资源描述：
《黑客特技隐身技术与僵尸网络.pdf》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。
1、HONGKONG.November.2006WEFINDTHEMBEFORETHEYFINDYOU.黑客特技隱身技術與殭屍網絡LawrenceTsuiManager,ProfessionalServicesDatalinkBusinessSolutionsTheReality:TodayWhatisa“Rootkit”隱身技術?°OriginallyreferredtoasetofrecompiledUnixtool°“Arootkitisatoolthatisdesignedtohideitselfandotherprocesses,data,a
2、nd/oractivityonasystem.“–G.Hoglund(www.rootkit.com)°Atoolkitusedforpreservationofremoteaccessor“root”°“Atoolusedtoprotectbackdoorsandothertoolsfromdetectionbyadministrators”Natureof“Rootkit”°Rootkitisnot–Anexploitofanykind–Compromiseahostbyitself–Gainaccesstoasystem,buttoprese
3、rveexistingaccess–Avirusorworm°Rootkithideprocesses,ports,files,andotherresourcesfromtheOSandsecurityprogramsWhyShouldYouCare?°Rootkitsrepresentoneofthegreatestthreatstonetworksecurity,yetmostadminsareunawareoftheirpresence–OSindependent–Undetectable–Symptom-free–Nearimpossibl
4、etoremove–Dangerouspayloads•Keyloggers•PasswordSnatchers•RemoteConsoles•Andmore!°NewviruseswillusenewrootkittechnologyHowRootkitsWork?°Compromisedsystemexposed–unpatched,zerodayexploit,poorconfiguration,etc.°Malwareexploitshost–virus,worm,spyware,etc.°Installspayload–keylogger
5、,FTPserver,remoteshell,etc.°Activatesrootkit–hooksintoOSAPIlibraries–redirectssystemcallsthroughitself–preventsOSfrom“seeing”processesandfilesEVENAFTERhostispatchedandoriginalmalwareisremovedHowRootkitsWork?docsrootkitwindowswindowsrootkitfiltersresultstohideitselfRootkitDLLdi
6、rc:docsReadFile()rootkitwindowsDLL“tricked”intoNTFScommandthinkingitcan’texecutecommand,callsrootkitC:Case:Rootkit°Cametopubicawarenessin2005SonyBMGCDCopyProtection°Firstmainstreammediacoverageofarootkit°DiscoveredbyMarkRussinovichwhenusinghisrootkitdetectionsoftware°Used“ro
7、otkit”technologytoprotecttheircopyprotectionmechanismfromusers–Anythingthatwasnamed$SYSwashiddenfromthesystem,eventheAdministratorCommonRootkits°HackerDefender–Mostpopularrootkit–Avoidsantivirusdetection–IsabletohookintotheLogonAPItocapturepasswords–Youcanpaythedevelopersmoney
8、($100-$900)foracustomversionofthesoftwaretoavoidalldetectors°
