The Virtual Bookcase for browsing and sharing reviews of books. New to this site? Read the welcome page first.

The Virtual Bookcase Home
Recent reviews
Collected book news
Welcome to this site

Book details of 'Rootkits : Subverting the Windows Kernel'

Cover of Rootkits : Subverting the Windows Kernel
TitleRootkits : Subverting the Windows Kernel
Author(s)Greg Hoglund, Jamie Butler
ISBN0321294319
LanguageEnglish
PublishedJuly 2005
PublisherAddison-Wesley Professional
Web links for this book
Search at Bookcrossing.com
Wikipedia booksources
Shop for this book
At Amazon.co.uk
As an Amazon Associate I earn from qualifying purchases

Back to shelf Computer security

Score:

Vote for this book

The Virtual Bookcase Reviews of 'Rootkits : Subverting the Windows Kernel':

Reviewer Rob Slade wrote:
The preface (and therefore the book) begins with a definition of a rootkit. The authors proceed to outline their initial interest in the phenomenon, and any security professional who understands the centrality of system internals can begin to see the importance of the work. Chapter one addresses a major selling point (in the blackhat mindset) for rootkits: the evasion of detection. Concentrating on this aspect, the material outlines what a rootkit is, and is not, noting also that the programs need not be limited to illegal activities but do have legitimate uses. Subversion of the core of the operating system is examined in chapter two, although this is limited to the creation of device drivers. (This chapter again raises the issue of whether a book investigating the breaking of a system can provide valuable advice when it comes to protecting computers. While some works do, Hoglund having created an example in "Exploiting Software" [cf. BKEXPLSW.RVW] along with Gary McGraw, this particular material concentrates on items of interest in the process of producing rootkits. The limited sections dealing with more theoretical considerations would be those of greater interest to the security community.) Chapter three explores some hardware related items, although there are others that could be perused, and most of those surveyed may be initiated in hardware, but operate primarily in the software realm. Hooking of interrupts and functions is covered in chapter four, at both a kernel and user level. Chapter five reviews various means of directly patching software. (Much of this material should be familiar for those who have studied operations of older viruses.) The interception techniques addressed in chapter four are extended, in chapter six, to include adding new "layers" to existing device drivers. The operating system kernel uses data and other resources in order to perform properly, and chapter seven shows that manipulating these objects can modify the actions of the machine. Although nominally about hardware, chapter eight really concentrates on the patching of firmware. Chapter nine examines covert channels, but the explanation is quite poor, and most of the space is dedicated to listings of program code. Rootkit detection is discussed in chapter ten. It is interesting to note that analogies of antiviral change detection and activity monitoring are mentioned, but there is no consideration of signature scanning. "Rootkits" does raise a number of interesting topics, and much of the material could be of use to those charged with protecting systems. However, the content is not as valuable as that presented in "Exploiting Software." There is, of course, much that will be of assistance for those writing legitimate rootkits, but this would be a fairly limited audience. copyright Robert M. Slade, 2005

Add my review for Rootkits : Subverting the Windows Kernel
Search The Virtual Bookcase

Enter a title word, author name or ISBN.

The shelves in The Virtual Bookcase

Arts and architecture (25)
Biography (24)
Business and Management (120)
Cars and driving (53)
Cartoons (45)
Children's books (180)
Computer (475)
Computer history/fun (113)
Computer networks (382)
Computer programming (215)
Computer security (272)
Cook books (89)
Fantasy (154)
Fiction (446)
Health and body (71)
History (138)
Hobby (37)
Horror (65)
Humorous books (52)
Literature (57)
Operating systems (94)
Outdoor camping (162)
Outdoors (236)
Politics (85)
Privacy (61)
Psychology (55)
Religion (17)
Science (113)
Science Fiction (156)
Self-help books (56)
Technology (14)
Travel guides (308)
War and weapons (29)
World Wide Web (213)
Zen (5)
Other books (89)

The Virtual Bookcase is created and maintained by Koos van den Hout. Contact e-mail webmaster@virtualbookcase.com.
Site credits
Copyright © 2000-2020 Koos van den Hout / The Virtual Bookcase Copyright and privacy statement