Day 2 Part 4: Rootkits: What they are, and how to find them
Channel: OpenSecurityTraining2
Date: 14/04/2012

The class materials are available at http://www.OpenSecurityTraining.info/Rootkits.html
Follow us on Twitter for class news @OpenSecTraining.
The playlist for this class is here: http://bit.ly/HLkPVG
The full quality video can be downloaded at http://archive.org/details/opensecuritytraining

It is recommended to take the 
Introductory Intel x86(playlist:http://bit.ly/IILMeN), 
Intermediate Intel x86(playlist:http://bit.ly/HIaD4O), and 
Life of Binaries (playlist:http://bit.ly/HTWlef) before this class.

Rootkits are a type of malware which are dedicated to hiding the attacker's presence on a compromised system. This two-day class by Xeno Kovah will focus on understanding how Windows rootkits and stealth malware work, and what tools can be used to help find them.This will be a very hands-on class where we talk about specific techniques which rootkits use, and then do labs where we show how a proof of concept rootkit is able to hide things from a defender. Example techniques include:
*Trojaned binaries
*Inline hooks
*Import Address Table (IAT) hooking
*System Call Table/System Service Descriptor Table (SSDT) hooking
*Interrupt Descriptor Table (IDT) hooking
*Direct Kernel Object Manipulation (DKOM)
*Kernel Object Hooking (KOH)
*IO Request Packet (IRP) filtering
*Hiding files/processes/open ports
*Compromising the Master Boot Record (MBR) to install a "bootkit"

The class will help the student learn which tools to use to look for rootkits on Windows systems, how to evaluate the breadth of a tool's detection capabilities, and how to interpret tool results.