MARK RUSSINOVICH Chief Technology Officer Microsoft Azure

Total Page：16

File Type：pdf, Size：1020Kb

MARK RUSSINOVICH Chief Technology Officer Microsoft Azure

MARK RUSSINOVICH is the CTO of Microsoft Azure. He was a co-founder of software producers Winternals before it was acquired by Microsoft in 2006. Russinovich earned his B.S. in computer engineering from Carnegie Mellon Uni- versity in 1989 and M.S. in computer cngineering from Rensselaer Polytechnic Institute. He later returned to CMU, and received a Ph.D. in computer engineer-ing on Application-transparent fault manage- ment in 1994, under the supervision of Zary Segall. From 1994 through early 1996 Russinovich was a research associate with the University of Oregon's computer science department and then joined NuMega Technologies as a developer, working on performance monitoring software for Window NT. In 1996, he and Bryce Cogswell cofounded Winternals Software, where Russinovich served as Chief Software Architect, and the web site sysinternals.com, where he wrote and published dozens of popular Windows administration and diagnostic utilities in- cludeing Autoruns, Filemon, Regmon, Process Explorer, TCPView, and RootkitRevealer among many others. In 1997 he worked as a consulting associate at OSR Open Systems Resources, Inc. and then joined IBM's Thomas J. Watson Research Center as a research staff member, re- searching operating system support for Web server acceleration and serving as an operating systems expert. Russinovich joined Microsoft in 2006, when it acquired Most existing blockchain protocols fail to meet several key enterprise requirements, including Winternals Software. con-fidentiality, acceptable transaction throughput and latency, computational efficiency (e.g. In his role as an author, he is a regular energy costs for proof-of-work consensus), and effective governance. Coco Framework, an contributor to TechNet Magazine and open-source system, enables any blockchain ledger that integrates with it to meet these needs. SCS Distinguished Industry Windows IT Pro magazine (previously called Windows NT Magazine) on the subject of It does so by leveraging Trusted Execution Environments (TEEs) such as Intel’s Software Guard Lecture the Architecture of Windows 2000 and was Extensions (SGX) to make a blockchain network that can use efficient consensus protocols and Monday, 4 December 2017 co-author of Inside Windows 2000 (third implement access control rules to protect blockchain state from being accessed by unauthor- edition). Russinovich is the author of many 4:30 pm - Rashid Auditorium tools used by Windows NT and Windows ized parties, even ones that operate the nodes on which it runs. Mark will describe Coco 2000 kernel-mode programmers, and of the Framework’s algorithms, as well as Microsoft’s broader research and development efforts in Gates Hillman 4401 NTFS file system driver for DOS. TEEs. .

Copy Link

Recommended publications

Process Explorer V16.05 (1.07 MB)
United States (English) Sign in Windows Sysinternals Search TechNet with Bing Home Learn Downloads Community Windows Sysinternals > Downloads > Process Utilities > Process Explorer Utilities Process Explorer Download Sysinternals Suite Utilities Index Download Process Explorer v16.05 (1.07 MB) File and Disk Utilities By Mark Russinovich Run Process Explorer now from Networking Utilities Published: March 10, 2015 Live.Sysinternals.com Process Utilities Download Process Explorer Runs on: Security Utilities (1.07 MB) System Information Utilities Rate: Client: Windows XP and higher (Including IA64). Miscellaneous Utilities Server: Windows Server 2003 and higher (Including Share this content IA64). Additional Introduction Installation Resources Ever wondered which program has a particular file or directory open? Now Simply run Process Explorer (procexp.exe). Forum you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded. The help file describes Process Explorer operation and Site Blog usage. If you have problems or questions please visit The Process Explorer display consists of two sub-windows. The top window the Sysinternals Process Explorer Forum. Sysinternals Learning always shows a list of the currently active processes, including the names of Mark's Webcasts their owning accounts, whereas the information displayed in the bottom Mark's Blog window depends on the mode that Process Explorer is in: if it is in handle Learn More mode you'll see the handles that the process selected in the top window has Software License opened; if Process Explorer is in DLL mode you'll see the DLLs and memory- Here are some other handle and DLL viewing tools and Licensing FAQ mapped files that the process has loaded.
