Designing BSD Rootkits: An Introduction to Kernel Hacking (英語) ペーパーバック – 2007/4
Kindle 端末は必要ありません。無料 Kindle アプリのいずれかをダウンロードすると、スマートフォン、タブレットPCで Kindle 本をお読みいただけます。
Though rootkits have a fairly negative image, they can be used for both good and evil. Designing BSD Rootkits arms you with the knowledge you need to write offensive rootkits, to defend against malicious ones, and to explore the FreeBSD kernel and operating system in the process.
Organized as a tutorial, Designing BSD Rootkits will teach you the fundamentals of programming and developing rootkits under the FreeBSD operating system. Author Joseph Kong's goal is to make you smarter, not to teach you how to write exploits or launch attacks. You'll learn how to maintain root access long after gaining access to a computer and how to hack FreeBSD.
Kongs liberal use of examples assumes no prior kernel-hacking experience but doesn't water down the information. All code is thoroughly described and analyzed, and each chapter contains at least one real-world application.
Hack the FreeBSD kernel for yourself!
The author of Designing BSD Rootkits (No Starch Press), Joseph Kong works on information security, operating system theory, reverse code engineering, and vulnerability assessment. Kong is a former system administrator for the City of Toronto.
It's based on FreeBSD 6.0 32-bit. No one really uses FreeBSD so why even bother studying rootkits on this platform? As of 2015, this release has long been EOL'ed. Now days, 32-bit is just a bad choice for anything but academic study. But you know this before you buy the book. What you don't know, if like me you have never used BSD, is that BSD is really not that similar to Linux. Yes, it works the same, but all the libs are different. Almost none of the C system libs you would use on Linux exist on FreeBSD. And, if they do, its almost in name only as the API is different.
I believe most of the disappointment comes from my lack of ever using BSD before. Installing it was a PITA and updating it is even more confusing since the system uses both ports and a package system. Writing C in FreeBSD, as mentioned, is also a rude awakening to anyone only familiar with Linux or Windows. Most all the libs you are familiar with are not there. Time to re-learn everything. A chapter dedicated to setting up the OS and environment would have been really nice. A crash course chapter on C programming on BSD would have been nice too.
Finally, the errata page is virtually non-existent. Not a single update for newer releases of the OS or for 64-bit solutions. There is two entries, for typos made in the book. That's all.
The ideas: creating LKM, hooking syscalls, DKOM, kernel patching, etc. are all great academic gems, but since porting this knowledge over to a modern, popular OS is non-trivial, I am going to have to say this book is purely academic. Don't get it if you want something practical.
DBR covers much of the same sorts of material found in the earlier Rootkits: Subverting the Windows Kernel by Greg Hoglund and James Butler, except Kong's book is all about FreeBSD. I actually read the Windows text first, but found Kong's more direct language and examples easier than the Hoglund/Butler text. After reading DBR I have a stronger understanding of each of the main chapters' techniques, i.e., kernel modules, hooking, direct kernel object manipulation, kernel object hooking, run-time kernel memory patching, and detection mechanisms. I particularly liked the author showing his sample rootkit's effectiveness against Tripwire, simply to demonstrate his methods.
DBR follows another tenet of great books: it credits previous work. Several times in the text Kong says where he learned a technique or what code he's modifying to do his bidding. This should serve as an example to other technical authors. Kong also does not treat his subject matter as a dark art practiced by people in long black coats at Def Con. He is professional and mentions where certain techniques like run-time kernel memory patching are used by commercial operating systems for "hot patching," as happens with Windows.
I have nothing bad to say about this book, although to get the absolute full learning experience it helps to know C programming, some assembly, and FreeBSD kernel internals. The Design and Implementation of the FreeBSD Operating System by McKusick and Neville-Neil (another excellent book) is helpful preparatory reading. The fact that Kong provided all of his source code for download is also very much appreciated. Bravo! I look forward to your next book.
- 洋書 > Computers & Technology > Internet & Web Culture > Hacking
- 洋書 > Computers & Technology > Networking > Internet, Groupware, & Telecommunications
- 洋書 > Computers & Technology > Operating Systems > BSD
- 洋書 > Computers & Technology > Programming > Languages & Tools
- 洋書 > Computers & Technology > Security & Encryption > Encryption
- 洋書 > Education & Reference