Title: Bootkits revisited : detecting, analysing and mitigating bootkit threats
Language: English
Authors: Grill, Bernhard 
Qualification level: Diploma
Advisor: Kastner, Wolfgang 
Assisting Advisor: Platzer, Christian 
Issue Date: 2016
Number of Pages: 82
Qualification level: Diploma
Bootkits (short for boot + rootkit) are one of the most advanced, powerful and persistent threats exploited in sophisticated malware attacks. In order to investigate this attack vector in greater detail, we performed a large-scale bootkit malware analysis utilizing Windows XP and Windows 7. The data set consists of samples spanning a timer period over 8 years to gain detailed insights into the bootkit malware economy. Grounded on the analysis results of 26,378 malware samples, novel techniques to detect and stop bootkit attacks have been developed. The proposed detection techniques are based on anomaly identification utilizing dynamic analysis during the system's boot phase. Furthermore, two novel techniques to prevent bootkit infections have been developed. The first one, is grounded on strictly blocking the malware's initial persistence and infection vector, while the second approach relies on emulation and monitoring the impact of disk modifications targeting the system's boot process. Furthermore, this work showcases the historic evolution of bootkit techniques starting in 2006 and presents an outlook on their potential future evolution.
Keywords: Bootkit; malware; infection
URI: https://resolver.obvsg.at/urn:nbn:at:at-ubtuw:1-101009
Library ID: AC13751932
Organisation: E183 - Institut für Rechnergestützte Automation 
Publication Type: Thesis
Appears in Collections:Thesis

Files in this item:

Show full item record

Page view(s)

checked on May 26, 2021


checked on May 26, 2021

Google ScholarTM


Items in reposiTUm are protected by copyright, with all rights reserved, unless otherwise indicated.