A Guide to Kernel Exploitation: Attacking the Core [Paperback]

Enrico Perla B.Sc. Computer Science University of Torino M.Sc. Computer Science Trinity College Dublin (Author), Massimiliano Oldani (Author)

Book Description

Publication Date: September 15, 2010 | ISBN-10: 1597494860 | ISBN-13: 978-1597494861 | Edition: 1

The number of security countermeasures against user-land exploitation is on the rise. Because of this, kernel exploitation is becoming much more popular among exploit writers and attackers. Playing with the heart of the operating system can be a dangerous game: This book covers the theoretical techniques and approaches needed to develop reliable and effective kernel-level exploits and applies them to different operating systems (Linux, Solaris, Mac OS X, and Windows). Kernel exploits require both art and science to achieve. Every OS has its quirks and so every exploit must be molded to fully exploit its target. This book discusses the most popular OS families-UNIX derivatives, Mac OS X, and Windows-and how to gain complete control over them. Concepts and tactics are presented categorically so that even when a specifically detailed exploit has been patched, the foundational information that you have read will help you to write a newer, better attack or a more concrete design and defensive structure.

• Covers a range of operating system families - UNIX derivatives, Mac OS X, Windows
• Details common scenarios such as generic memory corruption (stack overflow, heap overflow, etc.) issues, logical bugs and race conditions
• Delivers the reader from user-land exploitation to the world of kernel-land (OS) exploits/attacks, with a particular focus on the steps that lead to the creation of successful techniques, in order to give to the reader something more than just a set of tricks

Editorial Reviews

Review

"A very interesting book that not only exposes readers to kernel exploitation techniques, but also deeply motivates the study of operating systems internals, moving such study far beyond simple curiosity."--Golden G. Richard III, Ph.D., Professor of Computer Science, University of New Orleans and CTO, Digital Forensics Solutions, LLC

From the Back Cover

The number of security countermeasures against user-land exploitation is on the rise. Because of this, kernel exploitation is becoming much more popular among exploit writers and attackers. Playing with the heart of the operating system can be a dangerous game: This book covers the theoretical techniques and approaches needed to develop reliable and effective kernel-level exploits and applies them to different operating systems (Linux, Solaris, Mac OS X, and Windows). Kernel exploits require both art and science to achieve. Every OS has its quirks and so every exploit must be molded to fully exploit its target. This book discusses the most popular OS families-UNIX derivatives, Mac OS X, and Windows-and how to gain complete control over them. Concepts and tactics are presented categorically so that even when a specifically detailed exploit has been patched, the foundational information that you have read will help you to write a newer, better attack or a more concrete design and defensive structure.

See all Editorial Reviews

Product Details

• Paperback: 442 pages
• Publisher: Syngress; 1 edition (September 15, 2010)
• Language: English
• ISBN-10: 1597494860
• ISBN-13: 978-1597494861
• Product Dimensions: 7.5 x 0.9 x 9.2 inches
• Shipping Weight: 1.8 pounds (View shipping rates and policies)
• Average Customer Review: 4.4 out of 5 stars  See all reviews (22 customer reviews)
• Amazon Best Sellers Rank: #176,251 in Books (See Top 100 in Books)
  • #97 in Books > Computers & Technology > Internet & Web Culture > Hacking

More About the Author

Discover books, learn about writers, read author blogs, and more.

Most Helpful Customer Reviews

14 of 16 people found the following review helpful

5.0 out of 5 stars Readable, instructive, concise, just two caveats October 4, 2010

By DDDDDDD

Format:Paperback

My colleague showed me this book (full disclosure: he was a reviewer) - he made his students buy it it for his OS II class (assigned middle of the semester!) one week ago - hot off the presses. I got two copies, one for my office and one for reading on the bus.

It's one of three technical exploit books I'd take on a deserted, networked, powered island. Part 1: Journey into Kernel Land (Intro and explanations) is one of the most succinct clear intros I have ever seen. I wish I could distributed that as a document for class. The section on Windows is current and well done, also because the difference between 32 and 64 bit architectures and approaches are emphasized (this is not the case with Eilam's book alas, though very good) - this book is up to date. I think the Unix section needs to be updated, though, my colleague said that some of the exploits were possible in 2006/2007 but with kernel changes some APIs are not available etc. This needs to be updated. Cannot comment on the Mac section, because no expertise.

