Title: Bootkits revisited : detecting, analysing and mitigating bootkit threats
Language: input.forms.value-pairs.iso-languages.en
Authors: Grill, Bernhard 
Qualification level: Diploma
Advisor: Kastner, Wolfgang 
Assisting Advisor: Platzer, Christian 
Issue Date: 2016
Grill, B. (2016). Bootkits revisited : detecting, analysing and mitigating bootkit threats [Diploma Thesis, Technische Universität Wien]. reposiTUm. https://doi.org/10.34726/hss.2016.23987
Number of Pages: 82
Qualification level: Diploma
Bootkits (short for boot + rootkit) are one of the most advanced, powerful and persistent threats exploited in sophisticated malware attacks. In order to investigate this attack vector in greater detail, we performed a large-scale bootkit malware analysis utilizing Windows XP and Windows 7. The data set consists of samples spanning a timer period over 8 years to gain detailed insights into the bootkit malware economy. Grounded on the analysis results of 26,378 malware samples, novel techniques to detect and stop bootkit attacks have been developed. The proposed detection techniques are based on anomaly identification utilizing dynamic analysis during the system's boot phase. Furthermore, two novel techniques to prevent bootkit infections have been developed. The first one, is grounded on strictly blocking the malware's initial persistence and infection vector, while the second approach relies on emulation and monitoring the impact of disk modifications targeting the system's boot process. Furthermore, this work showcases the historic evolution of bootkit techniques starting in 2006 and presents an outlook on their potential future evolution.
Keywords: Bootkit; malware; infection
URI: https://doi.org/10.34726/hss.2016.23987
DOI: 10.34726/hss.2016.23987
Library ID: AC13751932
Organisation: E183 - Institut für Rechnergestützte Automation 
Publication Type: Thesis
Appears in Collections:Thesis

Files in this item:

Items in reposiTUm are protected by copyright, with all rights reserved, unless otherwise indicated.

Page view(s)

checked on Jun 4, 2022


checked on Jun 4, 2022

Google ScholarTM