Though rootkits have a fairly negative image, they can be used for both good and evil. "Designing BSD Rootkits" arms you with the knowledge you need to write offensive rootkits, to defend against malicious ones, and to explore the FreeBSD kernel and operating system in the process. Organized as a tutorial, "Designing BSD Rootkits" will teach you the fundamentals of programming and developing rootkits under the FreeBSD operating system. Author Joseph Kong`s goal is to make you smarter, not to teach you how to write exploits or launch attacks. You`ll learn how to maintain root access long after gaining access to a computer, and how to hack FreeBSD. Kong`s liberal use of examples assumes no prior kernel-hacking experience but doesn`t water down the information. All code is thoroughly described and analyzed, and each chapter contains at least one real-world application.
Designing BSD Rootkits: An Introduction to Kernel Hacking
und über 1,5 Millionen weitere Bücher verfügbar für Amazon Kindle. Erfahren Sie mehr
| |||||||||||||||
Kurzbeschreibung
Wird oft zusammen gekauft
Produktinformation
Möchten Sie die Produktinformationen aktualisieren oder Feedback zu den Produktabbildungen geben?
Ist der Verkauf dieses Produkts für Sie nicht akzeptabel? |
Mehr über die Autoren
Entdecken Sie Bücher, lesen Sie über Autoren und mehr
Produktbeschreibungen
Synopsis
Though rootkits have a fairly negative image, they can be used for both good and evil. Designing BSD Rootkits arms you with the knowledge you need to write offensive rootkits, to defend against malicious ones, and to explore the FreeBSD kernel and operating system in the process. Organized as a tutorial, Designing BSD Rootkits will teach you the fundamentals of programming and developing rootkits under the FreeBSD operating system. Author Joseph Kong's goal is to make you smarter, not to teach you how to write exploits or launch attacks. You'll learn how to maintain root access long after gaining access to a computer and how to hack FreeBSD. Kongs liberal use of examples assumes no prior kernel-hacking experience but doesn't water down the information. All code is thoroughly described and analyzed, and each chapter contains at least one real-world application.Included: The fundamentals of FreeBSD kernel module programming Using call hooking to subvert the FreeBSD kernel Directly manipulating the objects the kernel depends upon for its internal record-keeping Patching kernel code resident in main memory; in other words, altering the kernel's logic while it's still running How to defend against the attacks described Hack the FreeBSD kernel for yourself!
Über den Autor
Tinkering with computers has always been a primary passion of author Joseph Kong. He is a self-taught programmer who dabbles in information security, operating system theory, reverse engineering, and vulnerability assessment. He has written for Phrack Magazine and was a system administrator for the City of Toronto.
Welche anderen Artikel kaufen Kunden, nachdem sie diesen Artikel angesehen haben?
In diesem Buch
(Mehr dazu)
Buchdeckel | Copyright | Inhaltsverzeichnis | Auszug | Stichwortverzeichnis | Rückseite
Mehr entdecken
Wortanzeiger
Ausgewählte Seiten ansehenWortanzeiger
Buchdeckel | Copyright | Inhaltsverzeichnis | Auszug | Stichwortverzeichnis | Rückseite
Kundenrezensionen
Es gibt noch keine Kundenrezensionen auf Amazon.de
5 Sterne
4 Sterne
3 Sterne
2 Sterne
1 Sterne
Die hilfreichsten Kundenrezensionen auf Amazon.com (beta)
Amazon.com:
4.5 von 5 Sternen
4 Rezensionen
10 von 10 Kunden fanden die folgende Rezension hilfreich
5.0 von 5 Sternen
Concise, informative, powerful -- a real winner
23. Juni 2007
Von Richard Bejtlich
- Veröffentlicht auf Amazon.com
Format:Taschenbuch
I loved Designing BSD Rootkits (DBR) by Joseph Kong, and I'm not even a kernel hacker. Rather, I'm an incident responder and FreeBSD administrator. This book is directly on target and does not waste the reader's time. If you understand C and want to learn how to manipulate the FreeBSD kernel, Designing BSD Rootkits is for you. Peer into the depths of a powerful operating system and bend it to your will!
