Save Big On Open-Box & Pre-owned: Buy "Rootkits: Subverting the Windows Kernel” from Amazon Warehouse Deals and save 60% off the $64.99 list price. Product is eligible for Amazon's 30-day returns policy and Prime or FREE Shipping. See all Open-Box & Pre-owned offers from Amazon Warehouse Deals.
To get the free app, enter your mobile phone number.
Rootkits: Subverting the Windows Kernel Paperback – August 1, 2005
|New from||Used from|
Windows 10 For Dummies Video Training
Get up to speed with Windows 10 with this video training course from For Dummies. Learn more.
Frequently Bought Together
Customers Who Bought This Item Also Bought
Special Offers and Product Promotions
From the Back Cover
"It's imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits."
"--Mark Russinovich, editor, " Windows IT Pro / Windows & .NET Magazine
"This material is not only up-to-date, it defines up-to-date. It is truly cutting-edge. As the only book on the subject, "Rootkits" will be of interest to any Windows security researcher or security programmer. It's detailed, well researched and the technical information is excellent. The level of technical detail, research, and time invested in developing relevant examples is impressive. In one word: Outstanding."
"--Tony Bautts, Security Consultant; CEO, Xtivix, Inc."
"This book is an essential read for anyone responsible for Windows security. Security professionals, Windows system administrators, and programmers in general will want to understand the techniques used by rootkit authors. At a time when many IT and security professionals are still worrying about the latest e-mail virus or how to get all of this month's security patches installed, Mr. Hoglund and Mr. Butler open your eyes to some of the most stealthy and significant threats to the Windows operating system. Only by understanding these offensive techniques can you properly defend the networks and systems for which you are responsible."
"--Jennifer Kolde, Security Consultant, Author, and Instructor"
"What's worse than being owned? Not knowing it. Find out what it means to be owned by reading Hoglund and Butler's first-of-a-kind book on rootkits. At the apex the malicious hacker toolset--which includes decompilers, disassemblers, fault-injection engines, kernel debuggers, payload collections, coverage tools, and flow analysis tools--is the rootkit. Beginning where Exploiting Software left off, this book shows how attackers hide in plain sight.
"Rootkits are extremely powerful and are the next wave of attack technology. Like other types of malicious code, rootkits thrive on stealthiness. They hide away from standard system observers, employing hooks, trampolines, and patches to get their work done. Sophisticated rootkits run in such a way that other programs that usually monitor machine behavior can't easily detect them. A rootkit thus provides insider access only to people who know that it is running and available to accept commands. Kernel rootkits can hide files and running processes to provide a backdoor into the target machine.
"Understanding the ultimate attacker's tool provides an important motivator for those of us trying to defend systems. No authors are better suited to give you a detailed hands-on understanding of rootkits than Hoglund and Butler. Better to own this book than to be owned."
"--Gary McGraw, Ph.D., CTO, Cigital, coauthor of" Exploiting Software "(2004) and" Building Secure Software "(2002), both from Addison-Wesley"
"Greg and Jamie are unquestionably the go-to experts when it comes to subverting the Windows API and creating rootkits. These two masters come together to pierce the veil of mystery surrounding rootkits, bringing this information out of the shadows. Anyone even remotely interested in security for Windows systems, including forensic analysis, should include this book very high on their must-read list."
"--Harlan Carvey, author of" Windows Forensics and Incident Recovery "(Addison-Wesley, 2005)"
Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them. Rootkit.com's Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology--learn how attackers can get in and stay in for years, without detection.
Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. Using extensive downloadable examples, they teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers.
After reading this book, readers will be able toUnderstand the role of rootkits in remote command/control and software eavesdroppingBuild kernel rootkits that can make processes, files, and directories invisibleMaster key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objectsWork with layered drivers to implement keyboard sniffers and file filtersDetect rootkits and build host-based intrusion prevention software that resists rootkit attacks
Visit rootkit.com for code and programs from this book. The site also contains enhancements to the book's text, such as up-to-the-minute information on rootkits available nowhere else.
About the Author
Greg Hoglund has been a pioneer in the area of software security. He is CEO of HBGary, Inc., a leading provider of software security verification services. After writing one of the first network vulnerability scanners (installed in over half of all Fortune 500 companies), he created and documented the first Windows NT-based rootkit, founding rootkit.com in the process. Greg is a frequent speaker at Black Hat, RSA, and other security conferences.
James Butler, Director of Engineering at HBGary, has a world-class talent for kernel programming and rootkit development and extensive experience in host-based intrusion-detection systems. He is the developer of VICE, a rootkit detection and forensics system. Jamie's previous positions include Senior Security Software Engineer at Enterasys and Computer Scientist at the National Security Agency. He is a frequent trainer and speaker at Black Hat security conferences. He holds a masters of computer science from the University of Maryland, Baltimore County. He has published articles in the IEEE Information Assurance Workshop, Phrack, USENIX ;login:, and Information Management and Computer Security.
