Spotlight customer reviews:
|
Customer Rating: 
Summary: Required reading for security professionals and developers...
Comment: I don't think I've ever seen a book as detailed as this on "subverting" an operating system... Rootkits - Subverting The Windows Kernel by Greg Hoglund and James Butler.
Contents: Leave No Trace; Subverting the Kernel; The Hardware Connection; The Age-Old Art of Hooking; Runtime Patching; Layered Drivers; Hardware Manipulation; Covert Channels; Rootkit Detection; Index
Hoglund and Butler have devoted a lot of time to understanding how the Windows kernel works, as well as how rootkits can be utilized to manipulate the kernel. This knowledge led to the website rootkit.com, and subsequently to this book. They explore the definition of rootkits, how they work, and how they can remain hidden from detection. Using the C language, they go into great depth on how rootkit kernel manipulation can be accomplished. If you have a basic knowledge of C, you'll be able to follow along and learn the intricacies of the kernel.
It'd be tempting to wonder why all this dangerous knowledge should be put in book form for junior hackers to use. For one, this isn't script kiddy material. If you don't know how to program (and in C), the book is basically far over your head. I suppose if you were bent towards building your own rootkit for world domination, this material would help. But in reality, this information is probably already accessible to those who would abuse it in the first place. Having a compiled volume of the information helps "the good guys" understand the risks involved as well as how you can protect yourself from rootkit attacks in your own environment.
While programming geeks will likely get the most value from this book, all security experts need to understand the concepts covered here. The worst thing isn't finding out you've been "owned" with a rootkit on your network. It's *not* knowing the rootkit is there...
Customer Rating:
Summary: Man, how do you describe this book ???
Comment: I needed info on developing and using Windows drivers, and bought this on a whim. It's a great source of info on how drivers are SUPPOSED to work and on how they CAN work in the wrong hands. Has code examples, and is a total winner.
Customer Rating:
Summary: So who exactly will use this book?
Comment: It is rare to see a book as detailed as this on infiltrating a Microsoft machine. Hoglund and Butler give a serious, hard core technical account of several ways to subvert the operating system by the successful installation and running of a rootkit. A slight irony here. The "root" in rootkit refers to the super user's account name on a unix machine. But the market reality is that Microsoft machines dominate the desktop.
A key appeal of the book is the amount of example code that helps you, the programmer, understand how a rootkit works. While the book certainly gives good high level descriptions of rootkit strategies, the examples make these flesh.
To some of you, it will be saddening to see that certain sections of the book omit those examples. Possibly the authors wanted to veer on the side of caution on those topics.
There does seem to be a slight tension in the book, regarding who would use it. Black hats or white hats. The authors stoutly claim that sometimes you can have perfectly good reasons to design and deploy a rootkit. Granted. But undoubtedly, others will derive nefarious utility from the text.
Customer Rating:
Summary: One of a kind
Comment: This is one of those very rare books that reveals for the first time in one place all of the material that is so very hard to obtain from other sources.
Just like "Hacking Exposed" was the first successful security book to reveal what many people feared to disclose yet was already known to the "underground", "Rootkits" packages some of the deepest knowledge on the subject in a relatively readable format. Some of the stuff here, such as programming the TDI API is documentation you will find nowhere else in such an accessible manner.
Recognized experts in their field, Greg Hoglund and James Butler should be commended on creating a must-read book for any security conscious programmer or person wanting a better understanding of this apparently (to some) new field.
Robin Keir
Chief Scientist
Foundstone, Inc.
A division of McAfee, Inc.
Customer Rating:
Summary: be an elite hacker d00d!
Comment: Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.
The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.
The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).
By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.
In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.
I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.
In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up rootkit.com, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.
My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.
Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.
|
|
|
