Addison-Wesley Professional Announces Rootkits: Subverting the Windows Kernel

Business Wire, July 20, 2005

BOSTON -- Addison-Wesley Professional, a leading publisher of quality books for software engineers, today announced the introduction of the world's first comprehensive guide to rootkits.

The ultimate backdoor, rootkits give hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them. Rootkit.com's Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. (Black Hat is an event where security professionals discuss their research, projects, and business strategies). In this book, they reveal never-before-told aspects of rootkit technology, including how attackers can get in and stay in for years, without detection.

After reading this book, readers will be able to: understand the role of rootkits in remote command/control and software eavesdropping; build kernel rootkits that can make processes, files, and directories invisible; master key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objects; work with layered drivers to implement keyboard sniffers and file filters; establish covert channels for retaining control over systems with installed rootkits; detect rootkits and built host-based intrusion prevention software that resists rootkit attacks; and discover legitimate uses for rootkits by law enforcement and security organizations

"This book is an essential read for anyone responsible for Windows security. Security professionals, Windows system administrators, and programmers in general will want to understand the techniques used by rootkit authors," said Jennifer Kolde, security consultant, author and instructor. "At a time when many IT and security professionals are still worrying about the latest e-mail virus or how to get all of this month's security patches installed, Hoglund and Butler open your eyes to some of the most stealthy and significant threats to the Windows operating system."

"It's imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits," said Mark Russinovich, Editor, Windows IT Pro /Windows & .NET Magazine

Rootkits: Subverting the Windows Kernel, ISBN: 0321294319 by Greg Hoglund and James Butler, is available at retail books stores and online booksellers. List price $44.99 USD.

http://www.awprofessional.com/rootkits

Greg Hoglund, a pioneer in the area of software security, is CEO of HBGary, Inc., a leading provider of software security verification services. After writing one of the first network vulnerability scanners (installed in over half of all Fortune 500 companies), he created and documented the first Windows NT-based rootkit, founding www.rootkit.com in the process. Greg is a frequent speaker at Black Hat, RSA, and other security conferences. He coauthored the bestselling Exploiting Software: How to Break Code (Addison-Wesley, 2004). http://www.awprofessional.com/title/0201786958

James Butler, Director of Engineering at HBGary, has a world-class talent for kernel programming and rootkit development and extensive experience in host-based intrusion-detection systems. He is the developer of VICE, a rootkit detection and forensics system. Jamie's previous positions include Senior Security Software Engineer at Enterasys and Computer Scientist at the National Security Agency. He is a frequent trainer and speaker at Black Hat.

About Addison-Wesley Professional

Addison-Wesley Professional is the leading publisher of high-quality and timely information for programmers, developers, and system administrators. The Company's mission is to provide educational materials concerning new technologies and new approaches to current technologies written by leading authorities. Addison-Wesley Professional is a division of Pearson Education, the global leader in integrated education publishing. Pearson Education is part of Pearson plc (NYSE: PSO), the international media company. Visit us at www.awprofessional.com.

All products and company names mentioned herein may be trademarks of their respective owners.