{"id":1736,"date":"2015-03-02T19:08:38","date_gmt":"2015-03-02T18:08:38","guid":{"rendered":"https:\/\/yt.christiaan008.com\/?post_type=project&p=1736"},"modified":"2016-10-12T17:50:20","modified_gmt":"2016-10-12T16:50:20","slug":"rootkits-what-they-are-and-how-to-find-them","status":"publish","type":"project","link":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them","title":{"rendered":"Rootkits: What they are, and how to find them"},"content":{"rendered":"

[et_pb_section admin_label=”Section” fullwidth=”on” specialty=”off” transparent_background=”off” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” custom_padding=”||0px|” gutter_width=”3″][et_pb_fullwidth_header admin_label=”Fullwidth Header” title=”ROOTKITS” background_layout=”dark” text_orientation=”center” header_fullscreen=”on” header_scroll_down=”on” scroll_down_icon=”%%4%%” background_url=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/03\/rootkit2_high.jpg” background_overlay_color=”rgba(0,0,0,0.3)” parallax=”off” parallax_method=”off” content_orientation=”center” image_orientation=”center” title_font=”Arimo|||on|” title_font_size=”46″ subhead_font_size=”24px” custom_button_one=”off” button_one_use_icon=”default” button_one_icon_placement=”right” button_one_on_hover=”on” custom_button_two=”off” button_two_use_icon=”default” button_two_icon_placement=”right” button_two_on_hover=”on” background_color=”rgba(0,0,0,0)” content_font_size=”16″ subhead=”What they are, and how to find them”]<\/p>\n

[\/et_pb_fullwidth_header][\/et_pb_section][et_pb_section admin_label=”Section” fullwidth=”off” specialty=”off” transparent_background=”off” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”on” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” custom_padding=”3%|0px|2%|0px” background_color=”#ffffff”][et_pb_row admin_label=”Row” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” use_custom_gutter=”off” padding_mobile=”off” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”off” parallax_1=”off” parallax_method_1=”off” column_padding_mobile=”on” custom_margin=”||0%|” custom_padding=”0px|0px|0px|0px”][et_pb_column type=”4_4″][et_pb_text admin_label=”Photo credit” background_layout=”light” text_orientation=”center” use_border_color=”off” border_color=”#ffffff” border_style=”solid” module_id=”photocredit”]<\/p>\n

Photo credit: Christiaan Colen – Flickr<\/a><\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section admin_label=”Mobile version” fullwidth=”off” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”on” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” module_id=”my_section” custom_padding=”0px|||” disabled=”off” disabled_on=”|on|on”][et_pb_row admin_label=”Row” make_fullwidth=”on” use_custom_width=”off” width_unit=”on” use_custom_gutter=”off” padding_mobile=”off” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”on” background_color_1=”rgba(0,0,0,0)” background_color_2=”rgba(0,0,0,0)” column_padding_mobile=”off” gutter_width=”1″ background_color=”#f2f2f2″ module_class=”wpc-center” parallax_1=”off” parallax_method_1=”off” parallax_2=”off” parallax_method_2=”off” custom_padding=”|0px||0px”][et_pb_column type=”1_2″][et_pb_video_slider admin_label=”Mobile version” show_image_overlay=”show” show_arrows=”on” show_thumbnails=”on” controls_color=”light” module_id=”videoslider” module_class=”wpc-video”]<\/p>\n

[et_pb_video_slider_item src=”https:\/\/www.youtube.com\/watch?v=XwbL9Qxm22Q” background_layout=”dark” image_src=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/code_review_high.jpg”]<\/p>\n

[\/et_pb_video_slider_item]<\/p>\n

[\/et_pb_video_slider][\/et_pb_column][et_pb_column type=”1_2″][et_pb_text admin_label=”Video description” background_layout=”light” text_orientation=”center” use_border_color=”off” border_color=”#ffffff” border_style=”solid” text_font=”Arimo||||” module_id=”videodescription” module_class=”wpc-text” custom_padding=”||0px|” custom_margin=”||2%|”]<\/p>\n

