Managed Code Rootkits : Hooking into Runtime Environments

by METULA EREZ

• ISBN13: 9781597495745
• ISBN10: 1597495743
• Format: Paperback
• Copyright: 2010-10-28
• Publisher: Elsevier Science Ltd

Summary

Imagine being able to change the language that a computer is running and taking over control. That is exactly what managed code rootkits can do when they are placed within a computer. This new type of rootkit is hiding in a place that had previously been safe from this type of attack, the application level. Code reviews do not currently look for back doors in the virtual machine (VM) where this new rootkit would be injected. An invasion of this magnitude allows an attacker to steal information on the infected computer, fixate encryption keys, and disable security checks. Author, Erez Metula shows the reader how these rootkits are developed and inserted and how this attack can change the managed code that it is running whether that be JAVA, .NET, or any other managed code. Management development scenarios, tools like .NET-Sploit, and countermeasures are covered to make this book a one stop shop for this new attack vector. Introduces the reader briefly to managed code environments and rootkits in general Completely details a new type of rootkit hiding in the application level and demonstrates how a hacker can change language runtime implementation Focuses on managed code including Java, .Net and reviews malware development scenarios