Hello guys, Welcome to Africa's Largest Video Search Engine, and you are watching BlueHat v18 || Return of the kernel rootkit malware (on windows 10). and this video is uploaded by Microsoft Security Response Center (MSRC) at 2018-12-07T10:05:49-08:00. We are just promoting this video only for entertainment and educational purpose only. I hop you like our Video Search Engine. [qVIxFfXpyNc]
| Name | BlueHat v18 || Return of the kernel rootkit malware (on windows 10) |
| Video Uploader | Video From Microsoft Security Response Center (MSRC) |
| Upload Date | This Video Uploaded At 07-12-2018 18:05:49 |
| Video Discription | Matt Oh, Microsoft We are seeing new technique used everyday by malware. But, it is very hard to find any impressive techniques used in the wild. Recently there was huge buzz about Detrahere malware which used internally known issues with certificate signing in Windows 10 kernel driver. Even though the certificate check bypass technique itself is very interesting, also I found that the tactics used by the malware is more impressive. Even though the malware is mainly focused on Ad-hijacking functionality through Netfilter driver installation, but it also has rootkit ability through file system driver hooking. This feels like old days coming back with various new arsenals. The rootkit detects kernel debugging settings and will destroy the system when it finds one. The unpacking process can be very challenging job, too as it uses kernel driver image hollowing technique (something similar to process hollowing) to deobfuscate itself and run unpacked code. Our patchguard doesn't seem like triggering on this action, because all the sections are pre-allocated with execute permission already. Through this talk, I want to present various techniques used by this malware focusing on the kernel level obfuscation and anti-analysis tactics. This will give us new insights on how new Windows rootkit malware might look like in the future and how detecting them from security systems and detonation systems can be a challenge. https://www.slideshare.net/MSbluehat/bhv18-return-of-the-kernel-rootkit-malware-on-windows-10 [qVIxFfXpyNc] |
| Category | Science & Technology |
| Tags | Security | BlueHat | Microsoft |
