Chapter 6: Communications


Overview

This chapter introduces low-level network communications. Low-level communication is a requirement of many rootkits for several reasons. Of primary concern is that low-level communications cannot be seen by higher-level communications, such as the socket-level communications monitored by personal firewalls. This enables rootkits to remain undetected by personal firewalls and port monitors, such as Sysinternal’s portMon. Another reason for low-level communication is the need to separate rootkit communications from general network communications, as the connection between a rootkit and its remote controller does not need to be monitored by the rootkit.

This chapter includes the following:

  • The Transport Driver Interface (TDI)

  • Connection initiation

  • An example of remote control communication




Professional Rootkits
Professional Rootkits (Programmer to Programmer)
ISBN: 0470101547
EAN: 2147483647
Year: 2007
Pages: 229
Authors: Ric Vieler

Similar book on Amazon
Rootkits: Subverting the Windows Kernel
Rootkits: Subverting the Windows Kernel
A Guide to Kernel Exploitation: Attacking the Core
A Guide to Kernel Exploitation: Attacking the Core
Reversing: Secrets of Reverse Engineering
Reversing: Secrets of Reverse Engineering
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net