Top Customer Reviews
The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.
The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).
By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided.Read more ›
Once again, the Addison-Wesley team demonstrates excellence, I found a couple of sentences that could benefit from a rewrite, but no grammar or spelling errors. The charts and code examples are done well and the layout never detracts from the message.
I enjoyed learning about the VICE, patchfinder 2 and Rootkit Revealer tools and can't wait to run them on some of the older laptops in the company that have been used as loaners. I expect that will be revealing!
This was the clearest explanation I have ever seen as to how networking is managed using the Transport Data Inferface. Even so, it still left me just a bit "hungry" and I hope this section is expanded in the second edition of this book.
What impressed me the most though was when the authors reached the limits of their knowledge, after all, this is a developing art and no one understands everything, with areas such as microcode update they simply and frankly stated that.
Clear, pragmatic, authoritative, what's not to like, buy this book.
The authors start with `Understanding Attackers' Motives' and what Rootkits are and aren't, and work they way through Rootkit designs, hardware interaction, hooking into kernel and user, `Direct Kernel Object Manipulation', `Hardware Manipulation', covert techniques and ways to identify Rootkits on your systems.
The authors in-depth knowledge of Rootkits is clearly demonstrated early on when they walk through creating a loadable module, or device/kernel driver. Through this process, they take the time to explain each line, how it manipulates the system, and how it could be used maliciously.
Throughout most of the book, the authors give very detailed examples, lines of code and other evidence supporting the theories and processes presented here. The book is written in a way that they leave little to the imagination and provide hard evidence to support the thought.
The book ends with Rootkit detection, which is the only way to end a book on malicious software. Now that they have taught one how to manipulate and hijack system, here is what one can do to protect the systems they are responsible for, and identify these malicious codes on ones systems. They describe scanning memory, identifying different types of hooks, and again provide some code for one to use to help with these processes.Read more ›
Contents: Leave No Trace; Subverting the Kernel; The Hardware Connection; The Age-Old Art of Hooking; Runtime Patching; Layered Drivers; Hardware Manipulation; Covert Channels; Rootkit Detection; Index
Hoglund and Butler have devoted a lot of time to understanding how the Windows kernel works, as well as how rootkits can be utilized to manipulate the kernel. This knowledge led to the website rootkit.com, and subsequently to this book. They explore the definition of rootkits, how they work, and how they can remain hidden from detection. Using the C language, they go into great depth on how rootkit kernel manipulation can be accomplished. If you have a basic knowledge of C, you'll be able to follow along and learn the intricacies of the kernel.
It'd be tempting to wonder why all this dangerous knowledge should be put in book form for junior hackers to use. For one, this isn't script kiddy material. If you don't know how to program (and in C), the book is basically far over your head. I suppose if you were bent towards building your own rootkit for world domination, this material would help. But in reality, this information is probably already accessible to those who would abuse it in the first place. Having a compiled volume of the information helps "the good guys" understand the risks involved as well as how you can protect yourself from rootkit attacks in your own environment.
While programming geeks will likely get the most value from this book, all security experts need to understand the concepts covered here. The worst thing isn't finding out you've been "owned" with a rootkit on your network. It's *not* knowing the rootkit is there...
Most Recent Customer Reviews
This book is a must have for anyone working in it security. it is a sort of dark knowledge of windows programming. Read morePublished 10 months ago by William D
Extensive list of hooking and inline patching techniques, but it has otherwise become depreciated in new x64 Windows 8 -10 Operating Systems. Read morePublished 16 months ago by Jeremy Hecht
I won't even bother to proffer the fairly detailed critique that I offered for Scambray, yet another "Bible" in the Windows security space. There's no need for that. Read morePublished on June 14, 2014 by Bruce D. Wilner
This book was written in 2005, so a lot of things has changed. The techniques described in the book are still interesting, and will get you thinking the way a rootkit dev would... Read morePublished on April 8, 2014 by Reeko
I had read this book with the intentions of gaining a better understanding how advanced malware works on the Windows OS. Read morePublished on November 12, 2012 by Andrey Norin
Nice cover. Not recommended. Poorly written. Reads like a gamer wrote it, not a professional programmer. Neato ideas with a lot of fluff, no substance.Published on May 16, 2011 by edmin
With having so many stars, I thought this would be a great way to learn on making rootkits. It starts of easy at first, then looses you in a few pages , not explaining to which... Read morePublished on June 20, 2009 by Alexander Soroka