DOCSLIB.ORG

Rootkits and Bootkits with a Record of Discovering Advanced Malware.” — Rodrigo Rubira Branco Rootkits

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Rootkits and Bootkits with a Record of Discovering Advanced Malware.” — Rodrigo Rubira Branco Rootkits “Follow in the footsteps of professionals Bootkits and Rootkits with a record of discovering advanced malware.” Rootkits — Rodrigo Rubira Branco Rootkits and Bootkits will teach you how How to better understand the delivery stage to understand and counter sophisticated, of threats against BIOS and UEFI firmware advanced threats buried deep in a machine’s in order to create detection capabilities boot process or UEFI firmware. How to use virtualization tools like VMware and Bootkits With the aid of numerous case studies and Workstation to reverse engineer bootkits professional research from three of the world’s and the Intel Chipsec tool to dig into forensic leading security experts, you’ll trace malware analysis development over time from rootkits like TDL3 Reversing Modern Malware and to present-day UEFI implants and examine Cybercrime syndicates and malicious actors how they infect a system, persist through will continue to write ever more persistent reboot, and evade security software. As you and covert attacks, but the game is not lost. Next Generation Threats inspect and dissect real malware, you’ll learn: Explore the cutting edge of malware analysis with Rootkits and Bootkits. How Windows boots—including 32-bit, 64-bit, and UEFI mode—and where to find About the Authors vulnerabilities and Malware Modern Reversing Alex Matrosov is an Offensive Security The details of boot process security Threats Generation Next mechanisms like Secure Boot, including Research Lead at NVIDIA with over 20 years of an overview of Virtual Secure Mode (VSM) experience in reverse engineering, advanced and Device Guard malware analysis, firmware security, and exploitation techniques. Eugene Rodionov, Reverse engineering and forensic techniques PhD, is a Security Researcher at Intel working for analyzing real malware, including in BIOS security for Client Platforms. Sergey bootkits like Rovnix/Carberp, Gapz, TDL4, Bratus is a Research Associate Professor in the and the infamous rootkits TDL3 and Festi Computer Science Department at Dartmouth College. He has previously worked at BBN How to perform static and dynamic Technologies on natural language processing analysis using emulation and tools like research. Bochs and IDA Pro “I LIE FLAT.” This book uses a durable binding that won’t snap shut. Matrosov, THE FINEST IN GEEK ENTERTAINMENT™ www.nostarch.com Rodionov, Price: $49.95 ($65.95 CDN) and Bratus Shelve In: COMPUTErs/SECUriTY Alex Matrosov, Eugene Rodionov, and Sergey Bratus FSC FPO Foreword by Rodrigo Rubira Branco ROOTKITS AND BOOTKITS ROOTKITS AND BOOTKITS Reversing Modern Malware and Next Generation Threats by Alex Matrosov, Eugene Rodionov, and Sergey Bratus San Francisco ROOTKITS AND BOOTKITS. Copyright © 2019 by Alex Matrosov, Eugene Rodionov, and Sergey Bratus. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owners and the publisher. ISBN-10: 1-59327-716-4 ISBN-13: 978-1-59327-716-1 Publisher: William Pollock Production Editor: Laurel Chun Cover Illustration: Garry Booth Interior Design: Octopod Studios Developmental Editors: Liz Chadwick, William Pollock, and Frances Saux Technical Reviewer: Rodrigo Rubira Branco Copyeditor: Rachel Monaghan Compositors: Kassie Andreadis and Britt Bogan Proofreader: Paula L. Fleming Indexer: Erica Orloff For information on distribution, translations, or bulk sales, please contact No Starch Press, Inc. directly: No Starch Press, Inc. 245 8th Street, San Francisco, CA 94103 phone: 1.415.863.9900; [email protected] www.nostarch.com Library of Congress Control Number: 2018949204 No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the authors nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it. To our families and to those who made this book possible About the Authors Alex Matrosov is a leading offensive security researcher at NVIDIA. He has more than two decades of experience with reverse engineer- ing, advanced malware analysis, firmware security, and exploitation techniques. Before joining NVIDIA, Alex served as Principal Security Researcher at Intel Security Center of Excellence (SeCoE), spent more than six years in the Intel Advanced Threat Research team, and was Senior Security Researcher at ESET. Alex has authored and co-authored numerous research papers and is a frequent speaker at security confer- ences, including REcon, ZeroNights, Black Hat, DEFCON, and others. Alex received an award from Hex-Rays for his open source plug-in HexRaysCodeXplorer, supported since 2013 by the team at REhint. Eugene Rodionov, PhD, is a Security Researcher at Intel working in BIOS security for Client Platforms. Before that, Rodionov ran internal research projects and performed in-depth analysis of complex threats at ESET. His fields of interest include firmware security, kernel-mode programming, anti-rootkit technologies, and reverse engineering. Rodionov has spoken at security conferences, such as Black Hat, REcon, ZeroNights, and CARO, and has co-authored numerous research papers. Sergey Bratus