TDSS article

CloneRanger · Aug 5, 2010

Nice lengthy in depth article previously only in Russian.

TDSS

The TDSS rootkit first appeared in 2008. Since then, it has become far more widespread than the notorious rootkit Rustock. The rootkit’s malicious payload and the difficulties it presents for analysis are effectively similar to those of the bootkit. The bootkit infect (as its name suggests) infects the boot sector, ensuring that the malicious code is loaded prior to the operating system. TDSS implements the concept of infecting drivers; this means it is loaded and run at the very early stages of the operating system. This greatly complicates the detection of TDSS and makes removing it treatment a serious challenge.

http://www.securelist.com/en/analysis/204792131/TDSS
Click to expand...

wearetheborg · Aug 5, 2010

Thanks!

Boyfriend · Aug 5, 2010

I have just read the article. Very informative and thorough article. TDSS v3 sounds interesting (detect and remove) and much risky. Thanks for the link.

icr · Aug 5, 2010

Very informative info gonna help me alot in my presentation Thanks for the link

Rmus · Aug 5, 2010

Very detailed analysis. Thanks for posting.

----
rich

CloneRanger · Aug 6, 2010

Glad you liked it here's another which is goes into things in great detail, written by two guys from eSage Lab. They are the ones who have provided several very good TDSS removal tools

Andrew Rassokhin
Specialist Information Security
(eSage Lab) "Laboratory of Information Security» (eSage Lab)

Dmitry Oleksyuk
System Architect
(eSage Lab) "Laboratory of Information Security» (eSage Lab)

TDSS: full disclosure

Boat TDSS rootkit to date been well studied. ? However, none of the studies do not go beyond analyzing the code of the malware and the sources of its distribution. This article is intended to fill this gap by highlighting the underlying mechanisms of the botnet and its objective characteristics.

In addition, the publication of this material, we pursued another goal: to present a methodology for investigating computer crimes. This study demonstrates how, with just a tool in the hands of criminals (binary Trojan), get off at the digital core "kiberformirovaniya and analyze it. It should be noted that the approach can extract all the technical information about the incident, while the task of identifying individuals attackers and bring them to justice remains in the purview of law enforcement.

http://www.nobunkum.ru/issue003/tdss-botnet

http://translate.google.com/transla...ssue003/tdss-botnet/&sl=ru&tl=en&hl=&ie=UTF-8
Click to expand...

*

The translation isn't 100% perfect, but not far off.

Log in or Sign up

TDSS article

CloneRanger Registered Member

wearetheborg Registered Member

Boyfriend Registered Member

icr Registered Member

Rmus Exploit Analyst

CloneRanger Registered Member

Log in or Sign up

TDSS article

CloneRanger Registered Member

wearetheborg Registered Member

Boyfriend Registered Member

icr Registered Member

Rmus Exploit Analyst

CloneRanger Registered Member

Useful Searches