No abstract

No abstract

A fter breaking into a system, attackers usually install rootkits to create secret backdoors and cover their tracks. Unlike the name implies, rootkits don't provide root access. Instead, they arm attackers with stealth on already compromised systems. Stealthy operations hide processes, files, and connections that let an attacker sustain long-term access without alerting system administrators. (See the "Rootkit 101" sidebar for more details on rootkits.) Fortunately, most rootkits suffer from a lack of covertness and secrecy within their binaries. This lets administrators with access to the binary, or kernel, memory, analyze it for suspicious string and symbol characteristics. They can extract the strings and symbols and determine what attackers are doing to their systems. Unfortunately, attackers can avoid analysis by using code-obfuscation techniques that make it difficult for system administrators to detect and analyze kernel rootkits. Merely looking at symbol-table and text-segment information, which contains function names, variables, and strings contained in a program, provides valuable insight into rootkits (and even nonmalicious programs) that do not employ obfuscation. In this article, we show how software developers can use obfuscation techniques to fight attackers who reverseengineer or illegally distribute commercial-software.

No abstract

No abstract