Exclusive: FreeBSD Rootkits Book Forthcoming

While searching Amazon.com I found a forthcoming book titled Designing BSD Rootkits by Joseph Kong. Joe wrote Playing Games With Kernel Memory ... FreeBSD Style last year. I emailed him and asked if he would describe the table of contents.

The following is the table of contents, along with a brief description of each chapter, for my upcoming book:

  1. Basics: This chapter covers the fundamentals of FreeBSD kernel module programming (which is the basis of "modern" FreeBSD rootkits). It also briefly goes over the local kernel debugger (ddb).

  2. Hooking: This chapter covers the use of Call Hooking with kernel modules to subvert the FreeBSD kernel. To make this chapter more interesting, the example programs hook some of the more obscure or lesser known tables within the kernel.

  3. Kernel Object Manipulation: This chapter covers patching the objects (structures, queues, and so on) the kernel depends upon for its internal record keeping.

  4. Kernel Object Hooking: This chapter is the end result of combining the techniques in the
    previous two chapters.

  5. Runtime Kernel Memory Patching: This chapter covers patching the kernel code stored in main memory.

  6. Putting It All Together: This chapter demonstrates what one can achieve when they combine the
    techniques described in the previous four chapters. Note: While the previous chapters focused on the "how", this one focuses on the "what".

  7. Defense: This chapter focuses on detecting rootkits employing the techniques described throughout this book.


Essentially Chapter 1 is a whirlwind tour to bring readers up to speed. Chapters 2-5 explain the "how", through a combination of trivial and non-trivial examples. Chapter 6 is something I included for fun, and Chapter 7 should be self-explanatory.

I asked Joe how he convinced No Starch to publish a book on such a niche topic. He wrote:

To be honest with you, I have no idea how I convinced No Starch to publish my book. I just wrote them a proposal, gave them a sample chapter, and they wrote me back.

I look forward to reading this book. The FreeBSD public rootkit community seems fairly small; Stephanie Wehner and pragmatic come to mind. A few private folks come to mind too; you know who you are. :)

Comments

Anonymous said…
I find this an interesting topic. I look forward to reading this book. Also, very timely...

Check out what Joanna is up to over at invisiblethings - http://theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.html

This has also garnered some press, http://tinyurl.com/nh3ku, as the blue pill leverages AMD's SVM/Pacifica technology and not the underlying OS. This makes other OSes that run on x64 vulnerable as well. This is some very cool stuff.

Regards,

Brian
5:21 PM
Anonymous said…
I can't wait until this book is available. However, No Starch still doesn't even have a cover for the book on their website so it appears the release date will slip.
11:21 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more