[Show full text]
P 240/1 Process Control on Windows
P240.qxp_June 2018 03/05/2018 22:16 Page 41 Process Control on Windows P 240/1 Optimise and Stabilise Your Windows System by Taking Control of Your Processes Using the information given in this article you will be able to: Investigate exactly what processes are using your PC’s processor and memory, Optimise the performance of your system with perfect process management, Find and close Trojans, viruses and other suspicious processes. You’ve probably come across messages from Windows telling you that an application is no longer responding, and wondered exactly what is happening in the background on your Windows system. The egg timer icon or a little blue circle usually appear, the hard drive grinds away and you wait for what seems like an eternity for Windows to do something. When this happens, it usually indicates that Windows is performing tasks in the background. You can take a look at the list of the processes that are running on your system, but they usually have cryptic names which makes it difficult to work out exactly what is going on. However, if a program or service doesn’t run in a stable way, or you suspect that a virus or Trojan may be doing damage to your system, then you can’t avoid checking which processes are running. In this article I will show you the most important processes that Windows runs internally, and the tasks you need to perform in order to maintain your processes and take control of your system. • Check the Hidden Tasks Your Windows System is Running .................
[Show full text]
Rootkit- Rootkits.For.Dummies 2007.Pdf
01_917106 ffirs.qxp 12/21/06 12:04 AM Page i Rootkits FOR DUMmIES‰ 01_917106 ffirs.qxp 12/21/06 12:04 AM Page ii 01_917106 ffirs.qxp 12/21/06 12:04 AM Page iii Rootkits FOR DUMmIES‰ by Larry Stevenson and Nancy Altholz 01_917106 ffirs.qxp 12/21/06 12:04 AM Page iv Rootkits For Dummies® Published by Wiley Publishing, Inc. 111 River Street Hoboken, NJ 07030-5774 www.wiley.com Copyright © 2007 by Wiley Publishing, Inc., Indianapolis, Indiana Published by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permit- ted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley.com/go/permissions. Trademarks: Wiley, the Wiley Publishing logo, For Dummies, the Dummies Man logo, A Reference for the Rest of Us!, The Dummies Way, Dummies Daily, The Fun and Easy Way, Dummies.com, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates in the United States and other countries, and may not be used without written permission.
[Show full text]
La Sécurité Informatique Edition Livres Pour Tous (
La sécurité informatique Edition Livres pour tous (www.livrespourtous.com) PDF générés en utilisant l’atelier en source ouvert « mwlib ». Voir http://code.pediapress.com/ pour plus d’informations. PDF generated at: Sat, 13 Jul 2013 18:26:11 UTC Contenus Articles 1-Principes généraux 1 Sécurité de l'information 1 Sécurité des systèmes d'information 2 Insécurité du système d'information 12 Politique de sécurité du système d'information 17 Vulnérabilité (informatique) 21 Identité numérique (Internet) 24 2-Attaque, fraude, analyse et cryptanalyse 31 2.1-Application 32 Exploit (informatique) 32 Dépassement de tampon 34 Rétroingénierie 40 Shellcode 44 2.2-Réseau 47 Attaque de l'homme du milieu 47 Attaque de Mitnick 50 Attaque par rebond 54 Balayage de port 55 Attaque par déni de service 57 Empoisonnement du cache DNS 66 Pharming 69 Prise d'empreinte de la pile TCP/IP 70 Usurpation d'adresse IP 71 Wardriving 73 2.3-Système 74 Écran bleu de la mort 74 Fork bomb 82 2.4-Mot de passe 85 Attaque par dictionnaire 85 Attaque par force brute 87 2.5-Site web 90 Cross-site scripting 90 Défacement 93 2.6-Spam/Fishing 95 Bombardement Google 95 Fraude 4-1-9 99 Hameçonnage 102 2.7-Cloud Computing 106 Sécurité du cloud 106 3-Logiciel malveillant 114 Logiciel malveillant 114 Virus informatique 120 Ver informatique 125 Cheval de Troie (informatique) 129 Hacktool 131 Logiciel espion 132 Rootkit 134 Porte dérobée 145 Composeur (logiciel) 149 Charge utile 150 Fichier de test Eicar 151 Virus de boot 152 4-Concepts et mécanismes de sécurité 153 Authentification forte
[Show full text]
Process Explorer Copyright © 1996-2012 Mark Russinovich Sysinternals