is a Research Associate Professor in the Computer Science Department at Dartmouth College. He has previously worked at BBN Technologies on Natural Language Processing research. Bratus is inter- ested in all aspects of Unix security, in particular Linux kernel security, and detection and reverse engineering of Linux malware. About the Technical Reviewer Rodrigo Rubira Branco (BSDaemon) works as Chief Security Researcher at Intel Corporation where he leads the STORM (Strategic Offensive Research and Mitigations) team. Rodrigo released dozens of vulnerabilities in many important technologies and published innovative research in exploitation, reverse engineering, and malware analysis. He is a member of the RISE Security Group and is one of the organizers of the Hackers to Hackers Conference (H2HC), the oldest security research conference in Latin America. BRIEF CONTENTS Foreword by Rodrigo Rubira Branco..................................... xix Acknowledgments ................................................. xxiii Abbreviations .................................................... xxv Introduction ...................................................... xxix PART I: ROOTKITS Chapter 1: What’s in a Rootkit: The TDL3 Case Study ......................... 3 Chapter 2: Festi Rootkit: The Most Advanced Spam and DDoS Bot................ 13 Chapter 3: Observing Rootkit Infections .................................. 35 PART II: BOOTKITS Chapter 4: Evolution of the Bootkit ...................................... 49 Chapter 5: Operating System Boot Process Essentials ......................... 57 Chapter 6: Boot Process Security . 69 Chapter 7: Bootkit Infection Techniques .................................. 83 Chapter 8: Static Analysis of a Bootkit Using IDA Pro ......................... 95 Chapter 9: Bootkit Dynamic Analysis: Emulation and Virtualization .............. 115 Chapter 10: An Evolution of MBR and VBR Infection Techniques: Olmasco ......... 133 Chapter 11: IPL Bootkits: Rovnix and Carberp ............................. 147 Chapter 12: Gapz: Advanced VBR Infection .............................. 177 Chapter 13: The Rise of MBR Ransomware ............................... 207 Chapter 14: UEFI Boot vs. the MBR/VBR Boot Process ....................... 233 Chapter 15: Contemporary UEFI Bootkits ................................ 255 Chapter 16: UEFI Firmware Vulnerabilities ............................... 285 PART III: DEFENSE AND FORENSIC TECHNIQUES Chapter 17: How UEFI Secure Boot Works ............................... 319 Chapter 18: Approaches to Analyzing Hidden Filesystems .................... 351 Chapter 19: BIOS/UEFI Forensics: Firmware Acquisition and Analysis Approaches ... 363 Index ......................................................... 391 x Brief Contents CONTENTS IN DETAIL FOREWORD by Rodrigo Rubira Branco xix ACKNOWLEDGMENTS xxiii ABBREVIATIONS xxv INTRODUCTION xxix Why Read This Book? .............................................. xxx What’s in the Book? ................................................ xxx Part 1: Rootkits ............................................ xxxi Part 2: Bootkits ............................................ xxxi Part 3: Defense and Forensic Techniques ......................... xxxiii How to Read This Book............................................. xxxiii PART I: ROOTKITS 1 WHAt’s in A ROOTKIT: THE TDL3 CASE STUDY 3 History of TDL3 Distribution in the Wild.................................... 4 Infection Routine ................................................... 5 Controlling the Flow of Data ........................................... 7 Bring Your Own Linker ....................................... 7 How
Load more

Recommended publications
  • The Evolution of Ransomware
    The evolution of ransomware SECURITY RESPONSE The evolution of ransomware Kevin Savage, Peter Coogan, Hon Lau Version 1.0 – August 6, 2015 Never before in the history of human kind have people across the world been subjected to extortion on a massive scale as they are today. CONTENTS OVERVIEW ..............................................................................3 Key information ......................................................................5 Types of ransomware .............................................................5 How ransomware has evolved ...............................................7 Targets for ransomware .......................................................13 Systems impacted by ransomware ......................................14 Ransomware: How it works ..................................................18 Ransom techniques ..............................................................27 How widespread is the problem of ransomware .................33 What does the future hold for ransomware? .......................37 Conclusion ............................................................................45 Appendix ..............................................................................47 Mitigation strategies ............................................................51 Symantec detections for common ransomware families 54 Resources .............................................................................56 OVERVIEW Never before in the history of human kind have people across the world been