Rootkits<\/a> are a class of malware which are dedicated to hiding the attacker\u2019s presence on a compromised system. This talk, given by Xeno Kovah<\/a>, will focus on understanding how rootkits work and what tools can be used to help find them.<\/p>\n

This talk will be a very hands-on class about specific techniques which rootkits use and show how a proof of concept rootkit is able to hide things from a defender.<\/p>\n

Download the class materials here<\/a>.<\/p>\n

[\/et_pb_text][et_pb_button admin_label=”Watch this video on YouTube” button_url=”https:\/\/www.youtube.com\/watch?v=XwbL9Qxm22Q” url_new_window=”on” button_text=”Watch this video on YouTube” button_alignment=”center” background_layout=”light” disabled=”off” disabled_on=”|off|off” custom_button=”on” button_use_icon=”on” button_icon=”%%353%%” button_icon_placement=”right” button_on_hover=”on” button_border_radius_hover=”20″ button_border_radius=”20″ button_text_size=”1em” button_text_size_last_edited=”on|desktop” module_id=”button”]<\/p>\n

[\/et_pb_button][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section admin_label=”Desktop version” fullwidth=”off” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” module_id=”my_section” custom_padding=”1%||1%|” disabled=”off” disabled_on=”on|on|”][et_pb_row admin_label=”Row” make_fullwidth=”on” use_custom_width=”off” width_unit=”on” use_custom_gutter=”off” padding_mobile=”off” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”on” background_color_1=”rgba(0,0,0,0)” background_color_2=”rgba(0,0,0,0)” column_padding_mobile=”off” gutter_width=”1″ background_color=”#f2f2f2″ module_class=”wpc-center” parallax_1=”off” parallax_method_1=”off” parallax_2=”off” parallax_method_2=”off” custom_padding=”0px|0px|0px|0px”][et_pb_column type=”1_2″][et_pb_video_slider admin_label=”Desktop version” show_image_overlay=”show” show_arrows=”on” show_thumbnails=”on” controls_color=”light” module_id=”videoslider” module_class=”wpc-video”]<\/p>\n

[et_pb_video_slider_item src=”https:\/\/www.youtube.com\/watch?v=XwbL9Qxm22Q” background_layout=”dark” image_src=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/code_review_high.jpg”]<\/p>\n

[\/et_pb_video_slider_item]<\/p>\n

[\/et_pb_video_slider][\/et_pb_column][et_pb_column type=”1_2″][et_pb_text admin_label=”Video description” background_layout=”light” text_orientation=”center” text_font_size=”18″ text_letter_spacing=”1px” use_border_color=”off” border_color=”#ffffff” border_style=”solid” text_font=”Arimo||||” module_id=”videodescription” module_class=”wpc-text”]<\/p>\n

Rootkits<\/a> are a class of malware which are dedicated to hiding the attacker\u2019s presence on a compromised system. This talk, given by Xeno Kovah<\/a>, will focus on understanding how rootkits work and what tools can be used to help find them.<\/p>\n

This talk will be a very hands-on class about specific techniques which rootkits use and show how a proof of concept rootkit is able to hide things from a defender.<\/p>\n

Download the class materials here<\/a>.<\/p>\n

[\/et_pb_text][et_pb_text admin_label=”Video categories” background_layout=”light” text_orientation=”center” module_id=”videocategories” text_font_size=”1em” use_border_color=”off” border_color=”#ffffff” border_style=”solid” text_letter_spacing=”1px”]<\/p>\n

