Bibliographic Metadata

Bootkits revisited : detecting, analysing and mitigating bootkit threats / von Bernhard Grill
AuthorGrill, Bernhard
CensorKastner, Wolfgang ; Platzer, Christian
PublishedWien, 2016
Descriptionx, 82 Seiten : Diagramme
Institutional NoteTechnische Universität Wien, Diplomarbeit, 2016
Zusammenfassung in deutscher Sprache
Document typeThesis (Diplom)
Keywords (EN)Bootkit / malware / infection
URNurn:nbn:at:at-ubtuw:1-101009 Persistent Identifier (URN)
 The work is publicly available
Bootkits revisited [1.74 mb]
Abstract (English)

Bootkits (short for boot + rootkit) are one of the most advanced, powerful and persistent threats exploited in sophisticated malware attacks. In order to investigate this attack vector in greater detail, we performed a large-scale bootkit malware analysis utilizing Windows XP and Windows 7. The data set consists of samples spanning a timer period over 8 years to gain detailed insights into the bootkit malware economy. Grounded on the analysis results of 26,378 malware samples, novel techniques to detect and stop bootkit attacks have been developed. The proposed detection techniques are based on anomaly identification utilizing dynamic analysis during the system's boot phase. Furthermore, two novel techniques to prevent bootkit infections have been developed. The first one, is grounded on strictly blocking the malware's initial persistence and infection vector, while the second approach relies on emulation and monitoring the impact of disk modifications targeting the system's boot process. Furthermore, this work showcases the historic evolution of bootkit techniques starting in 2006 and presents an outlook on their potential future evolution.

The PDF-Document has been downloaded 37 times.