    [Show full text]
  • ESET Observed That the Focus of Android Ransomware Operators Cybercriminals, Even Though It Had Been Around for Many Years Before
    TRENDS IN ANDROID RANSOMWARE Authors Robert Lipovský – Senior Malware Researcher Lukáš Štefanko – Detection Engineer Gabriel Braniša – Malware Researcher The Rise of Android Ransomware Contents SUMMARY 2 RANSOMWARE ON ANDROID 2 Common infection vectors 3 Malware c&c communication 3 Malware self-protection 4 ANDROID RANSOMWARE CHRONOLOGY 5 Android defender 5 Ransomware meets fake av, meets…porn 7 Police ransomware 8 Simplocker 9 Simplocker distribution vectors 9 Simplocker in English 10 Lockerpin 11 Lockerpin’s aggressive self–defense 12 Jisut 13 Charger 15 HOW TO KEEP YOUR ANDROID PROTECTED 15 – 1 – The Rise of Android Ransomware SUMMARY RANSOMWARE ON ANDROID 2016 brought some interesting developments to the Android ransomware Ransomware, as the name suggests, is any type of malware that demands scene Ransomware is currently one of the most pressing cybersecurity a sum of money from the infected user while promising to “release” issues across all platforms, including the most popular mobile one a hijacked resource in exchange There are two general categories of malware that fall under the “ransomware” label: Authors of lock-screen types as well as file-encrypting “crypto-ransomware” have used the past 12 months to copycat effective techniques from desktop • Lock-screen ransomware malware, as well as develop their own sophisticated methods specialized • Crypto-ransomware for targets running Android devices In lock-screen types of ransomware, the hijacked resource is access to the In addition to the most prevalent scare tactics used by lock-screen
    [Show full text]
  • Lecture 1: Introduction to Reverse Engineering
    Boston, 2001 Table of Contents Table of Contents Table of Contents............................................................................................. 2 1. Introduction................................................................................................. 5 1.1 About the Course and Notes ............................................................................ 5 1.2 Definitions...................................................................................................... 5 1.3 Typical Examples ............................................................................................ 6 1.3.1 Hacking ................................................................................................... 7 1.3.2 Hiding Information from Public .................................................................. 7 1.3.3 Cell Phones ............................................................................................ 10 1.3.4 Computer Applications ............................................................................ 10 1.4 Requirements............................................................................................... 12 1.5 Scope .......................................................................................................... 13 1.6 Ethics .......................................................................................................... 13 1.7 Miscellaneous Information ............................................................................. 14 2. Programming Processors
    [Show full text]
  • A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics
    UNIVERSIDAD POLITECNICA´ DE MADRID ESCUELA TECNICA´ SUPERIOR DE INGENIEROS INFORMATICOS´ A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics PH.D THESIS Platon Pantelis Kotzias Copyright c 2019 by Platon Pantelis Kotzias iv DEPARTAMENTAMENTO DE LENGUAJES Y SISTEMAS INFORMATICOS´ E INGENIERIA DE SOFTWARE ESCUELA TECNICA´ SUPERIOR DE INGENIEROS INFORMATICOS´ A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF: Doctor of Philosophy in Software, Systems and Computing Author: Platon Pantelis Kotzias Advisor: Dr. Juan Caballero April 2019 Chair/Presidente: Marc Dasier, Professor and Department Head, EURECOM, France Secretary/Secretario: Dario Fiore, Assistant Research Professor, IMDEA Software Institute, Spain Member/Vocal: Narseo Vallina-Rodriguez, Assistant Research Professor, IMDEA Networks Institute, Spain Member/Vocal: Juan Tapiador, Associate Professor, Universidad Carlos III, Spain Member/Vocal: Igor Santos, Associate Research Professor, Universidad de Deusto, Spain Abstract of the Dissertation Potentially unwanted programs (PUP) are a category of undesirable software that, while not outright malicious, can pose significant risks to users’ security and privacy. There exist indications that PUP prominence has quickly increased over the last years, but the prevalence of PUP on both consumer and enterprise hosts remains unknown. Moreover, many important aspects of PUP such as distribution vectors, code signing abuse, and economics also remain unknown. In this thesis, we empirically and sys- tematically analyze in both breadth and depth PUP abuse, prevalence, distribution, and economics. We make the following four contributions. First, we perform a systematic study on the abuse of Windows Authenticode code signing by PUP and malware.