DBR covers much of the same sorts of material found in the earlier Rootkits: Subverting the Windows Kernel by Greg Hoglund and James Butler, except Kong's book is all about FreeBSD. I actually read the Windows text first, but found Kong's more direct language and examples easier than the Hoglund/Butler text. After reading DBR I have a stronger understanding of each of the main chapters' techniques, i.e., kernel modules, hooking, direct kernel object manipulation, kernel object hooking, run-time kernel memory patching, and detection mechanisms. I particularly liked the author showing his sample rootkit's effectiveness against Tripwire, simply to demonstrate his methods.
DBR follows another tenet of great books: it credits previous work. Several times in the text Kong says where he learned a technique or what code he's modifying to do his bidding. This should serve as an example to other technical authors. Kong also does not treat his subject matter as a dark art practiced by people in long black coats at Def Con. He is professional and mentions where certain techniques like run-time kernel memory patching are used by commercial operating systems for "hot patching," as happens with Windows.
I have nothing bad to say about this book, although to get the absolute full learning experience it helps to know C programming, some assembly, and FreeBSD kernel internals. The Design and Implementation of the FreeBSD Operating System by McKusick and Neville-Neil (another excellent book) is helpful preparatory reading. The fact that Kong provided all of his source code for download is also very much appreciated. Bravo! I look forward to your next book.
DBR covers much of the same sorts of material found in the earlier Rootkits: Subverting the Windows Kernel by Greg Hoglund and James Butler, except Kong's book is all about FreeBSD. I actually read the Windows text first, but found Kong's more direct language and examples easier than the Hoglund/Butler text. After reading DBR I have a stronger understanding of each of the main chapters' techniques, i.e., kernel modules, hooking, direct kernel object manipulation, kernel object hooking, run-time kernel memory patching, and detection mechanisms. I particularly liked the author showing his sample rootkit's effectiveness against Tripwire, simply to demonstrate his methods.
DBR follows another tenet of great books: it credits previous work. Several times in the text Kong says where he learned a technique or what code he's modifying to do his bidding. This should serve as an example to other technical authors. Kong also does not treat his subject matter as a dark art practiced by people in long black coats at Def Con. He is professional and mentions where certain techniques like run-time kernel memory patching are used by commercial operating systems for "hot patching," as happens with Windows.
I have nothing bad to say about this book, although to get the absolute full learning experience it helps to know C programming, some assembly, and FreeBSD kernel internals. The Design and Implementation of the FreeBSD Operating System by McKusick and Neville-Neil (another excellent book) is helpful preparatory reading. The fact that Kong provided all of his source code for download is also very much appreciated. Bravo! I look forward to your next book.
5 von 5 Kunden fanden die folgende Rezension hilfreich
4.0 von 5 Sternen
Enjoyable primer on system kernel penetration
30. Mai 2007
Von Nils Valentin
- Veröffentlicht auf Amazon.com
Format:Taschenbuch
--- DISCLAIMER: This is a requested review by No Starch Press, however any opinions expressed within the review are my personal ones. ---
This enjoyable readable book gradually and very systematically evolves around hacking the kernel of a BSD system.
Chapter 1: Loadable Kernel Modules 22p.
Chapter 2: Hooking 13p.
Chapter 3: Direct Kernel Object Manipulation 20p.
Chapter 4: Kernel Object Hooking 4p.
Chapter 5: Run-Time Kernel Memory Patching 27p.
Chapter 6: Putting It All Together 26p.
Chapter 7: Detection 8p.
Its written in a style that allows also non-developers to grasp the main procedures and steps involved for modifying a systems kernel (assuming the attacker got access to a privileged system account).
Chapters 1 to 5 explain the several methods for modifying the kernel.
While the book is divided into 7 chapters, its most value really is the Chapters 6 which has many of those WoW effects included.
All or most technics described of chapters 1-5 will be used in chapter 6 for show casing how to circumvent an HIDS. Here is where all learned technics finally come all together.
