A Study of Rootkit Stealth Techniques and Associated Detection Methods
Daniel D. Nerenberg · 2012
Dr. R. Raines (Member) date AFIT/GCE/ENG/07-10 In today’s world of advanced computing power at the fingertips of any user, computer security should be a primary concern. Information is power and this power is within the computer system. If the information within computer systems cannot be trusted then the power that comes from such information cannot be properly used. Rootkits are software programs that are designed to establish and maintain an environment in which malware may hide on a computer system after successful compromise of that computer system. Rootkits cut at the very foundation of the trust in information and subsequent power. This thesis examines rootkit hiding techniques, rootkit finding techniques and develops attack trees and defense trees to identify deficiencies in detection and further increase the trust in information systems. The developed attack and defense trees identified that enumeration is not sufficient to defend against rootkits. A developed