    [Show full text]
  • Scripting – Windows Powershell – Part 5
    CNT 4603: System Administration Spring 2012 Scripting – Windows PowerShell – Part 5 Instructor : Dr. Mark Llewellyn [email protected] HEC 236, 4078-823-2790 http://www.cs.ucf.edu/courses/cnt4603/spr2012 Department of Electrical Engineering and Computer Science Computer Science Division University of Central Florida CNT 4603: Scripting – Windows PowerShell – Part 5 Page 1 Dr. Mark Llewellyn © Code Signing • In the second set of notes on PowerShell we discussed the execution policy which is part of the security built-in to PowerShell. • We modified PowerShell’s default setting of Restricted, which prevents PowerShell from running any scripts (it is restricted to running in an interactive mode only). • We changed the setting using the set-executionpolicy cmdlet to RemoteSigned, which allowed locally created scripts to be loaded and executed without being digitally signed. • The other two options are: AllSigned, which is a notch under Restricted, in that all scripts must be digitally signed by a publisher you trust in order to be loaded and executed. The Unrestricted option allows any script to be executed but for non-local scripts the user is prompted for an action. CNT 4603: Scripting – Windows PowerShell – Part 5 Page 2 Dr. Mark Llewellyn © Code Signing • In short code signing is the process of digitally signing scripts, executables, dynamic link libraries (DLLs), and so forth to establish a level of trust for the code. • The trust granted to digitally signed code is based on two assumptions. – One, a signed piece of code ensures that the code hasn’t been altered or corrupted since being signed. – Two, the digital signature serves to prove the identity of the code’s author, which helps you to determine whether the code is safe for execution.
    [Show full text]
  • Solution Brief Recovering from Ransomware with Barracuda Backup
    Solution Brief Recovering from Ransomware with Barracuda Backup Ransomware is a malware variant that locks an end user’s computer or encrypts their files, then demands a sum of money to allow access or decryption. What’s worse, if an organization hands over the cash, there are often times when the attacker doesn’t play nice and still withholds the key even after payment. Ransomware is problematic for businesses because it not only results in financial loss, but also tainted credibility and lost productivity. However, this situation can be avoided if your organization has taken the steps to implement a ransomware prevention plan. In this solution brief, we will discuss some of the steps you can take to prevent ransomware attacks, as well as how to quickly recover from them using Barracuda Backup. Introduction Due to the sophistication of today’s threat landscape, ransomware can be difficult to catch right at the door. Once this malicious malware crosses the threshold, a business user is hit by a daunting message, informing the user that their computer and files have been seized, and payment is required. What’s equally perturbing is that ransomware doesn’t discriminate—it can happen to the mom and pop shops to large enterprises. It’s not a matter of if a business will get hit, but when. Protecting Your Organization from Ransomware Attackers have created many different variations of ransomware over the past few years, such as CryptoLocker, CryptoWall, TorrentLocker, TeslaCrypt, Locky, Petya, WannaCry, Bad Rabbit, and Samas. Each of these variations use new methods of infecting their victims’ computers, thereby compromising the data and network of many organizations worldwide.