\n\t\t\t\t\t\"Malware\"<\/a><\/p>\n

Malware\n\t\t\t\t<\/div>

\n\t\t\t\t\t\"Programming\"<\/a><\/p>\n

Programming\n\t\t\t\t<\/div>

\n\t\t\t\t\t\"\"<\/a><\/p>\n

Source\n\t\t\t\t<\/div>

<\/div><\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section admin_label=”Section” fullwidth=”off” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”on” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” module_id=”my_section2″ disabled=”off” disabled_on=”|on|on” custom_padding=”0px|||”][et_pb_row admin_label=”Row” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” use_custom_gutter=”off” padding_mobile=”on” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”off” parallax_1=”off” parallax_method_1=”off” column_padding_mobile=”on” module_class=”wpc-center” custom_padding=”0px||0px|” parallax_2=”off” parallax_method_2=”off” custom_css_main_2=”margin:-5% !important;” custom_css_after_2=”margin:-5% !important;” padding_top_2=”0px” padding_left_2=”0px”][et_pb_column type=”4_4″][et_pb_text admin_label=”About the speaker mobile version” background_layout=”light” text_orientation=”center” text_letter_spacing=”1px” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_padding=”||0%|” custom_margin=”||3%|” module_id=”speakermobile”]<\/p>\n

About the speaker<\/p>\n

[\/et_pb_text][et_pb_divider admin_label=”Divider” color=”#f2f2f2″ show_divider=”on” divider_style=”solid” divider_position=”top” hide_on_mobile=”off”]<\/p>\n

[\/et_pb_divider][et_pb_text admin_label=”Bio” background_layout=”light” text_orientation=”center” use_border_color=”off” border_color=”#ffffff” border_style=”solid” module_id=”bio” module_class=”wpc-text”]<\/p>\n

Xeno Kovah’s speciality area is stealth malware and its ability to hide from security software and force security software to lie.<\/p>\n

To combat such attacks he researches trusted computing systems that can provide much stronger security guarantees than normal COTS. He co-founded LegbaCore in 2014 to help improve security at the foundation of computing systems.<\/p>\n

He is also the founder and lead contributor to OpenSecurityTraining.info.<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=”Row” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” use_custom_gutter=”off” custom_padding=”0%|||” padding_mobile=”on” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”off” parallax_1=”off” parallax_method_1=”off” column_padding_mobile=”on” custom_margin=”-5%|||”][et_pb_column type=”4_4″][et_pb_text admin_label=”Connect” background_layout=”light” text_orientation=”center” text_font_size=”2em” text_letter_spacing=”1px” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_padding=”||0%|” custom_css_main_element=”font-size: 1.5em !important; ” custom_margin=”-5%||3%|”]<\/p>\n

Connect<\/p>\n

[\/et_pb_text][et_pb_code admin_label=”Code”]<div style="width:120px;height:1px;background-color:#f2f2f2;margin:0px auto;"><\/div>[\/et_pb_code][et_pb_social_media_follow admin_label=”Social Media Follow” link_shape=”rounded_rectangle” background_layout=”light” url_new_window=”on” follow_button=”off” custom_css_main_element=”font-size: 1em !important;||margin-top: -5% !important;” custom_css_social_follow=”font-size: 1em !important;”]<\/p>\n

[et_pb_social_media_follow_network social_network=”twitter” url=”https:\/\/twitter.com\/xenokovah” skype_action=”call” bg_color=”#00aced”]<\/p>\n

Twitter<\/p>\n

[\/et_pb_social_media_follow_network][et_pb_social_media_follow_network social_network=”linkedin” url=”https:\/\/www.linkedin.com\/in\/xenokovah” skype_action=”call” bg_color=”#007bb6″]<\/p>\n

LinkedIn<\/p>\n

[\/et_pb_social_media_follow_network]<\/p>\n

[\/et_pb_social_media_follow][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section admin_label=”Section” fullwidth=”off” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” disabled=”off” disabled_on=”on|off|off” custom_padding=”1%||1%|” module_id=”my_section2″][et_pb_row admin_label=”Row” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” use_custom_gutter=”off” padding_mobile=”on” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”on” parallax_1=”off” parallax_method_1=”off” column_padding_mobile=”on” module_class=”wpc-center” background_color=”#ffffff” custom_padding=”0px||0px|” parallax_2=”off” parallax_method_2=”off” custom_css_main_2=”margin:-10% !important;” custom_css_after_2=”margin:-10% !important;” padding_left_2=”5%”][et_pb_column type=”2_3″][et_pb_text admin_label=”About the speaker desktop version” background_layout=”light” text_orientation=”center” text_letter_spacing=”1px” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_padding=”||0%|” custom_margin=”||3%|” module_id=”speakerdesktop”]<\/p>\n