Website available and examples useful: [...]

Wishlist:

1) There are some unavoidable typos, sure: p.10: MAC is nor Media Access Control in a security context, it's Mandatory Access Control
2) I would have really really like an expanded section on hypervisors and virtualization (there is a mini epilogue on it at the end)- that would have made my day
3) The Linux case study was neat - for next version, do Windows Stuxnet's m.o. because it adds all sorts of interesting kernel root attack pathways

You will not regret buying this book - it is obvious and much appreciated that the authors put a lot of effort into making an readable guide for the medium to expert reader that can double as a textbook companion....

Daniel Bilar
CS Department
UNO Read more ›

6 of 6 people found the following review helpful

5.0 out of 5 stars An excellent book on kernel exploitation October 19, 2010

By Blake Self

Format:Paperback|Amazon Verified Purchase

I bought this book in hopes of finding an informative and thought provoking look at kernel exploitation - I was not disappointed. Aside from a few minor typos, I found this book to be one of the most well written books on exploitation that I have read. I have recommended it to some fellow students and a professor (I am a graduate student in computer science). I highly recommend this book for anybody that is interested in kernel exploitation. In my opinion, this book is currently the best source of information on exploiting the kernel since Phrack #64 file 6.

5 of 5 people found the following review helpful

5.0 out of 5 stars the new bible for kernel hackers December 30, 2010

By Ari Elias Bachrach

Format:Paperback|Amazon Vine™ Review (What's this?)

I've read plenty of works that have covered kernel exploits at their most basic level - fill up a buffer, overwrite the stack pointer, and insert your code with a nop sled. I can't think of anything that comes close to the depth and breadth offered by this book. It starts where technical books always should but rarely do - with theory. The first part of the book deals with explaining the kernel, describing the various types of kernel exploits, and has a lengthy discussion of architectural options that may effect a kernel exploit. The second part of the book gets practical. They cover the three main classes of OS in depth - Windows, Mac, and Unix. Each kernel is discussed, its' peculiarities analyzed, tool suggestions provided, debugging explained, and numerous examples of previous kernel exploits are given. There is also a chapter on remote exploitation, and the book wraps up with a fantastic case study which ties everything together in a real world example. This is going to quickly become a staple in the library of every kernel hacker as both a reference work and educational guide.

A quick note on the technical level of the book - it assumes you know C, understand something about how kernels work, and have at least a passing familiarity with assembly. There is a lot of code in the book, all of which is helpfully on the book's website at attackingthecore.com.

3 of 3 people found the following review helpful

5.0 out of 5 stars Great book December 23, 2010

By L. Romero VINE™ VOICE

Format:Paperback|Amazon Vine™ Review (What's this?)

The authors do a great job at introducing the subject. They provide a definition of what exploitation means and a rationale on why exploitations are moving from user-land to kernel-land. They then describe different categories of exploitations and provide examples taken from real code. A thorough understanding of the examples requires some programming experience but if you are looking at this book you probably have it. Some background in operating systems is also helpful even though the authors do a good job at explaining the parts of the OS that will be affected by the exploit. Once the high-level concepts have been presented, discussion moves to examples of exploitations under different OS families. If you are looking for a book that will allow you to understand the thought process involved in exploiting kernel vulnerabilities, I think this book does a great job!

5 of 6 people found the following review helpful

5.0 out of 5 stars Excellent Book November 22, 2010

By Tom Carpenter VINE™ VOICE

Format:Paperback|Amazon Vine™ Review (What's this?)

I really didn't pay much attention to the page count of this book when I ordered it. I was, therefore, very pleased to receive a computer book that was sufficiently long and not extended in length in order to look better on the shelf. Books on very specific topics have a bad habit of included 200-300 pages of review on the general topic within which the specific topic of discussion resides. This book wasted no such time. If you are already familiar with general security topics, you'll be very pleased that this book dives right into the details of kernels and kernel exploits. I highly recommend this book for those needing to learn more about this specific area of security and penetration testing.