    [Show full text]
  • Certified Malware: Measuring Breaches of Trust in the Windows Code-Signing PKI
    Certified Malware: Measuring Breaches of Trust in the Windows Code-Signing PKI Doowon Kim Bum Jun Kwon Tudor Dumitras, University of Maryland University of Maryland University of Maryland College Park, MD College Park, MD College Park, MD [email protected] [email protected] [email protected] ABSTRACT To establish trust in third-party software, we currently rely on Digitally signed malware can bypass system protection mechanisms the code-signing Public Key Infrastructure (PKI). This infrastruc- that install or launch only programs with valid signatures. It can ture includes Certification Authorities (CAs) that issue certificates also evade anti-virus programs, which often forego scanning signed to software publishers, vouching for their identity. Publishers use binaries. Known from advanced threats such as Stuxnet and Flame, these certificates to sign the software they release, and users rely this type of abuse has not been measured systematically in the on these signatures to decide which software packages to trust broader malware landscape. In particular, the methods, effective- (rather than maintaining a list of trusted packages). If adversaries ness window, and security implications of code-signing PKI abuse can compromise code signing certificates, this has severe impli- are not well understood. We propose a threat model that highlights cations for end-host security. Signed malware can bypass system three types of weaknesses in the code-signing PKI. We overcome protection mechanisms that install or launch only programs with challenges specific to code-signing measurements by introducing valid signatures, and it can evade anti-virus programs, which often techniques for prioritizing the collection of code-signing certificates neglect to scan signed binaries.
    [Show full text]
  • Measuring Breaches of Trust in the Windows Code-Signing PKI
    Session F5: Understanding Security Fails CCS’17, October 30-November 3, 2017, Dallas, TX, USA Certified Malware: Measuring Breaches of Trust in the Windows Code-Signing PKI Doowon Kim Bum Jun Kwon Tudor Dumitras, University of Maryland University of Maryland University of Maryland College Park, MD College Park, MD College Park, MD [email protected] [email protected] [email protected] ABSTRACT To establish trust in third-party software, we currently rely on Digitally signed malware can bypass system protection mechanisms the code-signing Public Key Infrastructure (PKI). This infrastruc- that install or launch only programs with valid signatures. It can ture includes Certification Authorities (CAs) that issue certificates also evade anti-virus programs, which often forego scanning signed to software publishers, vouching for their identity. Publishers use binaries. Known from advanced threats such as Stuxnet and Flame, these certificates to sign the software they release, and users rely this type of abuse has not been measured systematically in the on these signatures to decide which software packages to trust broader malware landscape. In particular, the methods, effective- (rather than maintaining a list of trusted packages). If adversaries ness window, and security implications of code-signing PKI abuse can compromise code signing certificates, this has severe impli- are not well understood. We propose a threat model that highlights cations for end-host security. Signed malware can bypass system three types of weaknesses in the code-signing PKI. We overcome protection mechanisms that install or launch only programs with challenges specific to code-signing measurements by introducing valid signatures, and it can evade anti-virus programs, which often techniques for prioritizing the collection of code-signing certificates neglect to scan signed binaries.
    [Show full text]
  • Hypervisor-Based Active Data Protection for Integrity And
    The 13th Annual ADFSL Conference on Digital Forensics, Security and Law, 2018 HYPERVISOR-BASED ACTIVE DATA PROTECTION FOR INTEGRITY AND CONFIDENTIALITY OF DYNAMICALLY ALLOCATED MEMORY IN WINDOWS KERNEL Igor Korkin, PhD Security Researcher Moscow, Russia [email protected] ABSTRACT One of the main issues in the OS security is providing trusted code execution in an untrusted environment. During executing, kernel-mode drivers dynamically allocate memory to store and process their data: Windows core kernel structures, users’ private information, and sensitive data of third-party drivers. All this data can be tampered with by kernel-mode malware. Attacks on Windows-based computers can cause not just hiding a malware driver, process privilege escalation, and stealing private data but also failures of industrial CNC machines. Windows built-in security and existing approaches do not provide the integrity and confidentiality of the allocated memory of third-party drivers. The proposed hypervisor-based system (AllMemPro) protects allocated data from being modified or stolen. AllMemPro prevents access to even 1 byte of allocated data, adapts for newly allocated memory in real time, and protects the driver without its source code. AllMemPro works well on newest Windows 10 1709 x64. Keywords: hypervisor-based protection, Windows kernel, Intel, CNC security, rootkits, dynamic data protection. 1. INTRODUCTION The vulnerable VirtualBox driver (VBoxDrv.sys) Currently, protection of data in computer memory has been exploited by Turla rootkit and allows to is becoming essential. Growing integration of write arbitrary values to any kernel memory (Singh, ubiquitous Windows-based computers into 2015; Kirda, 2015). industrial automation makes this security issue critically important.