About the speaker<\/p>\n

[\/et_pb_text][et_pb_divider admin_label=”Divider” color=”#f2f2f2″ show_divider=”on” divider_style=”solid” divider_position=”top” hide_on_mobile=”off”]<\/p>\n

[\/et_pb_divider][et_pb_text admin_label=”Bio” background_layout=”light” text_orientation=”center” use_border_color=”off” border_color=”#ffffff” border_style=”solid” module_id=”bio” module_class=”wpc-text”]<\/p>\n

Xeno Kovah’s speciality area is stealth malware and its ability to hide from security software and force security software to lie.<\/p>\n

To combat such attacks he researches trusted computing systems that can provide much stronger security guarantees than normal COTS. He co-founded LegbaCore in 2014 to help improve security at the foundation of computing systems.<\/p>\n

He is also the founder and lead contributor to OpenSecurityTraining.info.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”1_3″][et_pb_image admin_label=”Image” src=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2016\/10\/R1WzGyWZ_400x400.png” show_in_lightbox=”off” url_new_window=”on” use_overlay=”off” animation=”right” sticky=”off” align=”center” disabled=”off” disabled_on=”off||” max_width=”200px” force_fullwidth=”off” always_center_on_mobile=”on” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_css_main_element=”line-height: 0;||-webkit-border-radius: 25px;||-moz-border-radius: 25px;||border-radius: 25px;||overflow: hidden;||xmax-width: 200px;”]<\/p>\n

[\/et_pb_image][et_pb_social_media_follow admin_label=”Social Media Follow” link_shape=”rounded_rectangle” background_layout=”light” url_new_window=”off” follow_button=”off”]<\/p>\n

[et_pb_social_media_follow_network social_network=”twitter” url=”https:\/\/twitter.com\/xenokovah” skype_action=”call” bg_color=”#00aced”]<\/p>\n

Twitter<\/p>\n

[\/et_pb_social_media_follow_network][et_pb_social_media_follow_network social_network=”linkedin” url=”https:\/\/www.linkedin.com\/in\/xenokovah” skype_action=”call” bg_color=”#007bb6″]<\/p>\n

LinkedIn<\/p>\n

[\/et_pb_social_media_follow_network]<\/p>\n

[\/et_pb_social_media_follow][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section admin_label=”Section” fullwidth=”off” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”on” disabled=”off” disabled_on=”|off|on” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” module_id=”my_section” custom_padding=”0px|||”][et_pb_row admin_label=”Row” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” use_custom_gutter=”off” padding_mobile=”on” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”off” parallax_1=”off” parallax_method_1=”off” column_padding_mobile=”on” module_class=”wpc-center” parallax_2=”off” parallax_method_2=”off” custom_css_main_2=”margin:-5% !important;” custom_css_after_2=”margin:-5% !important;” padding_top_2=”0px” padding_left_2=”0px” background_color=”#f2f2f2″][et_pb_column type=”4_4″][et_pb_text admin_label=”Resources mobile version” background_layout=”light” text_orientation=”center” text_letter_spacing=”1px” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_padding=”||0%|” custom_margin=”||3%|” module_id=”resourcesmobile”]<\/p>\n

Resources<\/p>\n

[\/et_pb_text][et_pb_divider admin_label=”Divider” color=”#ffffff” show_divider=”on” divider_style=”solid” divider_position=”top” hide_on_mobile=”off”]<\/p>\n

[\/et_pb_divider][et_pb_video admin_label=”Video” src=”https:\/\/www.youtube.com\/watch?v=6CFnK20EyUU”]<\/p>\n

[\/et_pb_video][et_pb_blurb admin_label=”Blurb” title=”RootKits 101 (I). The Basics” url=”http:\/\/null-byte.wonderhowto.com\/how-to\/rootkits-101-i-basics-0168424\/” url_new_window=”on” use_icon=”off” icon_color=”#7EBEC5″ use_circle=”off” circle_color=”#7EBEC5″ use_circle_border=”off” circle_border_color=”#7EBEC5″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/02\/article_96_96_blue.svg” icon_placement=”left” animation=”left” background_layout=”light” text_orientation=”center” disabled=”off” disabled_on=”off|on|on” use_icon_font_size=”off” use_border_color=”off” border_color=”#ffffff” border_style=”solid” module_id=”resources” header_letter_spacing=”1px” header_font_size=”1em” module_class=”wpc-text”]<\/p>\n

