Table Of Content™
Hacking Exposed Malware & Rootkits Reviews
“Accessible but not dumbed-down, this latest addition to the Hacking Exposed
series is a stellar example of why this series remains one of the best-selling security
franchises out there. System administrators and Average Joe computer users alike
need to come to grips with the sophistication and stealth of modern malware, and
this book calmly and clearly explains the threat.”
—Brian Krebs,
Reporter for The Washington Post and author of the Security Fix Blog
“A harrowing guide to where the bad guys hide, and how you can find them.”
—Dan Kaminsky,
Director of Penetration Testing, IOActive, Inc.
“The authors tackle malware, a deep and diverse issue in computer security,
with common terms and relevant examples. Malware is a cold deadly tool in
hacking; the authors address it openly, showing its capabilities with direct technical
insight. The result is a good read that moves quickly, filling in the gaps even for the
knowledgeable reader.”
—Christopher Jordan,
VP, Threat Intelligence, McAfee; Principal Investigator to DHS Botnet Research
“Remember the end-of-semester review sessions where the instructor would go
over everything from the whole term in just enough detail so you would
understand all the key points, but also leave you with enough references to dig
deeper where you wanted? Hacking Exposed Malware & Rootkits resembles this! A
top-notch reference for novices and security professionals alike, this book provides
just enough detail to explain the topics being presented, but not too much to
dissuade those new to security.”
—LTC Ron Dodge,
U.S. Army
“Hacking Exposed Malware & Rootkits provides unique insights into the
techniques behind malware and rootkits. If you are responsible for security, you
must read this book!”
—Matt Conover,
Senior Principal Software Engineer, Symantec Research Labs
This page intentionally left blank
™
HACKING EXPOSED
MALWARE & ROOTKITS:
MALWARE & ROOTKITS
SECURITY SECRETS &
SOLUTIONS
MICHAEL DAVIS
SEAN BODMER
AARON LEMASTERS
New York Chicago San Francisco
Lisbon London Madrid Mexico City
Milan New Delhi San Juan
Seoul Singapore Sydney Toronto
Copyright © 2010 by The McGraw-Hill Companies. All rights reserved. Except as permitted under the United States Copyright Act of 1976, no
part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the
prior written permission of the publisher.
ISBN: 978-0-07-159119-5
MHID: 0-07-159119-2
The material in this eBook also appears in the print version of this title: ISBN: 978-0-07-159118-8, MHID: 0-07-159118-4.
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a
trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of
the trademark. Where such designations appear in this book, they have been printed with initial caps.
McGraw-Hill eBooks are available at special quantity discounts to use as premiums and sales promotions, or for use in corporate training
programs. To contact a representative please e-mail us at
I would like to dedicate this book to my family, especially my
grandfather Richard Mason, who has shown me that true leaders have
faith and touch the hearts of others before they ask for a hand.
—Michael A. Davis
I would like to dedicate this book to my wife Emily and our two
children Elizabeth and Ryan and my grandparents Mathew and
Brenda Karnes—without their support I would not be here today.
—Sean Bodmer
For my parents Earl and Sudie, who have supported and encouraged
me all my life despite the odds, and for my wife Justina.
—Aaron LeMasters
ABOUT THE AUTHORS
Michael A. Davis
Michael A. Davis is CEO of Savid Technologies, Inc., a national technology
and security consulting firm. Michael is well-known in the open source
security industry due to his porting of security tools to the Windows
platforms, including tools like snort, ngrep, dsniff, and honeyd. As a member
of the Honeynet Project, he works to develop data and network control
mechanisms for Windows-based honeynets. Michael is also the developer of sebek for
Windows, a kernel-based data collection and monitoring tool for honeynets. Michael
previously worked at McAfee, Inc., a leader in antivirus protection and vulnerability
management, as Senior Manager of Global Threats, where he led a team of researchers
investigating confidential and cutting-edge security research. Prior to being at McAfee,
Michael worked at Foundstone.
