Bill Blunden’s book, The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System, is one of the hidden gems in computer security books, and I hope that I can convince you to give it a look. This review has been too-long to arrive, as I haven’t had the time to read that I would like. That said, I felt it was very important to finally get the review up, as this is a book that I’m sure my regular readers will enjoy.
I first spotted this book on a vendor table at Defcon, and it stood out among the rest mostly because *I hadn’t heard of it*. I try to keep up with new book releases, especially on attack-oriented topics that would be of interest to the penetration testers and vulnerability analysts that read this blog. It was surprising to me that one had flown under the radar. I picked it up and flipped through the table of contents (which I encourage you to do as well), and was very impressed with the amount of material it covers.
I looked up the author, and was disappointed to realize that I had missed his talk at Blackhat earlier that week (looking forward to the video). I contacted him, and he was kind enough to supply a review copy of the book. It arrived very quickly, with a humorous personal note on the inside cover, and ever since, I have been learning a lot from it.
The author’s style is excellent. The material is technical and has the potential to be very dry, but the text has a very conversational tone, as if it were being presented as a lecture for a (particularly good) class. Each concept is tied back to the main topic: hiding operations and data from the user and operating system, and frustrating forensic analysis. The book reads very well, presenting enough context that you can understand it if you’re reading away from a computer, and enough detail that you can follow along and experiment with it if you are at your desk.
I appreciate that this book does not attempt to hold the reader’s hand throughout with the ethics of developing rootkits. The author takes a brief moment at the beginning of the book to explain the legitimate needs for security professionals to be familiar with rootkit techniques and development, and points out that the information can be found elsewhere. After this point, the book assumes a level of maturity in its reader that is greatly appreciated.
The first part of the book, “Foundations”, has an excellent introduction to IA32 architecture and Windows internals that I have never seen so well-described for beginners. Even if you aren’t interested in rootkits, this portion of the book is something I would recommend to anyone getting started in related fields, like reverse-engineering or exploit development. Digging further into the text, the second section on “System Modification” makes up the “meat” of the book, delving into the details of subverting Windows internals in many different ways. As technical and in-depth as the book gets, though, it never seems to leave the reader behind. Each new concept is well-explained and builds upon the material the reader has already learned. You may have to go through the text slower than you had anticipated, and go back to review previous material, but you’re never left feeling hopelessly lost.
The remainder of the book is a treat, as well. I can’t recall another book that goes into any kind of detail on defeating forensic analysis of memory and file systems. Anyone interested in developing forensic tools or curious about how analysis with tools like Encase and FTK might be subverted, should give it a read. The author closes the text with some strategic guidelines for rootkit development, and his own thoughts on how evasion and deception can be used to similar ends on a larger scale than operating systems.
This is now one of my favorite computer security books, and I believe that if you review its contents, you’ll find that you’re getting a great value for your money. If you are familiar with C and have a beginner’s knowledge of IA-32 assembly, you should have the prerequisites you need to follow along with this book. I highly recommend it, and hope that it becomes less-hidden of a gem that it already is.