<div class="csl-bib-body">
<div class="csl-entry">Grill, B. (2016). <i>Bootkits revisited : detecting, analysing and mitigating bootkit threats</i> [Diploma Thesis, Technische Universität Wien]. reposiTUm. https://doi.org/10.34726/hss.2016.23987</div>
</div>
-
dc.identifier.uri
https://doi.org/10.34726/hss.2016.23987
-
dc.identifier.uri
http://hdl.handle.net/20.500.12708/9823
-
dc.description
Zusammenfassung in deutscher Sprache
-
dc.description.abstract
Bootkits (short for boot + rootkit) are one of the most advanced, powerful and persistent threats exploited in sophisticated malware attacks. In order to investigate this attack vector in greater detail, we performed a large-scale bootkit malware analysis utilizing Windows XP and Windows 7. The data set consists of samples spanning a timer period over 8 years to gain detailed insights into the bootkit malware economy. Grounded on the analysis results of 26,378 malware samples, novel techniques to detect and stop bootkit attacks have been developed. The proposed detection techniques are based on anomaly identification utilizing dynamic analysis during the system's boot phase. Furthermore, two novel techniques to prevent bootkit infections have been developed. The first one, is grounded on strictly blocking the malware's initial persistence and infection vector, while the second approach relies on emulation and monitoring the impact of disk modifications targeting the system's boot process. Furthermore, this work showcases the historic evolution of bootkit techniques starting in 2006 and presents an outlook on their potential future evolution.
en
dc.language
English
-
dc.language.iso
en
-
dc.rights.uri
http://rightsstatements.org/vocab/InC/1.0/
-
dc.subject
Bootkit
en
dc.subject
malware
en
dc.subject
infection
en
dc.title
Bootkits revisited : detecting, analysing and mitigating bootkit threats