Process Explorer Copyright © 1996-2012 Mark Russinovich Sysinternals - www.sysinternals.com Process Explorer is an advanced process management utility that picks up where Task Manager leaves off. It will show you detailed information about a process including its icon, command-line, full image path, memory statistics, user account, security attributes, and more. When you zoom in on a particular process you can list the DLLs it has loaded or the operating system resource handles it has open. A search capability enables you to track down a process that has a resource opened, such as a file, directory or Registry key, or to view the list of processes that have a DLL loaded. The Process Explorer display consists of two sub-windows. The top always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window, which you can close, depends on the mode that Process Explorer is in: if it is in handle mode you will see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you will see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded. The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work. You can obtain equivalent command-line tools, Handle and ListDLLs, at the Sysinternals Web site.
[Show full text]
What Are Kernel-Mode Rootkits?
www.it-ebooks.info Hacking Exposed™ Malware & Rootkits Reviews “Accessible but not dumbed-down, this latest addition to the Hacking Exposed series is a stellar example of why this series remains one of the best-selling security franchises out there. System administrators and Average Joe computer users alike need to come to grips with the sophistication and stealth of modern malware, and this book calmly and clearly explains the threat.” —Brian Krebs, Reporter for The Washington Post and author of the Security Fix Blog “A harrowing guide to where the bad guys hide, and how you can find them.” —Dan Kaminsky, Director of Penetration Testing, IOActive, Inc. “The authors tackle malware, a deep and diverse issue in computer security, with common terms and relevant examples. Malware is a cold deadly tool in hacking; the authors address it openly, showing its capabilities with direct technical insight. The result is a good read that moves quickly, filling in the gaps even for the knowledgeable reader.” —Christopher Jordan, VP, Threat Intelligence, McAfee; Principal Investigator to DHS Botnet Research “Remember the end-of-semester review sessions where the instructor would go over everything from the whole term in just enough detail so you would understand all the key points, but also leave you with enough references to dig deeper where you wanted? Hacking Exposed Malware & Rootkits resembles this! A top-notch reference for novices and security professionals alike, this book provides just enough detail to explain the topics being presented, but not too much to dissuade those new to security.” —LTC Ron Dodge, U.S.
[Show full text]
Windows Rootkit Analysis Report
Windows Rootkit Analysis Report HBGary Contract No: NBCHC08004 SBIR Data Rights November 2008 Page 1 Table of Contents Introduction ................................................................................................................................... 4 Clean Monitoring Tool Logs......................................................................................................... 5 Clean System PSList ................................................................................................................. 5 Clean System Process Explorer ................................................................................................ 6 Vanquish......................................................................................................................................... 7 PSList Vanquish ........................................................................................................................ 7 Vanquish Process Monitor (Process Start – Exit) .................................................................. 8 Process Explorer Thread Stack Vanquish .............................................................................. 8 Process Monitor Events Vanquish ........................................................................................... 9 Vanquish Log File (Created by rootkit, placed in root directory “C:”) ............................. 21 Process Explorer Memory Strings Vanquish ........................................................................ 23 NTIllusion....................................................................................................................................
