ROOTKITS

What they are, and how to find them

Rootkits are a class of malware which are dedicated to hiding the attacker’s presence on a compromised system. This talk, given by Xeno Kovah, will focus on understanding how rootkits work and what tools can be used to help find them.

This talk will be a very hands-on class about specific techniques which rootkits use and show how a proof of concept rootkit is able to hide things from a defender.

Download the class materials here.

Rootkits are a class of malware which are dedicated to hiding the attacker’s presence on a compromised system. This talk, given by Xeno Kovah, will focus on understanding how rootkits work and what tools can be used to help find them.

This talk will be a very hands-on class about specific techniques which rootkits use and show how a proof of concept rootkit is able to hide things from a defender.

Download the class materials here.

Malware

Malware

Programming

Programming

Source

About the speaker

Xeno Kovah’s speciality area is stealth malware and its ability to hide from security software and force security software to lie.

To combat such attacks he researches trusted computing systems that can provide much stronger security guarantees than normal COTS. He co-founded LegbaCore in 2014 to help improve security at the foundation of computing systems.

He is also the founder and lead contributor to OpenSecurityTraining.info.

About the speaker

Xeno Kovah’s speciality area is stealth malware and its ability to hide from security software and force security software to lie.

To combat such attacks he researches trusted computing systems that can provide much stronger security guarantees than normal COTS. He co-founded LegbaCore in 2014 to help improve security at the foundation of computing systems.

He is also the founder and lead contributor to OpenSecurityTraining.info.

Resources

RootKits 101 (I). The Basics

In this series we are going to look into kernel mode rootkits. Those are the most common ones, and will give us enough fun to be busy for a while. Read more

Linux Rootkits 101

This post is going to be part of a three part series evolving the rootkit to modern/appropriate standards of rootkits for Linux today. Read more

Writing Cisco IOS Rootkits

This paper is about the work involved in modifying firmware images with the test case focused on Cisco IOS. Read more

Resources

RootKits 101 (I). The Basics

In this series we are going to look into kernel mode rootkits. Those are the most common ones, and will give us enough fun to be busy for a while. Read more

Linux Rootkits 101

This post is going to be part of a three part series evolving the rootkit to modern/appropriate standards of rootkits for Linux today. Read more

Writing Cisco IOS Rootkits

This paper is about the work involved in modifying firmware images with the test case focused on Cisco IOS. Read more

Related videos

DEF CON 18: Your ISP and the Government: Best Friends Forever 1/3

DEF CON 18: Your ISP and the Government: Best Friends Forever 1/3

Although many companies claim to care about end-user privacy, none seem to be willing to compete on the extent to which they assist or resist the government in its surveillance activities. This talk will pierce the veil of secrecy surrounding these practices.

Testing SQL injection with sqlmap

Testing SQL injection with sqlmap

Sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications.

Owning bad guys (and mafia) with JavaScript botnets

Owning bad guys (and mafia) with JavaScript botnets

In this talk MITM schemas in anonymous services are discussed. Attendees will see how easily a botnet using JavaScript can be created to analyse that kind of connections and some of the actions people behind those services are doing.

DEF CON 17: Making fun of your malware

DEF CON 17: Making fun of your malware

This talk evenly distributes technical knowledge and humor to present the funniest discoveries related to malware authors and the fight against their code.

24C3: Mifare (Little security, despite obscurity)

24C3: Mifare (Little security, despite obscurity)

We analyzed the hardware of the Mifare tags and found weaknesses in several parts of the cipher.

ICS Cybersecurity Advanced Training Day 4

ICS Cybersecurity Advanced Training Day 4

The vlog about the fourth day of the 2011 International ICS Cybersecurity Advanced Training. This day is what it’s all about, the Blue Team / Red Team exercise.

OHM2013: Should law enforcement have hacking powers?

OHM2013: Should law enforcement have hacking powers?

In several European countries proposals for vast expansion of the powers of law enforcement in the digital realm are floating about. The panel focuses on the pros and cons of such powers.

Battery firmware hacking

Battery firmware hacking

Charlie Miller will take an in depth look at a common embedded controller used in a battery and reverse engineer the firmware.

25C3: Hacking the iPhone

25C3: Hacking the iPhone

This talk will summarize what we have learned about the internal architecture of the iPhone platform, its security, and the ways we have found to defeat these security measures.

DeepSec 2010: Debugging GSM

DeepSec 2010: Debugging GSM

The talk discusses a GSM debugging tool that consists entirely of open source software and open radio hardware. We will demonstrate how to record and decode GSM calls, even encrypted ones.

SOURCE Barcelona 2010: Carders.cc, the rise and fall of an underground forum

SOURCE Barcelona 2010: Carders.cc, the rise and fall of an underground forum

OWASP AppSecUSA 2012: Bug bounty programs

OWASP AppSecUSA 2012: Bug bounty programs

A panel discussion with Michael Coates (Mozilla), Chris Evans (Google), Jeremiah Grossman (WhiteHat Security), Adam Mein (Google), Alex Rice (Facebook)

Introduction to Trusted Computing

Introduction to Trusted Computing

This course is an introduction to the fundamental technologies behind Trusted Computing. You will learn what Trusted Platform Modules (TPMs) are and what capabilities they can provide both at an in-depth technical level and in an enterprise context.

Attacking SMS. It’s no longer your BFF

Attacking SMS. It’s no longer your BFF

This talk will conclude with a proof-of-concept web application demo that demonstrates the techniques and issues mentioned as well as thoughts for solving the next generation of spam.

DeepSec 2011: The security of non-executable files

DeepSec 2011: The security of non-executable files

This talk presents an overview of the security risks in non-executable files such as PDF, rich media and office documents. The talk aims to range from global considerations to individual cases.

DEF CON 16: Forensics is ONLY for Private Investigators

DEF CON 16: Forensics is ONLY for Private Investigators

This is a talk about the struggles of becoming a Private Investigator and what the laws are for computer forensics going forward.

DeepSec 2010: Circumventing common Pitfalls when auditing sourcecode for security vulnerabilities

DeepSec 2010: Circumventing common Pitfalls when auditing sourcecode for security vulnerabilities

This presentation describes the technologies behind advanced static and dynamic vulnerability analysis tools. We conclude with a discussion of new ways to ensure that bugs get fixed before it’s too late.

DeepSec 2013: Cracking and analysing Apple iCloud protocols

DeepSec 2013: Cracking and analysing Apple iCloud protocols

Vladimir Katalov Vladimir Katalov presents the results of analysing the Apple iCloud protocol and its impact on iCloud services.

24C3: Cybercrime 2.0

24C3: Cybercrime 2.0

The first part of the talk provides a brief history of Storm Worm focusing on the actual propagation phase. Afterwards we describe the network communication of the bot in detail and show how we can learn more about the botnet.

24C3: Why Silicon-Based Security is still that hard: Deconstructing Xbox 360 Security

24C3: Why Silicon-Based Security is still that hard: Deconstructing Xbox 360 Security

We describe the design of the Xbox 360 security system from a very high-legel point of view. In the second part we will discuss the details of the Xbox 360 system and security architecture.

The Honey project and CIC News Engine

The Honey project and CIC News Engine

An update about the Honey project and the development of the CIC News engine.

Rootkits: What they are, and how to find them

Rootkits: What they are, and how to find them

This class will focus on understanding how rootkits work, and what tools can be used to help find them.

29C3: Russia’s surveillance state

29C3: Russia’s surveillance state

Privacy International, Agentura.Ru and Citizen Lab have joined forces to launch a new project ‘Russia’s Surveillance State’. The project aims to undertake research and investigation into surveillance practices in Russia.

Secure code reviews magic or art? A simplified approach to secure code reviews

Secure code reviews magic or art? A simplified approach to secure code reviews

This presentation will delve into the science and process behind secure code review and will continue to discuss a simplified approach to secure code review

Related videos

Videos from the same category or videos related to the subject.

You will find something new to watch and expand your knowledge.

Testing SQL injection with sqlmap

Testing SQL injection with sqlmap

Sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications.

24C3: Why Silicon-Based Security is still that hard: Deconstructing Xbox 360 Security

24C3: Why Silicon-Based Security is still that hard: Deconstructing Xbox 360 Security

We describe the design of the Xbox 360 security system from a very high-legel point of view. In the second part we will discuss the details of the Xbox 360 system and security architecture.

DeepSec 2010: Debugging GSM

DeepSec 2010: Debugging GSM

The talk discusses a GSM debugging tool that consists entirely of open source software and open radio hardware. We will demonstrate how to record and decode GSM calls, even encrypted ones.

DeepSec 2013: Cracking and analysing Apple iCloud protocols

DeepSec 2013: Cracking and analysing Apple iCloud protocols

Vladimir Katalov Vladimir Katalov presents the results of analysing the Apple iCloud protocol and its impact on iCloud services.

