Surgical Recovery from Kernel-Level Rootkit Installations
Julian Grizzard explores surgical recovery from kernel-level rootkit installations at DEF CON 13, examining rootkit and practical defenses.
Summary
Architecture and Background
Julian Grizzard, Surgical Recovery from Kernel-Level Rootkit Installations Conventional wisdom states that once a system has been compromised, it can no longer be trusted and the only solution is to wipe the system clean and reinstall. This talk goes against the grain of conventional wisdom and asks are there more efficient ways to repair a system other than complete reinstallation. Specifically, this talk will focus on the detection of and recovery from the installation of both traditional and kernel-level rootkits.
Vulnerability Analysis
Included in the presentation is a demonstration of an operating system architecture and intrusion recovery system (IRS) that is capable of recovering from some of the most prevalent rootkits seen in the wild. Prototype recovery tools will be released. Julian Grizzard is a Ph.D.
Exploitation and Demonstrations
candidate in the School of Electrical and Computer Engineering at the Georgia Institute of Technology. He received his B.S. in Computer Engineering from Clemson University and his M.S.
Remediation and Defensive Strategies
in Electrical and Computer Engineering from the Georgia Institute of Technology. He has been studying rootkits for several years, written numerous related papers, and given many academic and research presentations. He is a member of the Honeynet Research Alliance and his research interests include kernel hacking, networking, and security.
Related talks
Main Stage·56 min
Sherri Sparks · Jamie Butler
Sherri Sparks and Jamie Butler details sherri Sparks & Jamie Butler, "Shadow Walker" - Raising The Bar For Rootkit Detection Last year at Black Hat, we introduced the rootkit FU.
Main Stage·37 min
Itzik Kotler · Tomer Bitton
Itzik Kotler and Tomer Bitton explores the day of the updates at DEF CON 17, examining kernel-exploitation and practical defenses.
Main Stage·53 min
Alexandre Borges
Alexandre Borges examines modern advanced malware samples are used to infect countries and they make part of the current cyber war, cyber espionage and financial attacks.