.png){kind=icon}
.png){kind=icon}
Return
A framework for prototyping and testing data-only rootkit attacks
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2013.04.006.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Kernel rootkits-attacks which modify a running operating system kernel in order to hide an attacker's presence-are significant threats. Recent advances in rootkit defense technology will force rootkit threats to rely on only modifying kernel data structures without injecting and executing any new code; however these data-only kernel rootkit attacks are still both realistic and powerful. In this work we present DORF, a framework for prototyping and testing data-only rootkit attacks. DORF is an object-oriented framework that allows researchers to construct attacks that can be easily ported between various Linux distributions and versions. The current implementation of DORF contains a group of existing and new data-only attacks, and the portability of DORF is demonstrated by porting it to 6 different Linux distributions. The goal of DORF is to allow researchers to construct repeatable experiments with little effort, which will in turn advance research into data-only attacks and defenses. (c) 2013 Elsevier Ltd. All rights reserved.
Keywords:
Malware
Rootkits
Data attacks
Operating systems
Security
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W
Organization
No organization information available