The Ethical Hacker Network - Boot Sector Rootkits

Latest Additions

Who's Online

EH-Net > Ethical Hacking Discussions and Related Certifications > Malware (Moderator: don) > Boot Sector Rootkits

Pages: [1] Go Down

« previous next »

	Author	Topic: Boot Sector Rootkits (Read 3211 times)
0 Members and 1 Guest are viewing this topic.

satyr

Newbie

Offline

Posts: 41

Boot Sector Rootkits

« on: February 12, 2012, 12:55:27 PM »

hi,

I wanted to look more into rootkits, specially kernel mode rootkits which affect the boot sector.

Please suggest resources for me to understand and learn so that I am able to analyse these malwares.

I want to dig deep into rootkits and understand how to analyze them.

Any help appreciated.


	Logged

ajohnson

Recruiters
Hero Member

Offline

Posts: 1057

aka dynamik

Re: Boot Sector Rootkits

« Reply #1 on: February 13, 2012, 09:02:20 AM »

I haven't done much in this area, but http://www.amazon.com/Rootkits-Subverting-Windows-Greg-Hoglund/dp/0321294319/ref=sr_1_2?ie=UTF8&qid=1329145052&sr=8-2 was a decent introductory read. It's from 2005 and is probably dated now, but Syngress has a couple of others that seem like they would be of interest to you: http://www.amazon.com/Managed-Code-Rootkits-Hooking-Environments/dp/1597495743/ref=sr_1_3?ie=UTF8&qid=1329145052&sr=8-3

http://www.amazon.com/Guide-Kernel-Exploitation-Attacking-Core/dp/1597494860/ref=sr_1_12?ie=UTF8&qid=1329145052&sr=8-12

rootkit.com used to be a good resource as well, but it's not loading at the moment for me. I'm not sure if that's still around or not.


	Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.

lorddicranius

Sr. Member

Offline

Posts: 447

Re: Boot Sector Rootkits

« Reply #2 on: February 13, 2012, 10:30:16 AM »

Wasn't rootkit.com Haugland's site that was involved with the whole Anonymous/HBGary Federal ordeal? Was it ever brought back up after that breach?


	Logged

GSEC, eCPPT, Sec+

ajohnson

Recruiters
Hero Member

Offline

Posts: 1057

aka dynamik

Re: Boot Sector Rootkits

« Reply #3 on: February 13, 2012, 10:34:15 AM »

Quote from: lorddicranius on February 13, 2012, 10:30:16 AM

Wasn't rootkit.com Haugland's site that was involved with the whole Anonymous/HBGary Federal ordeal? Was it ever brought back up after that breach?

Yea, that's correct. He's also the co-author of the first book I recommended.

I never participated there, so aside from hearing about that ordeal, I really don't know if it was ever brought back up. It very well may not have been.


	Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.

Eleven

Full Member

Offline

Posts: 120

Re: Boot Sector Rootkits

« Reply #4 on: February 14, 2012, 10:36:59 AM »

Here is a nice analysis of the TDL4 rootkit. http://resources.infosecinstitute.com/tdss4-part-1/

The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System Second edition will be out March 7.