|
|
Generic Detection of Bootkits
Gach, Tomáš ; Křoustek, Jakub (referee) ; Hruška, Tomáš (advisor)
This thesis deals with the generic detection of bootkits which are relatively a new kind of malicious sofware falling into the category of rootkits. The definition of malicious software is presented along with several examples. Then the attention is paid to the rootkits in the context of Microsoft Windows operating systems. This section lists several techniques used by rootkits. After that, the ways of preventing and detecting rootkits are mentioned. Bootkits are known for infecting hard disks Master Boot Record (MBR). The structure of the MBR is described along with the example of hard disk partitioning. Afterwards, the processor instruction set is outlined and the disassembly of Windows 7 MBR is given. The rest of the thesis is devoted to a description of the course of operating system bootkit infection, bootkit prevention, analysis of infected MBR samples, and in particular to the design, implementation and testing of the generic MBR infection detector.
|
|
|
Uncovering of rootkits and detection of spyware
Juras, Stanislav ; Pelka, Tomáš (referee) ; Polívka, Michal (advisor)
Bachelor’s thesis is about uncovering of rootkit and detection of spyware. It describes the basic types of known spyware and rootkits. Section dealing with spyware is especially about a description of each species. In case of rootkit the thesis is mainly about description of modes and the manner of their infection. There are also outlined attempts to use legal rootkit. In other case there are summarized the basic methods of rootkit and spyware detection, which are commonly used in various detection programs. The second part of thesis is practical implementation (the program) of one of the methods of spyware detection. The program is designed to be able to detect a simple pattern of spyware, which is stored in its database. The program uses the file signature detection. It contains also the graphical user interface, where is possible to choose a unit that user want to test.
|
|
|
Rootkits Classification
Plocek, Radovan ; Křoustek, Jakub (referee) ; Hruška, Tomáš (advisor)
This paper describes information about current most widespread methods, which are used by rootkits. It contains basic information connected with development of rootkits, such as process registers, memory protection and native API of Windows operation system. The primary objective of this paper is to provide overview of techniques, such as hooking, code patching and direct kernel object modification, which are used by rootkits and present methods to detect them. These methods will be then implemented by detection and removal tools of rootkits based on these techniques.
|
|
|
Rootkits Classification
Plocek, Radovan ; Křoustek, Jakub (referee) ; Hruška, Tomáš (advisor)
This paper describes information about current most widespread methods, which are used by rootkits. It contains basic information connected with development of rootkits, such as process registers, memory protection and native API of Windows operation system. The primary objective of this paper is to provide overview of techniques, such as hooking, code patching and direct kernel object modification, which are used by rootkits and present methods to detect them. These methods will be then implemented by detection and removal tools of rootkits based on these techniques.
|
|
|
Generic Detection of Bootkits
Gach, Tomáš ; Křoustek, Jakub (referee) ; Hruška, Tomáš (advisor)
This thesis deals with the generic detection of bootkits which are relatively a new kind of malicious sofware falling into the category of rootkits. The definition of malicious software is presented along with several examples. Then the attention is paid to the rootkits in the context of Microsoft Windows operating systems. This section lists several techniques used by rootkits. After that, the ways of preventing and detecting rootkits are mentioned. Bootkits are known for infecting hard disks Master Boot Record (MBR). The structure of the MBR is described along with the example of hard disk partitioning. Afterwards, the processor instruction set is outlined and the disassembly of Windows 7 MBR is given. The rest of the thesis is devoted to a description of the course of operating system bootkit infection, bootkit prevention, analysis of infected MBR samples, and in particular to the design, implementation and testing of the generic MBR infection detector.
|
|
|
Uncovering of rootkits and detection of spyware
Juras, Stanislav ; Pelka, Tomáš (referee) ; Polívka, Michal (advisor)
Bachelor’s thesis is about uncovering of rootkit and detection of spyware. It describes the basic types of known spyware and rootkits. Section dealing with spyware is especially about a description of each species. In case of rootkit the thesis is mainly about description of modes and the manner of their infection. There are also outlined attempts to use legal rootkit. In other case there are summarized the basic methods of rootkit and spyware detection, which are commonly used in various detection programs. The second part of thesis is practical implementation (the program) of one of the methods of spyware detection. The program is designed to be able to detect a simple pattern of spyware, which is stored in its database. The program uses the file signature detection. It contains also the graphical user interface, where is possible to choose a unit that user want to test.
|
guest ::
