Malware: Fighting Malicious Code

Chapter 7. User-Mode RootKits

Iago: Men should be what they seem…

—Shakespeare's Othello, 1604, dialogue from Iago, a treacherous liar who destroys Othello's life with his deceptions

Consider all of the backdoor and Trojan horse examples we covered in Chapters 5 and 6. What do they all have in common? If you think about it, every single tool we discussed consisted of new software that was added to a system by an attacker. None of the tools we've seen so far have replaced or altered components of the victim system. Each of these Trojan horses and backdoors functioned as a separate application on the machine. Sure, some of the tools mimicked existing software on the machine, such as the backdoor Netcat listener named iexplore.exe. However, for ...