|
||||||||||||||||||||
|
||||||||||||||||||||
|
||||||||||||||||||||
Rootkits: Subverting the Windows Kernel
und über 1 Million weitere Bücher verfügbar für Amazon Kindle .
Erfahren Sie mehr
| |||||||||||||||
 Gutschein erhalten
Tauschen Sie jetzt Rootkits: Subverting the Windows Kernel (Addison-Wesley Software Security) gegen einen Amazon-Gutschein in Höhe von EUR 4,45 ein - einlösbar für Tausende von Artikeln bei Amazon.de. Entdecken Sie mehr eintauschbare Bücher im Bücher Trade-In Shop. Bitte beachten Sie die Teilnahmebedingungen.
 Jetzt für Amazon Student anmelden und um 20% erhöhten Eintauschwert sichern. |
Wird oft zusammen gekauft
Produktinformation
Möchten Sie die Produktinformationen aktualisieren oder Feedback zu den Produktabbildungen geben?
Ist der Verkauf dieses Produkts für Sie nicht akzeptabel? |
Mehr über die Autoren
Entdecken Sie Bücher, lesen Sie über Autoren und mehr
Produktbeschreibungen
Kurzbeschreibung
"It's imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits." --Mark Russinovich, editor, Windows IT Pro / Windows & .NET Magazine "This material is not only up-to-date, it defines up-to-date. It is truly cutting-edge. As the only book on the subject, Rootkits will be of interest to any Windows security researcher or security programmer. It's detailed, well researched and the technical information is excellent. The level of technical detail, research, and time invested in developing relevant examples is impressive. In one word: Outstanding." --Tony Bautts, Security Consultant; CEO, Xtivix, Inc. "This book is an essential read for anyone responsible for Windows security. Security professionals, Windows system administrators, and programmers in general will want to understand the techniques used by rootkit authors. At a time when many IT and security professionals are still worrying about the latest e-mail virus or how to get all of this month's security patches installed, Mr. Hoglund and Mr. Butler open your eyes to some of the most stealthy and significant threats to the Windows operating system. Only by understanding these offensive techniques can you properly defend the networks and systems for which you are responsible." --Jennifer Kolde, Security Consultant, Author, and Instructor "What's worse than being owned? Not knowing it. Find out what it means to be owned by reading Hoglund and Butler's first-of-a-kind book on rootkits. At the apex the malicious hacker toolset--which includes decompilers, disassemblers, fault-injection engines, kernel debuggers, payload collections, coverage tools, and flow analysis tools--is the rootkit. Beginning where Exploiting Software left off, this book shows how attackers hide in plain sight. "Rootkits are extremely powerful and are the next wave of attack technology. Like other types of malicious code, rootkits thrive on stealthiness. They hide away from standard system observers, employing hooks, trampolines, and patches to get their work done. Sophisticated rootkits run in such a way that other programs that usually monitor machine behavior can't easily detect them. A rootkit thus provides insider access only to people who know that it is running and available to accept commands. Kernel rootkits can hide files and running processes to provide a backdoor into the target machine. "Understanding the ultimate attacker's tool provides an important motivator for those of us trying to defend systems. No authors are better suited to give you a detailed hands-on understanding of rootkits than Hoglund and Butler. Better to own this book than to be owned." --Gary McGraw, Ph.D., CTO, Cigital, coauthor of Exploiting Software (2004) and Building Secure Software (2002), both from Addison-Wesley "Greg and Jamie are unquestionably the go-to experts when it comes to subverting the Windows API and creating rootkits. These two masters come together to pierce the veil of mystery surrounding rootkits, bringing this information out of the shadows. Anyone even remotely interested in security for Windows systems, including forensic analysis, should include this book very high on their must-read list." --Harlan Carvey, author of Windows Forensics and Incident Recovery (Addison-Wesley, 2005) Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them. Rootkit.com's Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology--learn how attackers can get in and stay in for years, without detection. Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. They teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers. After reading this book, readers will be able to * Understand the role of rootkits in remote command/control and software eavesdropping * Build kernel rootkits that can make processes, files, and directories invisible * Master key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objects * Work with layered drivers to implement keyboard sniffers and file filters * Detect rootkits and build host-based intrusion prevention software that resists rootkit attacks
Synopsis
"It's imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits." --Mark Russinovich, editor, Windows IT Pro / Windows & .NET Magazine "This material is not only up-to-date, it defines up-to-date. It is truly cutting-edge. As the only book on the subject, Rootkits will be of interest to any Windows security researcher or security programmer. It's detailed, well researched and the technical information is excellent. The level of technical detail, research, and time invested in developing relevant examples is impressive. In one word: Outstanding." --Tony Bautts, Security Consultant; CEO, Xtivix, Inc. "This book is an essential read for anyone responsible for Windows security. Security professionals, Windows system administrators, and programmers in general will want to understand the techniques used by rootkit authors. At a time when many IT and security professionals are still worrying about the latest e-mail virus or how to get all of this month's security patches installed, Mr. Hoglund and Mr.Butler open your eyes to some of the most stealthy and significant threats to the Windows operating system.Only by understanding these offensive techniques can you properly defend the networks and systems for which you are responsible." --Jennifer Kolde, Security Consultant, Author, and Instructor "What's worse than being