Stealth by Design (SbD) Malware & RK's etc

StevieO · Jan 30, 2006

She's been globetrotting and busy once again, and it all sounds very interesting. I've done some homework for you too, so if you don't have the required bits and pieces, i've provided the extra needed links to them.

. . .

Joanna Rutkowska said:

Rootkits vs. Stealth by Design malware... by Joanna Rutkowska

The presentation I gave in Washington, D.C., at Black Hat Federal Conference in January 2006. It's about new generation of stealth malware, so called Stealth by Design (SbD) malware, which doesn't use any of the classic rootkit technology tricks, but still offers full stealth! The presentation also focuses on limitations of the current anti-rootkit technology and why it’s not useful in fighting this new kind of SbD malware. Consequently, alternative method for compromise detection is advocated in this presentation, Explicit Compromise Detection (ECD), as well as the challenges which Independent Software Vendors encounter when trying to implement ECD for Windows systems.

ECD approach is used by tools like VICE, SVV and MS’s Patch Guard. Out of these tools only PG avoids MRP problem, as it was build by MS itself and the PG team was aware of how to avoid MRP (which seems to be impossible for ISV today).

With this new SVV you should be able to detect all the Apropos modifications (some of them were not detectable by SVV 1.x), Eeye Bootroot, Shadow Walker and many more of the type I malware.

Please note though, that SVV is not able to detect the malware which I presented during the presentation, mostly because it was type II malware and because of the MRP.
Click to expand...

Microsoft PPT format.

And you can also get AVI demos (10MB): ( ffdshow required )

http://invisiblethings.org/papers.html

Free ffdshow codec.

ffdshow is DirectShow and VFW codec for decoding/encoding many video and audio formats, including DivX and XviD movies using libavcodec, xvid and other opensourced libraries with a rich set of postprocessing filters.

http://sourceforge.net/project/showfiles.php?group_id=53761

Free MS PPT viewer.

http://www.microsoft.com/downloads/...8E-5513-46C4-AA4F-058A84A37DF1&displaylang=EN

SVV = System Virginity Verifier v2.2 Free

http://invisiblethings.org/tools.html

StevieO

Log in or Sign up

Stealth by Design (SbD) Malware & RK's etc

StevieO Guest

Log in or Sign up

Stealth by Design (SbD) Malware & RK's etc

StevieO Guest

Useful Searches