Edition DescriptionRevised edition
Table Of ContentPartPart I Foundation ChapterChapter 1 Empty Cup Mind ChapterChapter 2 Anti-Forensics Overview ChapterChapter 3 Hardware Briefing ChapterChapter 4 System Software Briefing ChapterChapter 5 Tools of the Trade ChapterChapter 6 Life in Kernel Space PartPart II Post-Mortem ChapterChapter 7 Defeating Disk Analysis ChapterChapter 8 Foiling Executable Analysis PartPart III Live Response ChapterChapter 9 Defeating Live Response ChapterChapter 10 Shellcode ChapterChapter 11 Modifying Call Tables ChapterChapter 12 Modifying Code ChapterChapter 13 Modifying Objects Kernel ChapterChapter 14 Covert Channels ChapterChapter 15 Going Out-of-Band PartPart IV Summation ChapterChapter 16 The Tao of Rootkits
SynopsisWhile forensic analysis has proven to be a valuable investigative tool in the field of computer security, utilizing anti-forensic technology makes it possible to maintain a covert operational foothold for extended periods, even in a high-security environment. Adopting an approach that favors full disclosure, the updated Second Edition of The Rootkit Arsenal presents the most accessible, timely, and complete coverage of forensic countermeasures. This book covers more topics, in greater depth, than any other currently available. In doing so the author forges through the murky back alleys of the Internet, shedding light on material that has traditionally been poorly documented, partially documented, or intentionally undocumented.The range of topics presented includes how to:-Evade post-mortem analysis-Frustrate attempts to reverse engineer your command & control modules-Defeat live incident response-Undermine the process of memory analysis-Modify subsystem internals to feed misinformation to the outside-Entrench your code in fortified regions of execution-Design and implement covert channels-Unearth new avenues of attack, While forensic analysis has proven to be a valuable investigative tool in the field of computer security, utilizing anti-forensic technology makes it possible to maintain a covert operational foothold for extended periods, even in a high-security environment. Adopting an approach that favors full disclosure, the updated Second Edition of The Rootkit Arsenal presents the most accessible, timely, and complete coverage of forensic countermeasures. This book covers more topics, in greater depth, than any other currently available. In doing so the author forges through the murky back alleys of the Internet, shedding light on material that has traditionally been poorly documented, partially documented, or intentionally undocumented.The range of topics presented includes how to: -Evade post-mortem analysis-Frustrate attempts to reverse engineer your command & control modules-Defeat live incident response-Undermine the process of memory analysis-Modify subsystem internals to feed misinformation to the outside-Entrench your code in fortified regions of execution-Design and implement covert channels-Unearth new avenues of attack, While forensic analysis has proven to be a valuable investigative tool in the field of computer security, utilizing anti-forensic technology makes it possible to maintain a covert operational foothold for extended periods, even in a high-security environment. Adopting an approach that favors full disclosure, the updated Second Edition of The Rootkit Arsenal presents the most accessible, timely, and complete coverage of forensic countermeasures. This book covers more topics, in greater depth, than any other currently available. In doing so the author forges through the murky back alleys of the Internet, shedding light on material that has traditionally been poorly documented, partially documented, or intentionally undocumented. The range of topics presented includes how to: -Evade post-mortem analysis -Frustrate attempts to reverse engineer your command & control modules -Defeat live incident response -Undermine the process of memory analysis -Modify subsystem internals to feed misinformation to the outside -Entrench your code in fortified regions of execution -Design and implement covert channels -Unearth new avenues of attack
LC Classification NumberQA76.9.A25B585 2012