In this series we are going to look into kernel mode rootkits. Those are the most common ones, and will give us enough fun to be busy for a while. Read more<\/a><\/p>\n

[\/et_pb_blurb][et_pb_blurb admin_label=”Blurb” title=”Linux Rootkits 101″ url=”http:\/\/turbochaos.blogspot.nl\/2013\/09\/linux-rootkits-101-1-of-3.html” url_new_window=”on” use_icon=”off” icon_color=”#7EBEC5″ use_circle=”off” circle_color=”#7EBEC5″ use_circle_border=”off” circle_border_color=”#7EBEC5″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/02\/article_96_96_blue.svg” icon_placement=”left” animation=”left” background_layout=”light” text_orientation=”center” disabled=”off” disabled_on=”off|on|on” use_icon_font_size=”off” use_border_color=”off” border_color=”#ffffff” border_style=”solid” module_id=”resources” header_font_size=”1em” header_letter_spacing=”1px” module_class=”wpc-text”]<\/p>\n

This post is going to be part of a three part series evolving the rootkit to modern\/appropriate standards of rootkits for Linux today. Read more<\/a><\/p>\n

[\/et_pb_blurb][et_pb_blurb admin_label=”Blurb” title=”Writing Cisco IOS Rootkits” url=”http:\/\/grid32.com\/bb095447484a76e5c74d10f604b716f8\/cisco_ios_rootkits.pdf” url_new_window=”on” use_icon=”off” icon_color=”#7EBEC5″ use_circle=”off” circle_color=”#7EBEC5″ use_circle_border=”off” circle_border_color=”#7EBEC5″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/02\/whitepaper_96_96_blue.svg” icon_placement=”left” animation=”left” background_layout=”light” text_orientation=”center” disabled=”off” disabled_on=”off|on|on” use_icon_font_size=”off” use_border_color=”off” border_color=”#ffffff” border_style=”solid” module_id=”resources” header_font_size=”1em” header_letter_spacing=”1px” module_class=”wpc-text”]<\/p>\n

This paper is about the work involved in modifying firmware images with the test case focused on Cisco IOS. Read more<\/a><\/p>\n

[\/et_pb_blurb][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section admin_label=”Desktop version” fullwidth=”off” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” module_id=”my_section2″ disabled=”off” disabled_on=”on|on|”][et_pb_row admin_label=”Row” make_fullwidth=”off” use_custom_width=”off” width_unit=”off” use_custom_gutter=”off” padding_mobile=”off” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”off” column_padding_mobile=”off” gutter_width=”1″ module_class=”wpc-center” parallax_1=”off” parallax_method_1=”off” parallax_2=”off” parallax_method_2=”off” background_color=”#f2f2f2″][et_pb_column type=”1_2″][et_pb_text admin_label=”Resources desktop version” background_layout=”light” text_orientation=”center” text_letter_spacing=”1px” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_padding=”||0%|” custom_margin=”||3%|” module_id=”resourcesdesktop”]<\/p>\n

Resources<\/p>\n

[\/et_pb_text][et_pb_divider admin_label=”Divider” color=”#ffffff” show_divider=”on” divider_style=”solid” divider_position=”top” hide_on_mobile=”off”]<\/p>\n

[\/et_pb_divider][et_pb_video admin_label=”Video” src=”https:\/\/www.youtube.com\/watch?v=6CFnK20EyUU” module_id=”videoslider” module_class=”wpc-video”]<\/p>\n

