Detecting kernel-level rootkits through binary analysis

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2004, Pages 91-100

  Kruegel, Christopher ^a   Robertson, William ^b   Vigna, Giovanni ^b  

^a VIENNA UNIVERSITY OF TECHNOLOGY   (Austria)

^b UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BINARY ANALYSIS; COMPUTER OPERATING SYSTEMS - LINUX; COMPUTER OPERATING SYSTEMS - SOLARIS; ROOTKITS;

DATA STRUCTURES; MATHEMATICAL MODELS; SPECIFICATIONS; STATISTICAL METHODS; TELECOMMUNICATION SERVICES; UNIX;

SECURITY OF DATA;

EID: 21644451617     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (17)

1. A. Aho, R. Sethi, and J. Ullman. Compilers - Principles, Techniques, and Tools. World Student Series of Computer Science. Addison Wesley, 1986.
2. S. Aubert. rkscan: Rootkit Scanner. http://www.hsc.fr/ressources/outils/rkscan/index. html. en, 2004.
3. Black Tie Affair. Hiding Out Under UNIX. Phrack Magazine, 3(25), 1989.
4. FuSyS. Kstatv. 1.1-2. http://s0ftpj.org/, November 2002.
5. grsecurity. An innovative approach to security utilizing a multi-layered detection, prevention, and containment model. http://www.grsecurity.net/, 2004.
6. Halflife. Abuse of the Linux Kernel for Fun and Profit. Phrack Magazine, 7(50), April 1997.
7. G. Kim and E. Spafford. The Design and Implementation of Tripwire: A File System Integrity Checker. Technical report, Purdue University, Nov. 1993.
8. T. Lawless. St. Michael and St. Jude. http://sourceforge.net/projects/stjude/, 2004.
9. T. Miller. T0rn rootkit analysis, http://www.ossec.net/rootkits/studies/t0rn.txt.
10. T. Miller. Analysis of the KNARK Rootkit. http://www.ossec.net/rootkits/studies/knark.txt, 2004.
11. N. Murilo and K. Steding-Jessen. Chkrootkit v. 0.43. http://www.chkrootkit.org/.
12. D. Safford. The Need for TCPA. IBM White Paper, October 2002.
13. sd and devik. Linux on-the-fly kernel patching without LKM. Phrack Magazine, 11(58), 2001.
14. Stealth, adore, http://spider.scorpions.net/~stealth, 2001.
15. Stealth. Kernel Rootkit Experiences and the Future. Phrack Magazine, 11(61), August 2003.
16. Stealth. adore-ng. http://stealth.7350.org/rootkits/, 2004.
17. TCG. Trusted Computing Group Home. https://www.trustedcomputinggroup.org/home, 2004.