).[PDF]&ckook;

Rootkits-Windows内核的安全防护-中文

《Rootkits-Windows内核的安全防护》-中文.pdf

最新资源

Rootkits_Windows内核的安全防护电子书及源码