So the reader dabbles with the author from an initial "simple" idea of bypassing an HIDS from one issue to the next. First the system call is hooked, so technically its kind of working, but then we realize that in order to make it perfect we need to hide the just created file (which contains the execution redirection routine). So the next obvious step is to hide the file so we dont leave a footprint on the system, just to realize that we need to hide the KLD (Dynamic Kernel Linker). So now everything is hidden but we forgot about the change of the /sbin directories access/ modification and change time, so we have to go after that too...
Its technically very interesting to learn how the author approaches the issues involved in order to avoid being detected by the HIDS or commands the user might use. That the author is technically on top of things is also shown f.e. by some info included in the book which is already referring to FreeBSD 7.
To get the most out of the book you ideally have programming knowledge of C, assembly etc. and debugging software systems. So I think its most valuable to system administrators, developers and security consultants.
This enjoyable readable book gradually and very systematically evolves around hacking the kernel of a BSD system.
Chapter 1: Loadable Kernel Modules 22p.
Chapter 2: Hooking 13p.
Chapter 3: Direct Kernel Object Manipulation 20p.
Chapter 4: Kernel Object Hooking 4p.
Chapter 5: Run-Time Kernel Memory Patching 27p.
Chapter 6: Putting It All Together 26p.
Chapter 7: Detection 8p.
Its written in a style that allows also non-developers to grasp the main procedures and steps involved for modifying a systems kernel (assuming the attacker got access to a privileged system account).
Chapters 1 to 5 explain the several methods for modifying the kernel.
While the book is divided into 7 chapters, its most value really is the Chapters 6 which has many of those WoW effects included.
All or most technics described of chapters 1-5 will be used in chapter 6 for show casing how to circumvent an HIDS. Here is where all learned technics finally come all together.
So the reader dabbles with the author from an initial "simple" idea of bypassing an HIDS from one issue to the next. First the system call is hooked, so technically its kind of working, but then we realize that in order to make it perfect we need to hide the just created file (which contains the execution redirection routine). So the next obvious step is to hide the file so we dont leave a footprint on the system, just to realize that we need to hide the KLD (Dynamic Kernel Linker). So now everything is hidden but we forgot about the change of the /sbin directories access/ modification and change time, so we have to go after that too...
Its technically very interesting to learn how the author approaches the issues involved in order to avoid being detected by the HIDS or commands the user might use. That the author is technically on top of things is also shown f.e. by some info included in the book which is already referring to FreeBSD 7.
To get the most out of the book you ideally have programming knowledge of C, assembly etc. and debugging software systems. So I think its most valuable to system administrators, developers and security consultants.
1 von 3 Kunden fanden die folgende Rezension hilfreich
5.0 von 5 Sternen
A perfect programmer's guide.
8. Juli 2007
Von Midwest Book Review
- Veröffentlicht auf Amazon.com
Format:Taschenbuch
Collections strong in web design and programmer's guides know that rootkits have a negative image - but DESIGNING BSD ROOTKITS provides all the information on how to overcome any bad image and problems to develop effective rootkits under the FreeBSD operating system. This instructional is actually a tutorial, so it may also be used in programming classes: it explains how to maintain root access and how to hack Free BSD, using many examples which assume no prior kernel-hacking knowledge. Code is described, analyzed, and linked to real-world scenarios for maximum understanding, making for a perfect programmer's guide.
›
Gehen Sie zu Amazon.com, um alle 4 Rezensionen zu sehen
4.5 von 5 Sternen
Waren diese Rezensionen hilfreich?
Wir wollen von Ihnen hören.
Kunden diskutieren
|
Das Forum zu diesem Produkt
Fragen stellen, Meinungen austauschen, Einblicke gewinnen Aktive Diskussionen in ähnlichen Foren
Kundendiskussionen durchsuchen
|
Ähnliche Foren
|
||||||||||||||||||||||||||||||||||
Lieblingslisten
Ähnliche Artikel finden
Ihr Kommentar
Möchten Sie die Produktinformationen aktualisieren oder Feedback zu den Produktabbildungen geben?
|
