full-disclosure - Re: Full-Disclosure Digest, Vol 89, Issue 15 suspicion of rootkit (Alexandru Balan)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <24416AE8-9F5E-4323-B53A-647F8DAFA254@phocean.net>
Date: Thu, 12 Jul 2012 18:47:53 +0200
From: phocean <0x90@...cean.net>
To: Григорий Братислава
	<musntlive@...il.com>
Cc: "Mikhail A. Utin" <mutin@...monwealthcare.org>,
	full-disclosure@...ts.grok.org.uk, Valdis.Kletnieks@...edu
Subject: Re: Full-Disclosure Digest, Vol 89,
	Issue 15 suspicion of rootkit (Alexandru Balan)

Yes, maybe WinDbg… Not that I am confortable with WinDBG, but certainly a good chance to learn and get more familiar.

However:

- Volatility: anything has to sit somehow in the memory, so there is no way for it to escape from the analysis. It has all advantages of offline analysis. I don't think Volatility is script kiddy stuff. I think it is a great tool and should be enough for my concern.

- WinDBG: here we are doing live analysis, with all the difficulties it implies. It is long and painful. You have to read damn a lot of assembly, thousands of calls, decide to step into or step over, when and based on what assumptions, etc.
Of course, perfect knowledge of the system internals is required. Difficulty will be raised if ever there are some anti-debugging protections. Respect to the people who can do it, they are artists, but is it really the most reasonable way to go?

--- phocean


Le 12 juil. 2012 à 18:22, Григорий Братислава a écrit :

> On Thu, Jul 12, 2012 at 12:09 PM, phocean <0x90@...cean.net> wrote:
>> Could you elaborate please?
>> What that I haven't done yet? If we agree there is nothing in the RAM dump,
>> how can we explain the artefacts?
>> 
>> Musntlive, I never trust any antivirus.
>> 
>> --- phocean
> 
> 0x00: MusntLive will always help you. .effmach x86 (or is whatever is
> your machine amd64, ia64) is your first friend. When you is run this,
> you come back and let MusntLive know. For then we must use !dml_proc
> and only is real hacker debug stuff. No script kid stuff. Only for
> when you is know WinDBG like is back of your hand is you Windows
> hacker. Not is Immunity or is Olly, this is these are for is how you
> say rookie. Now you is go dump with is effmach. Then is we can study
> this is yes with HB Gary memory tools. Because is HB Gary, if we know
> is find it, HB Gary is will find with is their backdoor into is their
> tools. We not worry, we find evil 1337 together.


Content of type "text/html" skipped

Download attachment "signature.asc" of type "application/pgp-signature" (842 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/