owned? Not knowing it. Find out what it means to be owned by reading Hoglund and Butler's first-of-a-kind book on rootkits. At the apex the malicious hacker toolset--which includes decompilers, disassemblers, fault-injection engines, kernel debuggers, payload collections, coverage tools, and flow analysis tools--is the rootkit. Beginning where Exploiting Software left off, this book shows how attackers hide in plain sight. "Rootkits are extremely powerful and are the next wave of attack technology. Like other types of malicious code, rootkits thrive on stealthiness. They hide away from standard system observers, employing hooks, trampolines, and patches to get their work done. Sophisticated rootkits run in such a way that other programs that usually monitor machine behavior can't easily detect them.A rootkit thus provides insider access only to people who know that it is running and available to accept commands.Kernel rootkits can hide files and running processes to provide a backdoor into the target machine. "Understanding the ultimate attacker's tool provides an important motivator for those of us trying to defend systems. No authors are better suited to give you a detailed hands-on understanding of rootkits than Hoglund and Butler. Better to own this book than to be owned." --Gary McGraw, Ph.D., CTO, Cigital, coauthor of Exploiting Software (2004) and Building Secure Software (2002), both from Addison-Wesley "Greg and Jamie are unquestionably the go-to experts when it comes to subverting the Windows API and creating rootkits. These two masters come together to pierce the veil of mystery surrounding rootkits, bringing this information out of the shadows. Anyone even remotely interested in security for Windows systems, including forensic analysis, should include this book very high on their must-read list." --Harlan Carvey, author of Windows Forensics and Incident Recovery (Addison-Wesley, 2005) Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit.Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them. Rootkit.com's Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology--learn how attackers can get in and stay in for years, without detection. Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. Using extensive downloadable examples, they teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers.After reading this book, readers will be able to *Understand the role of rootkits in remote command/control and software eavesdropping *Build kernel rootkits that can make processes, files, and directories invisible *Master key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objects *Work with layered drivers to implement keyboard sniffers and file filters *Detect rootkits and build host-based intrusion prevention software that resists rootkit attacks Visit rootkit.com for code and programs from this book. The site also contains enhancements to the book's text, such as up-to-the-minute information on rootkits available nowhere else.
Welche anderen Artikel kaufen Kunden, nachdem sie diesen Artikel angesehen haben?
Tags, die Kunden mit diesem Produkt verbinden(Was ist das?)Klicken Sie zum Suchen verwandter Artikel, Diskussionen oder Personen auf ein Tag.
|
Kundenrezensionen
Die hilfreichsten Kundenrezensionen
1 von 1 Kunden fanden die folgende Rezension hilfreich
Format:Taschenbuch
Man braucht kein Hacker zu sein, um aus diesem Buch Nutzen zu ziehen. Zum einen ist ein Verständnis der Angriffstechniken auch für diejenigen interessant, die sich schützen oder sichere Produkte entwickeln möchten. Zum anderen habe ich selten ein Buch gelesen, in dem die Funktionsweise von Internals der MS-Betriebssysteme so gut erklärt worden wären. Das Buch kann also z.B. auch für Entwickler von (ganz legalen) Devicetreibern eine große Hilfe sein.
Format:Taschenbuch
Wenn es um das Thema Rootkits geht, kommt man an diesem Werk nicht vorbei.
Die Beispiele im Buch sind jedoch für absolute Programmierneulinge unbrauchbar.
Es geht zwar nicht zu sehr in die Tiefe, aber man sollte mehr als nur vages
Vorwissen mitbringen, um hier den größten Nutzen für sich zu ziehen!
Die Beispiele im Buch sind jedoch für absolute Programmierneulinge unbrauchbar.
Es geht zwar nicht zu sehr in die Tiefe, aber man sollte mehr als nur vages
Vorwissen mitbringen, um hier den größten Nutzen für sich zu ziehen!
Die hilfreichsten Kundenrezensionen auf Amazon.com (beta)
Amazon.com:
22 Rezensionen
52 von 53 Kunden fanden die folgende Rezension hilfreich
be an elite hacker d00d!
20. August 2005
Format:Taschenbuch
Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.
The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.
The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).
By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.
In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.
I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.
In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up rootkit.com, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.
My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.
Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.
The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.
The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).
By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.
In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.
I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.
In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up rootkit.com, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.
My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.
Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.
49 von 55 Kunden fanden die folgende Rezension hilfreich
Best security book I have read this year
16. August 2005
Format:Taschenbuch
Technical books tend to be either "about things" or "how to do things" with how to being far rarer and generally more valuable. Hoglund and Butler are true authorities on this subject and yet they never brag, instead they focus on helping the rest of us understand what is possible and exactly how it can be done.
Once again, the Addison-Wesley team demonstrates excellence, I found a couple of sentences that could benefit from a rewrite, but no grammar or spelling errors. The charts and code examples are done well and the layout never detracts from the message.