[Show full text]
Windows Internals, Sixth Edition, Part 2
spine = 1.2” Part 2 About the Authors Mark Russinovich is a Technical Fellow in ® the Windows Azure™ group at Microsoft. Windows Internals He is coauthor of Windows Sysinternals SIXTH EDITION Administrator’s Reference, co-creator of the Sysinternals tools available from Microsoft Windows ® The definitive guide—fully updated for Windows 7 TechNet, and coauthor of the Windows Internals and Windows Server 2008 R2 book series. Delve inside Windows architecture and internals—and see how core David A. Solomon is coauthor of the Windows Internals book series and has taught components work behind the scenes. Led by a team of internationally his Windows internals class to thousands of renowned internals experts, this classic guide has been fully updated Windows developers and IT professionals worldwide, SIXTH for Windows 7 and Windows Server® 2008 R2—and now presents its including Microsoft staff. He is a regular speaker 6EDITION coverage in two volumes. at Microsoft conferences, including TechNet As always, you get critical, insider perspectives on how Windows and PDC. operates. And through hands-on experiments, you’ll experience its Alex Ionescu is a chief software architect and internal behavior firsthand—knowledge you can apply to improve consultant expert in low-level system software, application design, debugging, system performance, and support. kernel development, security training, and Internals reverse engineering. He teaches Windows internals courses with David Solomon, and is ® In Part 2, you will: active in the security research community.
[Show full text]
Windows Performance Troubleshooting and Analysis Daniel Pearson David Solomon Expert Seminars Daniel Pearson
Windows Performance Troubleshooting and Analysis Daniel Pearson David Solomon Expert Seminars Daniel Pearson • Started working with Windows NT 3.51 • Three years at Digital Equipment Corporation • Supporting Intel and Alpha systems running Windows NT • Seven years at Microsoft • Senior Escalation Lead in Windows base team • Worked in the Mobile Internet sustained engineering team • Instructor for David Solomon, co-author of the Windows Internals book series Agenda • Components of performance analysis • Understanding the tools for troubleshooting and analyzing performance issues • Troubleshooting CPU and memory issues using various Windows tools * Portions of this session are based on material developed by Mark Russinovich and David Solomon Components of Performance Analysis • Event Tracing for Windows • Core component of the operating system • Kernel mode data structures • Used to store information about the system and system objects that can be read by various tools • e.g. dt nt!_KTHREAD KernelTime • CPU performance monitoring events • Refer to the Intel 64 and IA-32 Architectures Software Developer‟s Manual • http://developer.intel.com/products/processor/manuals Event Tracing for Windows • Built in to the system • High performance, low overhead and scalable • 2.5% CPU usage for a sustained rate of 10,000 events/sec on a 2 GHz CPU1 • Operations throughout the system that are of interest to performance are fully instrumented • e.g. process and thread activity, registry I/O, disk I/O 1. Milirud, Michael. 2008. Windows Performance Analysis:
[Show full text]
Malware Hunting with the Sysinternals Tools
SESSION ID: HTA-T07R Malware Hunting with the Sysinternals Tools Mark Russinovich CTO, Microsoft Azure Microsoft @markrussinovich #RSAC #RSAC “When combining the results from all four AV engines, less than 40% of the binaries were detected.” Source: CAMP: Content-Agnostic Malware Protection Proceedings of 20th Annual Network & Distributed System Security Symposium https://www.cs.jhu.edu/~moheeb/aburajab-ndss-13.pdf #RSAC #RSAC #RSAC About this Talk Learn about Sysinternals tools and techniques for analyzing and cleaning malware Professional antimalware analysis requires years of deep training But even for professionals, Sysinternals tools can prove useful Analyzing: Understanding the impact of malware Can be used to understand malware operation Generates road map for cleaning infestations Cleaning: Removing an infestation of a compromised system Attempting a clean can also reveal more information about malware’s operation #RSAC Malware Cleaning Steps Disconnect from network Identify malicious processes and drivers Terminate identified processes Identify and delete malware autostarts Delete malware files Reboot and repeat #RSAC #RSAC What Are You Looking For? Investigate processes that… …have no icon …have no description or company name …unsigned Microsoft images …live in Windows directory or user profile …are packed …include strange URLs in their strings …have open TCP/IP endpoints …host suspicious DLLs or services #RSAC What About Task Manager? Task Manager provides little information about images that are running