Sean M. Bodmer, CISSP, CEH
Sean M. Bodmer is Director of Government Programs at Savid Corporation,
Inc. Sean is an active honeynet researcher, specializing in the analysis of
signatures, patterns, and the behavior of malware and attackers. Most notably,
he has spent several years leading the operations and analysis of advanced
intrusion detection systems (honeynets) where the motives and intent of
attackers and their tools can be captured and analyzed in order to generate actionable
intelligence to further protect customer networks. Sean has worked in various systems
security engineering roles for various federal government entities and private corporations
over the past decade in the Washington D.C. metropolitan area. Sean has lectured across
the United States at industry conferences such as DEFCON, PhreakNIC, DC3, NW3C,
Carnegie Mellon CERT, and the Pentagon Security Forum, covering aspects of attacks
and attacker assessment profiling to help identify the true motivations and intent behind
cyber attacks.
Aaron LeMasters, CISSP, GCIH, CSTP
Aaron LeMasters (M.S., George Washington University) is a security
researcher specializing in computer forensics, malware analysis, and
vulnerability research. The first five years of his career were spent defending
the undefendable DoD networks, and he is now a senior software engineer at
Raytheon SI. Aaron enjoys sharing his research at both larger security
conferences such as Black Hat and smaller, regional hacker cons like Outerz0ne. He
prefers to pacify his short attention span with advanced research and development issues
related to Windows internals, system integrity, reverse engineering, and malware
analysis. He is an enthusiastic prototypist and enjoys developing tools that complement
his research interests. In his spare time, Aaron plays basketball, sketches, jams on his
Epiphone Les Paul, and travels frequently to New York City with his wife.
About the Contributing Author
Jason Lord
Jason Lord is currently Chief Operating Officer of d3 Services, Ltd., a consulting firm
providing cyber security solutions. Jason has been active in the information security
field for the past 14 years, focusing on computer forensics, incident response, enterprise
security, penetration testing, and malicious code analysis. During this time, Jason has
responded to several hundred computer forensics and incident response cases globally.
He is also an active member of the High Technology Crimes Investigation Association
(HTCIA), InfraGard, and the International Systems Security Association (ISSA).
About the Technical Editor
Alexander Eisen is CEO of FormalTechnologies.com, an associate professor with the
University of Advancing Technology, and, as a public servant, an enterprise architect for
a DoD agency. Always an unconventional experimentalist, since 1999 he has played all
sorts of roles—offensive and defensive, tactical and strategic—in the fields of penetration
testing, enterprise incident response, forensics, RE, and security software evaluation—a
career sparked by the award of an NSA-sponsored Information Assurance Fellowship
for multidisciplinary research in Computer Science, Crypto, and Law. He has led over a
dozen major red team and incident response efforts for the DoD and affiliated
organizations, many of which have received widespread media coverage such as
“Pentagon 1500 hacked.” As a core member of the National Cyber Initiative, he has
researched large-scale enterprise incident response and software assurance
methodologies. With certifications from the Defense Language Institute, Defense Cyber
Crime Center Training Academy, (ISC)2, and the Committee on National Security
Systems, he is an active member of InfraGard, AFCEA, IEEE, and various federal
advisory boards. He has spoken internationally on emerging security issues at many
industry conferences such as Black Hat Japan and the Ukraine IT Festival and in closed
venues such as the Pentagon, and has published in trade journals on topics of national
infrastructure protection and IPv6. Through teaching InfoSec curriculum and supporting
UAT’s NSA Center of Academic Excellence, his passion has grown toward leveraging
the talent and resources of academia to explore pioneering socioeconomic technology
topics. He enjoys recruiting and mentoring aspiring youth to jumpstart their careers via
Scholarship for Service programs. By night, his right-brain explores visual arts, extreme
sports, roasting coffee, and engineering binaural Hang drum music. His daily life is now
sustained by the support of his lovely wife Marina. Codeword: BH”96mae3ajme2ie18m
emsdmal2rhbkkgppsjngcpaz24.
This page intentionally left blank
CONTENTS
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi
Part I Malware
Case Study: Please Review This Before Our Quarterly Meeting . . . . . . . . . . 2
▼ 1 Method of Infection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
This Security Stuff Might Actually Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Decrease in Operating System Vulnerabilities . . . . . . . . . . . . . . . . . . . 9
Perimeter Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Why They Want Your Workstation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Intent Is Hard to Detect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
It’s a Business . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Signifi cant Malware Propagation Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 14
Social Engineering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
File Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Modern Malware Propagation Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
StormWorm (Malware Sample: trojan.peacomm) . . . . . . . . . . . . . . . . 22
Metamorphism (Malware Sample: W32.Evol, W32.Simile) . . . . . . . . 24
Obfuscation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Dynamic Domain Name Services (Malware Sample:
