Windows rootkits: attacks and countermeasures

Desmond Lobo; Paul Watters; Xin Wen Wu; Li Sun

doi:10.1109/CTC.2010.9

Windows rootkits: attacks and countermeasures

Desmond Lobo^*, Paul Watters, Xin Wen Wu, Li Sun

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

8 Citations (Scopus)

Abstract

Windows XP is the dominant operating system in the world today and rootkits have been a major concern for XP users. This paper provides an in-depth analysis of the rootkits that target that operating system, while focusing on those that use various hooking techniques to hide malware on a machine. We identify some of the weaknesses in the Windows XP architecture that rootkits exploit and then evaluate some of the anti-rootkit security features that Microsoft has unveiled in Vista and 7. To reduce the number of rootkit infections in the future, we suggest that Microsoft should take full advantage of Intel's four distinct privilege levels.

Original language	English
Title of host publication	Proceedings
Subtitle of host publication	Second Cybercrime and Trustworthy Computing Workshop
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	69-78
Number of pages	10
ISBN (Print)	9780769541860
DOIs	https://doi.org/10.1109/CTC.2010.9
Publication status	Published - 2010
Externally published	Yes
Event	Cybercrime and Trustworthy Computing Workshop (2nd : 2010) - Ballarat, VIC, Canada Duration: 19 Jul 2010 → 20 Jul 2010

Conference

Conference	Cybercrime and Trustworthy Computing Workshop (2nd : 2010)
Abbreviated title	CTC 2010
Country/Territory	Canada
City	Ballarat, VIC
Period	19/07/10 → 20/07/10

Keywords

Computer security
Intel's ring architecture
Malicious software (malware)
Microsoft Windows
Rootkits

Access to Document

10.1109/CTC.2010.9

Cite this

@inproceedings{a54cec996d01465b8b8864eef28bb70a,

title = "Windows rootkits: attacks and countermeasures",

abstract = "Windows XP is the dominant operating system in the world today and rootkits have been a major concern for XP users. This paper provides an in-depth analysis of the rootkits that target that operating system, while focusing on those that use various hooking techniques to hide malware on a machine. We identify some of the weaknesses in the Windows XP architecture that rootkits exploit and then evaluate some of the anti-rootkit security features that Microsoft has unveiled in Vista and 7. To reduce the number of rootkit infections in the future, we suggest that Microsoft should take full advantage of Intel's four distinct privilege levels.",

keywords = "Computer security, Intel's ring architecture, Malicious software (malware), Microsoft Windows, Rootkits",

author = "Desmond Lobo and Paul Watters and Wu, \{Xin Wen\} and Li Sun",

year = "2010",

doi = "10.1109/CTC.2010.9",

language = "English",

isbn = "9780769541860",

pages = "69--78",

booktitle = "Proceedings",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

note = "Cybercrime and Trustworthy Computing Workshop (2nd : 2010), CTC 2010 ; Conference date: 19-07-2010 Through 20-07-2010",

}

TY - GEN

T1 - Windows rootkits

T2 - Cybercrime and Trustworthy Computing Workshop (2nd : 2010)

AU - Lobo, Desmond

AU - Watters, Paul

AU - Wu, Xin Wen

AU - Sun, Li

PY - 2010

Y1 - 2010

N2 - Windows XP is the dominant operating system in the world today and rootkits have been a major concern for XP users. This paper provides an in-depth analysis of the rootkits that target that operating system, while focusing on those that use various hooking techniques to hide malware on a machine. We identify some of the weaknesses in the Windows XP architecture that rootkits exploit and then evaluate some of the anti-rootkit security features that Microsoft has unveiled in Vista and 7. To reduce the number of rootkit infections in the future, we suggest that Microsoft should take full advantage of Intel's four distinct privilege levels.

AB - Windows XP is the dominant operating system in the world today and rootkits have been a major concern for XP users. This paper provides an in-depth analysis of the rootkits that target that operating system, while focusing on those that use various hooking techniques to hide malware on a machine. We identify some of the weaknesses in the Windows XP architecture that rootkits exploit and then evaluate some of the anti-rootkit security features that Microsoft has unveiled in Vista and 7. To reduce the number of rootkit infections in the future, we suggest that Microsoft should take full advantage of Intel's four distinct privilege levels.

KW - Computer security

KW - Intel's ring architecture

KW - Malicious software (malware)

KW - Microsoft Windows

KW - Rootkits

UR - https://www.scopus.com/pages/publications/78649850004

U2 - 10.1109/CTC.2010.9

DO - 10.1109/CTC.2010.9

M3 - Conference proceeding contribution

AN - SCOPUS:78649850004

SN - 9780769541860

SP - 69

EP - 78

BT - Proceedings

PB - Institute of Electrical and Electronics Engineers (IEEE)

Y2 - 19 July 2010 through 20 July 2010

ER -

Windows rootkits: attacks and countermeasures

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this