[\/et_pb_video][\/et_pb_column][et_pb_column type=”1_2″][et_pb_blurb admin_label=”Blurb” title=”RootKits 101 (I). The Basics” url=”http:\/\/null-byte.wonderhowto.com\/how-to\/rootkits-101-i-basics-0168424\/” url_new_window=”on” use_icon=”off” icon_color=”#7EBEC5″ use_circle=”off” circle_color=”#7EBEC5″ use_circle_border=”off” circle_border_color=”#7EBEC5″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/02\/article_96_96_blue.svg” icon_placement=”left” animation=”left” background_layout=”light” text_orientation=”center” disabled=”off” disabled_on=”on|on|off” use_icon_font_size=”off” use_border_color=”off” border_color=”#ffffff” border_style=”solid” header_letter_spacing=”1px” header_font_size=”1em” module_id=”resources” module_class=”wpc-center”]<\/p>\n

In this series we are going to look into kernel mode rootkits. Those are the most common ones, and will give us enough fun to be busy for a while. Read more<\/a><\/p>\n

[\/et_pb_blurb][et_pb_blurb admin_label=”Blurb” title=”Linux Rootkits 101″ url=”http:\/\/turbochaos.blogspot.nl\/2013\/09\/linux-rootkits-101-1-of-3.html” url_new_window=”on” use_icon=”off” icon_color=”#7EBEC5″ use_circle=”off” circle_color=”#7EBEC5″ use_circle_border=”off” circle_border_color=”#7EBEC5″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/02\/article_96_96_blue.svg” icon_placement=”left” animation=”left” background_layout=”light” text_orientation=”center” disabled=”off” disabled_on=”on|on|off” use_icon_font_size=”off” use_border_color=”off” border_color=”#ffffff” border_style=”solid” module_id=”resources” header_font_size=”1em” header_letter_spacing=”1px”]<\/p>\n

This post is going to be part of a three part series evolving the rootkit to modern\/appropriate standards of rootkits for Linux today. Read more<\/a><\/p>\n

[\/et_pb_blurb][et_pb_blurb admin_label=”Blurb” title=”Writing Cisco IOS Rootkits” url=”http:\/\/grid32.com\/bb095447484a76e5c74d10f604b716f8\/cisco_ios_rootkits.pdf” url_new_window=”on” use_icon=”off” icon_color=”#7EBEC5″ use_circle=”off” circle_color=”#7EBEC5″ use_circle_border=”off” circle_border_color=”#7EBEC5″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/02\/whitepaper_96_96_blue.svg” icon_placement=”left” animation=”left” background_layout=”light” text_orientation=”center” disabled=”off” disabled_on=”on|on|off” use_icon_font_size=”off” use_border_color=”off” border_color=”#ffffff” border_style=”solid” module_id=”resources” header_font_size=”1em” header_letter_spacing=”1px”]<\/p>\n

This paper is about the work involved in modifying firmware images with the test case focused on Cisco IOS. Read more<\/a><\/p>\n

[\/et_pb_blurb][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section admin_label=”Section” fullwidth=”off” specialty=”off” transparent_background=”off” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”on” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” custom_padding=”0%||0%|” background_color=”#ffffff” disabled=”off” disabled_on=”|on|on” module_id=”my_section2″][et_pb_row admin_label=”Row” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” use_custom_gutter=”off” padding_mobile=”off” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”off” parallax_1=”off” parallax_method_1=”off” column_padding_mobile=”off”][et_pb_column type=”4_4″][et_pb_text admin_label=”Related videos mobile version” background_layout=”light” text_orientation=”center” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_padding=”5%||0px|” custom_margin=”||3%|” text_letter_spacing=”1px” module_id=”relatedmobile”]<\/p>\n

Related videos<\/p>\n

[\/et_pb_text][et_pb_divider admin_label=”Divider” color=”#f2f2f2″ show_divider=”on” divider_style=”solid” divider_position=”top” divider_weight=”1″ hide_on_mobile=”off”]<\/p>\n

[\/et_pb_divider][et_pb_filterable_portfolio admin_label=”Filterable Portfolio” fullwidth=”off” posts_number=”3″ include_categories=”107,90,100,119″ show_title=”on” show_categories=”off” show_pagination=”on” background_layout=”light” hover_overlay_color=”rgba(255,255,255,0.9)” title_font_size=”1em” title_letter_spacing=”1px” caption_letter_spacing=”1px” filter_font_size=”1em” filter_letter_spacing=”1px” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_css_main_element=”text-align: center!important;” hover_icon=”%%353%%” module_class=”et_custom_portfolio” caption_font_size=”1em” module_id=”test”]<\/p>\n