    [Show full text]
  • Code Signing Requirements 2015-11-19
    Draft of Final Forum Guideline Version 1.0 Draft of November 19, 2015 CA/Browser Forum Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates Copyright © 2015, The CA/Browser Forum, all rights reserved. Verbatim copying and distribution of this entire document is permitted in any medium without royalty, provided this notice is preserved. The CA/Browser Forum participants grant you a license to reproduce, distribute, make derivative works and display this entire document in any medium without royalty, provided this notice is preserved. If you make a translation of this document, we request that you prominently display the following statement in the language of the translation: “This document is a translation of the original English version. If a discrepancy arises between interpretations of this version and the original English version, the original English version governs.” i Draft of Final Forum Guideline Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates Version 1.0, as adopted by the CA/Browser Forum on nn aaa nnnn. These requirements describe an integrated set of technologies, protocols, identity-proofing, lifecycle management, and auditing requirements that are minimum standards for the issuance and management of Code-Signing Certificates that are trusted because their corresponding Root Certificate is distributed in widely-available application software. These Requirements are not mandatory for Certification Authorities unless and until they become adopted and enforced by an Application Software Supplier. Notice to Readers This version of the Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates presents criteria established by the CA/Browser Forum for use by Certification Authorities when issuing, maintaining, and revoking publicly-trusted Code Signing Certificates.
    [Show full text]
  • Detecting Malware in TLS Traffic
    IMPERIAL COLLEGE LONDON DEPARTMENT OF COMPUTING Detecting Malware in TLS Traffic Project Report Supervisor: Author: Sergio Maffeis Olivier Roques Co-Supervisor: Marco Cova Submitted in partial fulfillment of the requirements for the MSc degree in Computing Science / Security and Reliability of Imperial College London September 2019 Abstract The use of encryption on the Internet has spread rapidly these last years, a trend encouraged by the growing concerns about online privacy. TLS (Transport Layer Security), the standard protocol for packet encryption, is now implemented by every major websites to protect users’ messages, transactions and credentials. However cybercriminals have started to incorporate TLS into their activities. An increasing number of malware leverage TLS encryption to hide their communications and to exfiltrate data to their command server, effectively bypassing traditional detection platforms. The goal of this project is to design and implement an effective alternative to the unpractical method of decrypting TLS packets’ payload before looking for signs of malware activity. This work presents a highly accurate supervised classifier that can detect malicious TLS flows in a company’s network traffic based on a set of features related to TLS, certificates and flow metadata. The classifier was trained on curated datasets of benign and malware observations, which were extracted from capture files thanks to a set of tools specially developed for this purpose. We detail in this report the complete development process, from data collection and feature extraction to model selection and performance analysis. ii Acknowledgments I would like to particularly thank Marco Cova and Sergio Maffeis, my project su- pervisors, for their valuable and continuous suggestions and for their constructive feedbacks on this project.
    [Show full text]
  • Kernel Integrity Analysis
    Project CS2 AAVR Kernel Integrity Analysis Major Qualifying Project Submitted to the Faculty of Worcester Polytechnic Institute in partial fulfillment of the requirements for the Degree in Bachelor of Science in Computer Science By Caleb Stepanian [email protected] Submitted On: October 27, 2015 Project Advisor: Professor Craig Shue [email protected] This report represents work of WPI undergraduate students submitted to the faculty as evidence of a degree requirement. WPI routinely publishes these reports on its web site without editorial or peer review. For more information about the projects program at WPI, see http: // www. wpi. edu/ Academics/ Projects . Abstract Rootkits are dangerous and hard to detect. A rootkit is malware specifically de- signed to be stealthy and maintain control of a computer without alerting users or administrators. Existing detection mechanisms are insufficient to reliably detect rootkits, due to fundamental problems with the way they do detection. To gain control of an operating system kernel, a rootkit edits certain parts of the kernel data structures to route execution to its code or to hide files that it has placed on the file system. Each of the existing detector tools only monitors a subset of those data structures. This MQP has two major contributions. The first contribution is a Red Team analysis of WinKIM, a rootkit detection tool. The analysis shows my attempts to find flaws in WinKIM's ability to detect rootkits. WinKIM monitors a particular set of Windows data structures; I attempt to show that this set is insufficient to detect all possible rootkits. The second is the enumeration of data structures in the Windows kernel which can possibly be targeted by a rootkit.
    [Show full text]