Review of The Rootkit Arsenal Posted
Amazon.com just posted my five star review of The Rootkit Arsenal by Bill Blunden. I received this book last year but didn't get a chance to finish it until this week, thanks to several long plane flights. From the review:
Disclaimer: Bill mentions me and my book "Real Digital Forensics" on pages xxvi and 493. He sent me a free review copy of his book.
"Wow." That summarizes my review of "The Rootkit Arsenal" (TRA) by Bill Blunden. If you're a security person and you plan to read one seriously technical book this year, make it TRA. If you decide to really focus your attention, and try the examples in the book, you will be able to write Windows rootkits. Even without taking a hands-on approach, you will learn why you can't trust computers to defend themselves or report their condition in a trustworthy manner.
Disclaimer: Bill mentions me and my book "Real Digital Forensics" on pages xxvi and 493. He sent me a free review copy of his book.
"Wow." That summarizes my review of "The Rootkit Arsenal" (TRA) by Bill Blunden. If you're a security person and you plan to read one seriously technical book this year, make it TRA. If you decide to really focus your attention, and try the examples in the book, you will be able to write Windows rootkits. Even without taking a hands-on approach, you will learn why you can't trust computers to defend themselves or report their condition in a trustworthy manner.
Comments
More updated? Different techniques?
The Rootkit Arsenal (TRA) generally offers a lot more examples in greater depth. While Hoglund's book might offer a couple of relevant snippets, TRA provides the reader with a complete implementation. Also, code from the TRA is cleaner and easier to read.
I also think TRA covers more ground. Hoglund's book is somewhat lacking when it comes to explaining the finer details of installing and launching a kernel-mode driver and offers only a token gesture towards prerequisite material like using a kernel debugger or the foibles of Intel's architecture.
TRA exhaustively briefs the reader on all this background material and then also dives into more general anti-forensic topics, which are just as pertinent from an offensive perspective.
This probably explains the page count for TRA, which borders on 900+.