I enjoyed learning about the VICE, patchfinder 2 and Rootkit Revealer tools and can't wait to run them on some of the older laptops in the company that have been used as loaners. I expect that will be revealing!
This was the clearest explanation I have ever seen as to how networking is managed using the Transport Data Inferface. Even so, it still left me just a bit "hungry" and I hope this section is expanded in the second edition of this book.
What impressed me the most though was when the authors reached the limits of their knowledge, after all, this is a developing art and no one understands everything, with areas such as microcode update they simply and frankly stated that.
Clear, pragmatic, authoritative, what's not to like, buy this book.
Once again, the Addison-Wesley team demonstrates excellence, I found a couple of sentences that could benefit from a rewrite, but no grammar or spelling errors. The charts and code examples are done well and the layout never detracts from the message.
I enjoyed learning about the VICE, patchfinder 2 and Rootkit Revealer tools and can't wait to run them on some of the older laptops in the company that have been used as loaners. I expect that will be revealing!
This was the clearest explanation I have ever seen as to how networking is managed using the Transport Data Inferface. Even so, it still left me just a bit "hungry" and I hope this section is expanded in the second edition of this book.
What impressed me the most though was when the authors reached the limits of their knowledge, after all, this is a developing art and no one understands everything, with areas such as microcode update they simply and frankly stated that.
Clear, pragmatic, authoritative, what's not to like, buy this book.
19 von 20 Kunden fanden die folgende Rezension hilfreich
A must for those desiring knowledge on the "Mother of all Malware"!
2. Oktober 2005
Format:Taschenbuch
A brilliantly written book on everything one would want to know about Rootkits in the Microsoft Windows world. Greg is the industry expert who shares his knowledge through many examples and illustrations that would help almost any level of reader grasp a better understanding of Rootkits.
The authors start with `Understanding Attackers' Motives' and what Rootkits are and aren't, and work they way through Rootkit designs, hardware interaction, hooking into kernel and user, `Direct Kernel Object Manipulation', `Hardware Manipulation', covert techniques and ways to identify Rootkits on your systems.
The authors in-depth knowledge of Rootkits is clearly demonstrated early on when they walk through creating a loadable module, or device/kernel driver. Through this process, they take the time to explain each line, how it manipulates the system, and how it could be used maliciously.
Throughout most of the book, the authors give very detailed examples, lines of code and other evidence supporting the theories and processes presented here. The book is written in a way that they leave little to the imagination and provide hard evidence to support the thought.
The book ends with Rootkit detection, which is the only way to end a book on malicious software. Now that they have taught one how to manipulate and hijack system, here is what one can do to protect the systems they are responsible for, and identify these malicious codes on ones systems. They describe scanning memory, identifying different types of hooks, and again provide some code for one to use to help with these processes.
After reading this book, not only will one have the understanding of Rootkits are and how they can be used, one will have enough knowledge to create their own Rootkits, understand key programming techniques such as runtime patching, hooking into the kernel, and remote command and control.
I highly recommend this book as the Rootkit is the `Mother of all Malicious Code'. Once an attacker has successfully installed a Rootkit on one's system, the game is over.
The authors start with `Understanding Attackers' Motives' and what Rootkits are and aren't, and work they way through Rootkit designs, hardware interaction, hooking into kernel and user, `Direct Kernel Object Manipulation', `Hardware Manipulation', covert techniques and ways to identify Rootkits on your systems.
The authors in-depth knowledge of Rootkits is clearly demonstrated early on when they walk through creating a loadable module, or device/kernel driver. Through this process, they take the time to explain each line, how it manipulates the system, and how it could be used maliciously.
Throughout most of the book, the authors give very detailed examples, lines of code and other evidence supporting the theories and processes presented here. The book is written in a way that they leave little to the imagination and provide hard evidence to support the thought.
The book ends with Rootkit detection, which is the only way to end a book on malicious software. Now that they have taught one how to manipulate and hijack system, here is what one can do to protect the systems they are responsible for, and identify these malicious codes on ones systems. They describe scanning memory, identifying different types of hooks, and again provide some code for one to use to help with these processes.
After reading this book, not only will one have the understanding of Rootkits are and how they can be used, one will have enough knowledge to create their own Rootkits, understand key programming techniques such as runtime patching, hooking into the kernel, and remote command and control.
I highly recommend this book as the Rootkit is the `Mother of all Malicious Code'. Once an attacker has successfully installed a Rootkit on one's system, the game is over.
Waren diese Rezensionen hilfreich?
Wir wollen von Ihnen hören.
Kunden diskutieren
|
Das Forum zu diesem Produkt
Fragen stellen, Meinungen austauschen, Einblicke gewinnen Aktive Diskussionen in ähnlichen Foren
Kundendiskussionen durchsuchen
|
Ähnliche Foren
|
||||||||||||||||||||||||||||||||||
Lieblingslisten
Ähnliche Artikel finden
Anhand des Sachgebietes nach ähnlichen Produkten suchen:
Ihr Kommentar
Möchten Sie die Produktinformationen aktualisieren oder Feedback zu den Produktabbildungen geben?
|