DeepSec 2010: Circumventing common Pitfalls when auditing sourcecode for security vulnerabilities

DeepSec 2010: Circumventing common Pitfalls when auditing sourcecode for security vulnerabilities

This presentation describes the technologies behind advanced static and dynamic vulnerability analysis tools. We conclude with a discussion of new ways to ensure that bugs get fixed before it’s too late.

DEF CON 18: Your ISP and the Government: Best Friends Forever 1/3

DEF CON 18: Your ISP and the Government: Best Friends Forever 1/3

Although many companies claim to care about end-user privacy, none seem to be willing to compete on the extent to which they assist or resist the government in its surveillance activities. This talk will pierce the veil of secrecy surrounding these practices.

SOURCE Barcelona 2010: Carders.cc, the rise and fall of an underground forum

SOURCE Barcelona 2010: Carders.cc, the rise and fall of an underground forum

24C3: Cybercrime 2.0

24C3: Cybercrime 2.0

The first part of the talk provides a brief history of Storm Worm focusing on the actual propagation phase. Afterwards we describe the network communication of the bot in detail and show how we can learn more about the botnet.

DeepSec 2011: The security of non-executable files

DeepSec 2011: The security of non-executable files

This talk presents an overview of the security risks in non-executable files such as PDF, rich media and office documents. The talk aims to range from global considerations to individual cases.

DEF CON 17: Making fun of your malware

DEF CON 17: Making fun of your malware

This talk evenly distributes technical knowledge and humor to present the funniest discoveries related to malware authors and the fight against their code.

DEF CON 16: Forensics is ONLY for Private Investigators

DEF CON 16: Forensics is ONLY for Private Investigators

This is a talk about the struggles of becoming a Private Investigator and what the laws are for computer forensics going forward.

Rootkits: What they are, and how to find them

Rootkits: What they are, and how to find them

This class will focus on understanding how rootkits work, and what tools can be used to help find them.

OHM2013: Should law enforcement have hacking powers?

OHM2013: Should law enforcement have hacking powers?

In several European countries proposals for vast expansion of the powers of law enforcement in the digital realm are floating about. The panel focuses on the pros and cons of such powers.

24C3: Mifare (Little security, despite obscurity)

24C3: Mifare (Little security, despite obscurity)

We analyzed the hardware of the Mifare tags and found weaknesses in several parts of the cipher.

Secure code reviews magic or art? A simplified approach to secure code reviews

Secure code reviews magic or art? A simplified approach to secure code reviews

This presentation will delve into the science and process behind secure code review and will continue to discuss a simplified approach to secure code review

Attacking SMS. It’s no longer your BFF

Attacking SMS. It’s no longer your BFF

This talk will conclude with a proof-of-concept web application demo that demonstrates the techniques and issues mentioned as well as thoughts for solving the next generation of spam.

ICS Cybersecurity Advanced Training Day 4

ICS Cybersecurity Advanced Training Day 4

The vlog about the fourth day of the 2011 International ICS Cybersecurity Advanced Training. This day is what it’s all about, the Blue Team / Red Team exercise.

29C3: Russia’s surveillance state

29C3: Russia’s surveillance state

Privacy International, Agentura.Ru and Citizen Lab have joined forces to launch a new project ‘Russia’s Surveillance State’. The project aims to undertake research and investigation into surveillance practices in Russia.

25C3: Hacking the iPhone

25C3: Hacking the iPhone

This talk will summarize what we have learned about the internal architecture of the iPhone platform, its security, and the ways we have found to defeat these security measures.

The Honey project and CIC News Engine

The Honey project and CIC News Engine

An update about the Honey project and the development of the CIC News engine.

Owning bad guys (and mafia) with JavaScript botnets

Owning bad guys (and mafia) with JavaScript botnets

In this talk MITM schemas in anonymous services are discussed. Attendees will see how easily a botnet using JavaScript can be created to analyse that kind of connections and some of the actions people behind those services are doing.

OWASP AppSecUSA 2012: Bug bounty programs

OWASP AppSecUSA 2012: Bug bounty programs

A panel discussion with Michael Coates (Mozilla), Chris Evans (Google), Jeremiah Grossman (WhiteHat Security), Adam Mein (Google), Alex Rice (Facebook)

Battery firmware hacking

Battery firmware hacking

Charlie Miller will take an in depth look at a common embedded controller used in a battery and reverse engineer the firmware.

Introduction to Trusted Computing

Introduction to Trusted Computing

This course is an introduction to the fundamental technologies behind Trusted Computing. You will learn what Trusted Platform Modules (TPMs) are and what capabilities they can provide both at an in-depth technical level and in an enterprise context.

Share This