[\/et_pb_filterable_portfolio][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section admin_label=”section” fullwidth=”off” specialty=”off” transparent_background=”on” inner_shadow=”off” parallax=”off” parallax_method=”on” allow_player_pause=”off” padding_mobile=”on” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off” custom_padding=”2%||0%|” background_color=”#ffffff” module_class=”relatedvideos” disabled=”off” disabled_on=”on|on|”][et_pb_row admin_label=”row” make_fullwidth=”on” use_custom_width=”off” width_unit=”on” use_custom_gutter=”off” padding_mobile=”off” allow_player_pause=”off” parallax=”off” parallax_method=”off” make_equal=”off” column_padding_mobile=”on” parallax_1=”off” parallax_method_1=”off” parallax_2=”off” parallax_method_2=”off”][et_pb_column type=”1_4″][et_pb_text admin_label=”Related videos mobile version” background_layout=”light” text_orientation=”center” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_padding=”5%||0px|” custom_margin=”||3%|” text_letter_spacing=”1px” disabled=”off” disabled_on=”on|on|” module_id=”relateddesktop”]<\/p>\n

Related videos<\/p>\n

[\/et_pb_text][et_pb_divider admin_label=”Divider” color=”#f2f2f2″ show_divider=”on” divider_style=”solid” divider_position=”top” hide_on_mobile=”off” disabled=”off” disabled_on=”on|on|”]<\/p>\n

[\/et_pb_divider][et_pb_text admin_label=”Title” background_layout=”light” text_orientation=”center” text_font_size=”16″ text_letter_spacing=”1px” use_border_color=”off” border_color=”#ffffff” border_style=”solid” module_id=”resources” disabled=”off” disabled_on=”on|on|”]<\/p>\n

Videos from the same category or videos related to the subject.<\/p>\n

You will find something new to watch and expand your knowledge.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″][et_pb_filterable_portfolio admin_label=”Filterable Portfolio” fullwidth=”off” posts_number=”3″ include_categories=”107,90,100,119″ show_title=”on” show_categories=”off” show_pagination=”on” background_layout=”light” hover_overlay_color=”rgba(255,255,255,0.9)” caption_letter_spacing=”1px” filter_font_size=”1em” filter_letter_spacing=”1px” use_border_color=”off” border_color=”#ffffff” border_style=”solid” custom_css_main_element=”text-align: center!important;” hover_icon=”%%353%%” module_class=”et_custom_portfolio”]<\/p>\n

[\/et_pb_filterable_portfolio][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