[Show full text]
Vmwatcher.Pdf
Stealthy Malware Detection and Monitoring through VMM-Based “Out-of-the-Box” 12 Semantic View Reconstruction XUXIAN JIANG North Carolina State University XINYUAN WANG George Mason University and DONGYAN XU Purdue University An alarming trend in recent malware incidents is that they are armed with stealthy techniques to detect, evade, and subvert malware detection facilities of the victim. On the defensive side, a fundamental limitation of traditional host-based antimalware systems is that they run inside the very hosts they are protecting (“in-the-box”), making them vulnerable to counter detection and subversion by malware. To address this limitation, recent solutions based on virtual machine (VM) technologies advocate placing the malware detection facilities outside of the protected VM (“out-of- the-box”). However, they gain tamper resistance at the cost of losing the internal semantic view of the host, which is enjoyed by “in-the-box” approaches. This poses a technical challenge known as the semantic gap. In this article, we present the design, implementation, and evaluation of VMwatcher—an “out- of-the-box” approach that overcomes the semantic gap challenge. A new technique called guest view casting is developed to reconstruct internal semantic views (e.g., files, processes, and ker- nel modules) of a VM nonintrusively from the outside. More specifically, the new technique casts semantic definitions of guest OS data structures and functions on virtual machine monitor (VMM)- level VM states, so that the semantic view can be reconstructed. Furthermore, we extend guest view casting to reconstruct details of system call events (e.g., the process that makes the system This work was supported in part by the US National Science Foundation (NSF) under Grants CNS-0716376, CNS-0716444 and CNS-0546173.
[Show full text]
Sysinternals Learning Resources
THE PERSONAL COMPUTER SPECIALIST Sysinternals Learning Resources Help and Support Sysinternals Learning Resources Help Desk Books Windows Internals Book Homepage The official updates and errata page for the definitive book on Windows internals, by Mark Russinovich and David Solomon. Windows Sysinternals Administrator's Reference The official guide to the Sysinternals utilities by Mark Russinovich and Aaron Margosis, including descriptions of all the tools, their features, how to use them for troubleshooting, and example real-world cases of their use. Articles Inside the Windows Vista Kernel: Part 1 Inside the Windows Vista Kernel: Part 2 Inside the Windows Vista Kernel: Part 3 Inside Windows Vista User Account Control Inside Windows Server 2008 Kernel Changes Mark's Blog Articles Hunting Down and Killing Ransomware Scareware, a type of malware that mimics antimalware software, has been around for a decade and shows no sign of going away. The goal of scareware is to fool a user into thinking that their computer is heavily infected with malware and the most convenient...(read more) Monday, Jan 7 The Case of the Unexplained FTP Connections A key part of any cybersecurity plan is “continuous monitoring”, or enabling auditing and monitoring throughout a network environment and configuring automated analysis of the resulting logs to identify anomalous behaviors that merit investigation. This...(read more) Tuesday, Oct 30 Windows Azure Host Updates: Why, When, and How Windows Azure’s compute platform, which includes Web Roles, Worker Roles, and Virtual Machines, is based on machine virtualization. It’s the deep access to the underlying operating system that makes Windows Azure’s Platform-as-a-Service (PaaS) uniquely...(read more) Wednesday, Aug 22 The Case of the Veeerrry Slow Logons This case is my favorite kind of case, one where I use my own tools to solve a This case is my favorite kind of case, one where I use my own tools to solve a problem affecting me personally.
[Show full text]