While forensic analysis has proven to be a valuable investigative tool in the field of computer security, utilizing anti-forensic technology makes it possible to maintain a covert operational foothold for extended periods, even in a high-security environment. Adopting an approach that favors full disclosure, the updated Second Edition of The Rootkit Arsenal presents the most accessible, timely, and complete coverage of forensic countermeasures. This book covers more topics, in greater depth, than any other currently available. In doing so the author forges through the murky back alleys of the Internet, shedding light on material that has traditionally been poorly documented, partially documented, or intentionally undocumented. The range of topics presented includes how to: -Evade post-mortem analysis -Frustrate attempts to reverse engineer your command & control modules -Defeat live incident response -Undermine the process of memory analysis -Modify subsystem internals to feed misinformation to the outside -Entrench your code in fortified regions of execution -Design and implement covert channels -Unearth new avenues of attack

Table of Contents

Part I: Foundations

Chapter 1: Empty Cup Mind

Chapter 2: Overview of Anti-Forensics

Chapter 3: Hardware Briefing

Chapter 4: System Briefing

Chapter 5: Tools of the Trade

Chapter 6: Life in Kernel Space

Part II: Postmortem

Chapter 7: Defeating Disk Analysis

Chapter 8: Defeating Executable Analysis

Part Ill: Live Response

Chapter 9: Defeating Live Response

Chapter 10: Building Shellcode in C

Chapter 11: Modifying Call Tables

Chapter 12: Modifying Code

Chapter 13: Modifying Kernel Objects

Chapter 14: Covert Channels

Chapter 15: Going Out-of-Band

Part IV: Summation

Chapter 16: The Tao of Root kits

About the Author

Bill Blunden (MCSE, MCITP: Enterprise Administrator) began his journey into enterprise computing over ten years ago at an insurance company in Cleveland, Ohio. Gradually forging a westward path to Northern California, he’s worked with ERP middleware, developed code for network security appliances, and taken various detours through academia. Bill is the principal investigator at Below Gotham Labs.