Linux Kernel Rootkits Instructor Dr Harold C Grossman

Agenda • • Introduction History Rootkit objectives Malware classification & Rootkit’s standing Specific rootkit

Introduction • What are rootkits? - tool to conceal information - hides files and

History • • • Ken Thompson’s work on exploitation Brain virus in 1986 Lane

Rootkit Objectives Based on the analysis of Nick Petroni and J. Hicks, the objectives

Malware Classification The following classification was suggested by Joanna Rutkowska in Black Hat 2006

Rootkit Features Common rootkit features are as below – • • File hiding Process

Rootkit Detection There are various ways of detecting Linux rootkits. Some of the detection

Conclusion In this presentation, we’ve provided a general overview of rootkits, basic rootkit attributes,

References Below is the list of references – 1. http: //en. wikipedia. org/wiki/Rootkit 2.

Slides: 12

Download presentation

Linux Kernel Rootkits Instructor: Dr. Harold C. Grossman Students: Jinwei Liu & Subhra S. Sarkar

Agenda • • Introduction History Rootkit objectives Malware classification & Rootkit’s standing Specific rootkit features Detection mechanisms Conclusion

Introduction • What are rootkits? - tool to conceal information - hides files and process - escapes detection - creates backdoor - enables hackers to remotely control infected machines

History • • • Ken Thompson’s work on exploitation Brain virus in 1986 Lane Davis & Steve Drake’s rootkit Sony BMG copy protection rootkit Greek wiretapping Carrier IQ rootkit on smartphone devices

Rootkit Objectives Based on the analysis of Nick Petroni and J. Hicks, the objectives of each rootkit fall into one or more of the following categories – • HID • PE • REC • NEU

Malware Classification The following classification was suggested by Joanna Rutkowska in Black Hat 2006 – 1. 2. 3. 4. Type 0 Malware Type 1 Malware Type 2 Malware Type 3 Malware

Rootkit Features Common rootkit features are as below – • • File hiding Process hiding Socket hiding Backdoor creation Auto-start after reboot Sophisticated layer of obfuscation Keystroke logging

Rootkit Detection There are various ways of detecting Linux rootkits. Some of the detection mechanisms are mentioned below – • • • LKM filtering HIDS LIDS State-based control-flow integrity test(SBCFI) Detection based on distribution of system calls (Anderson -Darling)

Conclusion In this presentation, we’ve provided a general overview of rootkits, basic rootkit attributes, their objectives, malware classification and rootkit’s standing in there and several detection mechanisms, both for user-space and kernel-space rootkits. Also, we briefly covered a comparative analysis of various rootkit detection mechanisms.

References Below is the list of references – 1. http: //en. wikipedia. org/wiki/Rootkit 2. http: //www. businessweek. com/technology/content/nov 2 005/tc 20051129_685454. htm 3. http: //www. huffingtonpost. com/2011/12/01/carrier-iqiphone-android-blackberry_n_1123575. html 4. http: //arch. ece. gatech. edu/people/Manoj. html 5. http: //dl. acm. org/citation. cfm? id=1315260 6. http: //packetstormsecurity. org/search/? q=phalanx 7. http: //citeseerx. ist. psu. edu/viewdoc/summary? doi=10. 1. 1. 134. 3527

Questions?

Thank You

Related presentations