This class will focus on understanding how rootkits work, and what tools can be used to help find them.<\/p>\n","protected":false},"author":2,"featured_media":7746,"comment_status":"open","ping_status":"open","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"project_category":[107,86,100,119,198],"project_tag":[],"class_list":["post-1736","project","type-project","status-publish","has-post-thumbnail","hentry","project_category-malware-2","project_category-technical_grid_slider2","project_category-programming","project_category-rootkit","project_category-rss-all"],"yoast_head":"\nRootkits: What they are, and how to find them | Christiaan's collection<\/title>\n<meta name=\"description\" content=\"This talk will focus on understanding how rootkits work and what tools can be used to help find them.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Rootkits: What they are, and how to find them | Christiaan's collection\" \/>\n<meta property=\"og:description\" content=\"This talk will focus on understanding how rootkits work and what tools can be used to help find them.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them\" \/>\n<meta property=\"og:site_name\" content=\"Christiaan's collection\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/christiaan008\" \/>\n<meta property=\"article:modified_time\" content=\"2016-10-12T16:50:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/03\/rootkit1_high.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1080\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@christiaan008\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"20 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=rootkits-what-they-are-and-how-to-find-them\",\"url\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=rootkits-what-they-are-and-how-to-find-them\",\"name\":\"Rootkits: What they are, and how to find them | Christiaan's collection\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=rootkits-what-they-are-and-how-to-find-them#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=rootkits-what-they-are-and-how-to-find-them#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/yt.christiaan008.com\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2015\\\/03\\\/rootkit1_high.jpg\",\"datePublished\":\"2015-03-02T18:08:38+00:00\",\"dateModified\":\"2016-10-12T16:50:20+00:00\",\"description\":\"This talk will focus on understanding how rootkits work and what tools can be used to help find them.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=rootkits-what-they-are-and-how-to-find-them#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/yt.christiaan008.com\\\/?project=rootkits-what-they-are-and-how-to-find-them\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=rootkits-what-they-are-and-how-to-find-them#primaryimage\",\"url\":\"https:\\\/\\\/yt.christiaan008.com\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2015\\\/03\\\/rootkit1_high.jpg\",\"contentUrl\":\"https:\\\/\\\/yt.christiaan008.com\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2015\\\/03\\\/rootkit1_high.jpg\",\"width\":1920,\"height\":1080,\"caption\":\"Rookit high\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=rootkits-what-they-are-and-how-to-find-them#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/yt.christiaan008.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Projects\",\"item\":\"https:\\\/\\\/yt.christiaan008.com\\\/?post_type=project\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Rootkits: What they are, and how to find them\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/#website\",\"url\":\"https:\\\/\\\/yt.christiaan008.com\\\/\",\"name\":\"Christiaan's collection\",\"description\":\"A great collection of security related videos!\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/yt.christiaan008.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Rootkits: What they are, and how to find them | Christiaan's collection","description":"This talk will focus on understanding how rootkits work and what tools can be used to help find them.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them","og_locale":"en_US","og_type":"article","og_title":"Rootkits: What they are, and how to find them | Christiaan's collection","og_description":"This talk will focus on understanding how rootkits work and what tools can be used to help find them.","og_url":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them","og_site_name":"Christiaan's collection","article_publisher":"https:\/\/www.facebook.com\/christiaan008","article_modified_time":"2016-10-12T16:50:20+00:00","og_image":[{"width":1920,"height":1080,"url":"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/03\/rootkit1_high.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@christiaan008","twitter_misc":{"Est. reading time":"20 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them","url":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them","name":"Rootkits: What they are, and how to find them | Christiaan's collection","isPartOf":{"@id":"https:\/\/yt.christiaan008.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them#primaryimage"},"image":{"@id":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them#primaryimage"},"thumbnailUrl":"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/03\/rootkit1_high.jpg","datePublished":"2015-03-02T18:08:38+00:00","dateModified":"2016-10-12T16:50:20+00:00","description":"This talk will focus on understanding how rootkits work and what tools can be used to help find them.","breadcrumb":{"@id":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them#primaryimage","url":"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/03\/rootkit1_high.jpg","contentUrl":"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/03\/rootkit1_high.jpg","width":1920,"height":1080,"caption":"Rookit high"},{"@type":"BreadcrumbList","@id":"https:\/\/yt.christiaan008.com\/?project=rootkits-what-they-are-and-how-to-find-them#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/yt.christiaan008.com\/"},{"@type":"ListItem","position":2,"name":"Projects","item":"https:\/\/yt.christiaan008.com\/?post_type=project"},{"@type":"ListItem","position":3,"name":"Rootkits: What they are, and how to find them"}]},{"@type":"WebSite","@id":"https:\/\/yt.christiaan008.com\/#website","url":"https:\/\/yt.christiaan008.com\/","name":"Christiaan's collection","description":"A great collection of security related videos!","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/yt.christiaan008.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/project\/1736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/project"}],"about":[{"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/types\/project"}],"author":[{"embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1736"}],"version-history":[{"count":21,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/project\/1736\/revisions"}],"predecessor-version":[{"id":9672,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/project\/1736\/revisions\/9672"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/media\/7746"}],"wp:attachment":[{"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1736"}],"wp:term":[{"taxonomy":"project_category","embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=%2Fwp%2Fv2%2Fproject_category&post=1736"},{"taxonomy":"project_tag","embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=%2Fwp%2Fv2%2Fproject_tag&post=1736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}