Managed Code Rootkits

Chapter 9 Defending against MCRs

Information in this chapter

• What Can We Do about This Kind of Threat?

• Awareness: Malware Is Everybody's Problem

• The Prevention Approach

• The Detection Approach

• The Response Approach

Managed code rootkits can affect everyone from system administrators, security auditors, and forensic investigators to security product vendors, runtime vendors, operating system vendors, developers, and end users. Fortunately, there are several approaches to dealing with managed code rootkits. In the prevention approach, runtime binaries are transformed in such a way that the attacker must perform additional tasks to complete his attack against the target machine. In the detection approach, software and hardware-based solutions ...