BKROOTKT.RVW 20051023 "Rootkits", Greg Hoglund/James Butler, 2006, 0-321-29431-9, U$44.99/C$62.99 %A Greg Hoglund %A James Butler %C P.O. Box 520, 26 Prince Andrew Place, Don Mills, Ontario M3C 2T8 %D 2006 %G 0-321-29431-9 %I Addison-Wesley Publishing Co. %O U$44.99/C$62.99 416-447-5101 fax: 416-443-0948 [EMAIL PROTECTED] %O http://www.amazon.com/exec/obidos/ASIN/0321294319/robsladesinterne http://www.amazon.co.uk/exec/obidos/ASIN/0321294319/robsladesinte-21 %O http://www.amazon.ca/exec/obidos/ASIN/0321294319/robsladesin03-20 %O Audience s+ Tech 3 Writing 2 (see revfaq.htm for explanation) %P 324 p. %T "Rootkits: Subverting the Windows Kernel"
The preface (and therefore the book) begins with a definition of a rootkit. The authors proceed to outline their initial interest in the phenomenon, and any security professional who understands the centrality of system internals can begin to see the importance of the work. Chapter one addresses a major selling point (in the blackhat mindset) for rootkits: the evasion of detection. Concentrating on this aspect, the material outlines what a rootkit is, and is not, noting also that the programs need not be limited to illegal activities but do have legitimate uses. Subversion of the core of the operating system is examined in chapter two, although this is limited to the creation of device drivers. (This chapter again raises the issue of whether a book investigating the breaking of a system can provide valuable advice when it comes to protecting computers. While some works do; Hoglund, along with Gary McGraw, having created an example in "Exploiting Software" [cf. BKEXPLSW.RVW]; this particular material concentrates on items of interest in the process of producing rootkits. The limited sections dealing with more theoretical considerations would be those of greater interest to the security community.) Chapter three explores some hardware related items, although there are others that could be perused, and most of those surveyed may be initiated in hardware, but operate primarily in the software realm. Hooking of interrupts and functions is covered in chapter four, at both a kernel and user level. Chapter five reviews various means of directly patching software. (Much of this material should be familiar for those who have studied operations of older viruses.) The interception techniques addressed in chapter four are extended, in chapter six, to include adding new "layers" to existing device drivers. The operating system kernel uses data and other resources in order to perform properly, and chapter seven shows that manipulating these objects can modify the actions of the machine. Although nominally about hardware, chapter eight really concentrates on the patching of firmware. Chapter nine examines covert channels, but the explanation is quite poor, and most of the space is dedicated to listings of program code. Rootkit detection is discussed in chapter ten. It is interesting to note that analogies of antiviral change detection and activity monitoring are mentioned, but there is no consideration of signature scanning. "Rootkits" does raise a number of interesting topics, and much of the material could be of use to those charged with protecting systems. However, the content is not as valuable as that presented in "Exploiting Software." There is, of course, much that will be of assistance for those writing legitimate rootkits, but this would be a fairly limited audience. copyright Robert M. Slade, 2005 BKROOTKT.RVW 20051023 ====================== (quote inserted randomly by Pegasus Mailer) [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] Skill without imagination is craftsmanship and gives us many useful objects such as wickerwork picnic baskets. Imagination without skill gives us modern art. - Tom Stoppard http://victoria.tc.ca/techrev or http://sun.soci.niu.edu/~rslade
