BKROOTKT.RVW   20051023

"Rootkits", Greg Hoglund/James Butler, 2006, 0-321-29431-9,
U$44.99/C$62.99
%A   Greg Hoglund
%A   James Butler
%C   P.O. Box 520, 26 Prince Andrew Place, Don Mills, Ontario  M3C 2T8
%D   2006
%G   0-321-29431-9
%I   Addison-Wesley Publishing Co.
%O   U$44.99/C$62.99 416-447-5101 fax: 416-443-0948 bkexpress@aw.com
%O  http://www.amazon.com/exec/obidos/ASIN/0321294319/robsladesinterne
  http://www.amazon.co.uk/exec/obidos/ASIN/0321294319/robsladesinte-21
%O   http://www.amazon.ca/exec/obidos/ASIN/0321294319/robsladesin03-20
%O   Audience s+ Tech 3 Writing 2 (see revfaq.htm for explanation)
%P   324 p.
%T   "Rootkits: Subverting the Windows Kernel"

The preface (and therefore the book) begins with a definition of a
rootkit.  The authors proceed to outline their initial interest in the
phenomenon, and any security professional who understands the
centrality of system internals can begin to see the importance of the
work.

Chapter one addresses a major selling point (in the blackhat mindset)
for rootkits: the evasion of detection.  Concentrating on this aspect,
the material outlines what a rootkit is, and is not, noting also that
the programs need not be limited to illegal activities but do have
legitimate uses.  Subversion of the core of the operating system is
examined in chapter two, although this is limited to the creation of
device drivers.  (This chapter again raises the issue of whether a
book investigating the breaking of a system can provide valuable
advice when it comes to protecting computers.  While some works do;
Hoglund, along with Gary McGraw, having created an example in
"Exploiting Software" [cf. BKEXPLSW.RVW]; this particular material
concentrates on items of interest in the process of producing
rootkits.  The limited sections dealing with more theoretical
considerations would be those of greater interest to the security
community.)  Chapter three explores some hardware related items,
although there are others that could be perused, and most of those
surveyed may be initiated in hardware, but operate primarily in the
software realm.

Hooking of interrupts and functions is covered in chapter four, at
both a kernel and user level.  Chapter five reviews various means of
directly patching software.  (Much of this material should be familiar
for those who have studied operations of older viruses.)  The
interception techniques addressed in chapter four are extended, in
chapter six, to include adding new "layers" to existing device
drivers.  The operating system kernel uses data and other resources in
order to perform properly, and chapter seven shows that manipulating
these objects can modify the actions of the machine.  Although
nominally about hardware, chapter eight really concentrates on the
patching of firmware.  Chapter nine examines covert channels, but the
explanation is quite poor, and most of the space is dedicated to
listings of program code.  Rootkit detection is discussed in chapter
ten.  It is interesting to note that analogies of antiviral change
detection and activity monitoring are mentioned, but there is no
consideration of signature scanning.

"Rootkits" does raise a number of interesting topics, and much of the
material could be of use to those charged with protecting systems. 
However, the content is not as valuable as that presented in
"Exploiting Software."  There is, of course, much that will be of
assistance for those writing legitimate rootkits, but this would be a
fairly limited audience.

copyright Robert M. Slade, 2005   BKROOTKT.RVW   20051023