full-disclosure - Reversing x64 TDSS at InfoSec Institute

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <009901cbff8d$48a537d0$d9efa770$@com>
Date: Wed, 20 Apr 2011 14:00:58 -0500
From: "Adam Behnke" <adam@...osecinstitute.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Reversing x64 TDSS at InfoSec Institute

Hello everyone,

We have a new article series on x64 TDSS up at InfoSec Institute. The series
discusses the first malware to reliably attach x64 operating systems such as
Windows Vista and Windows 7. This technically advanced malware bypasses many
protective measures in various operation systems and exploits the normal
boot process.

You can find the first article, in the series of three, here:

http://resources.infosecinstitute.com/tdss4-part-1/

In this research we focused on the most interesting and exceptional features
of the Win32/Olmarik bootkit. Special attention was paid to the bootkit
functionality which appeared in TDL4 and enabled it to begin its launch
process before the OS is loaded, as well as its ability to load an unsigned
kernel-mode driver - even on systems with kernel-mode code signing policy
enabled - and bypassing kernel-mode patch protection mechanisms. These
characteristics all make TDL4's a prominent player on the malware scene.

Your thoughts?

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/