Full Disclosure mailing list archives
Reversing x64 TDSS at InfoSec Institute
From: "Adam Behnke" <adam () infosecinstitute com>
Date: Wed, 20 Apr 2011 14:00:58 -0500
Hello everyone, We have a new article series on x64 TDSS up at InfoSec Institute. The series discusses the first malware to reliably attach x64 operating systems such as Windows Vista and Windows 7. This technically advanced malware bypasses many protective measures in various operation systems and exploits the normal boot process. You can find the first article, in the series of three, here: http://resources.infosecinstitute.com/tdss4-part-1/ In this research we focused on the most interesting and exceptional features of the Win32/Olmarik bootkit. Special attention was paid to the bootkit functionality which appeared in TDL4 and enabled it to begin its launch process before the OS is loaded, as well as its ability to load an unsigned kernel-mode driver - even on systems with kernel-mode code signing policy enabled - and bypassing kernel-mode patch protection mechanisms. These characteristics all make TDL4's a prominent player on the malware scene. Your thoughts?
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Reversing x64 TDSS at InfoSec Institute Adam Behnke (Apr 20)