The Antivirus Hackers' Handbook Book - Online bookshop
The Antivirus Hackers' Handbook

The Antivirus Hackers' Handbook


     4.6  |  8 Reviews 
5
4
3
2
1



Out of Stock


Notify me when this book is in stock
About the Book

The Antivirus Hacker's Handbook guides you through the process of reverse engineering antivirus software. You explore how to detect and exploit vulnerabilities that can be leveraged to improve future software design, protect your network and anticipate attacks that may sneak through your antivirus' line of defense. You'll begin building your knowledge by diving into the reverse engineering process, which details how to start from a finished antivirus software program and work your way back through its development using the functions and other key elements of the software.

About the Author

Joxean Koret is a security researcher at Coseinc, a Singapore-based security service company. He started working as a database software developer and DBA for a number of different RDBMS. Afterwards he got interested in reverse engineering and applied this knowledge to the DBs he was working with, for which he has discovered dozens of vulnerabilities in products from the major database vendors, especially Oracle software. He also specialized in malware analysis and anti-malware software development developing IDA Pro at Hex-Rays. Joxean is a frequent presenter at security conferences around the world.



Table of Contents:
Introduction Part I Antivirus Basics Chapter 1 Introduction to Antivirus Software ·What is Antivirus Software? ·Antivirus Software: Past and Present ·Antivirus Scanners, Kernels and Products ·Typical Misconceptions about Antivirus Software ·Antivirus Features ·Basic Features ·Making Use of Native Languages ·Scanners ·Signatures ·Compressors and Archives ·Unpackers ·Emulators ·Miscellaneous File Formats ·Advanced Features ·Packet Filters and Firewalls ·Self-Protection ·Anti-Exploiting Chapter 2 Reverse-Engineering the Core ·Reverse-Engineering Tools ·Command-Line Tools versus GUI Tools ·Debugging Symbols ·Tricks for Retrieving Debugging Symbols ·Debugging Tricks ·Backdoors and Configuration Settings ·Kernel Debugging ·Debugging User-Mode Processes with a Kernel-Mode Debugger ·Analyzing AV Software with Command-Line Tools ·Porting the Core ·A Practical Example: Writing Basic Python Bindings for Avast for Linux ·A Brief Look at Avast for Linux ·Writing Simple Python Bindings for Avast for Linux ·The Final Version of the Python Bindings ·A Practical Example: Writing Native C/C++ Tools for Comodo Antivirus for Linux ·Other Components Loaded by the Kernel Chapter 3 The Plug-ins System ·Understanding How Plug-ins Are Loaded ·A Full-Featured Linker in Antivirus Software ·Understanding Dynamic Loading ·Advantages and Disadvantages of the Approaches for Packaging Plug-ins ·Types of Plug-ins ·Scanners and Generic Routines ·File Format and Protocol Support ·Heuristics ·Bayesian Networks ·Bloom Filters ·Weights-Based Heuristics ·Some Advanced Plug-ins ·Memory Scanners ·Non-native Code ·Scripting Languages ·Emulators Chapter 4 Understanding Antivirus Signatures ·Typical Signatures ·Byte-Streams ·Checksums ·Custom Checksums ·Cryptographic Hashes ·Advanced Signatures ·Fuzzy Hashing ·Graph-Based Hashes for Executable Files Chapter 5 The Update System ·Understanding the Update Protocols ·Support for SSL/TLS ·Verifying the Update Files ·Dissecting an Update Protocol ·When Protection Is Done Wrong Part II Antivirus Software Evasion Chapter 6 Antivirus Software Evasion ·Who Uses Antivirus Evasion Techniques? ·Discovering Where and How Malware Is Detected ·Old Tricks for Determining Where Malware Is Detected: Divide and Conquer ·Evading a Simple Signature-Based Detection with the Divide and Conquer Trick ·Binary Instrumentation and Taint Analysis Chapter 7 Evading Signatures ·File Formats: Corner Cases and Undocumented Cases ·Evading a Real Signature ·Evasion Tips and Tricks for Specific File Formats ·PE Files ·JavaScript ·String Encoding ·Executing Code on the Fly ·Hiding the Logic: Opaque Predicates and Junk Code ·PDF Chapter 8 Evading Scanners ·Generic Evasion Tips and Tricks ·Fingerprinting Emulators ·Advanced Evasion Tricks ·Taking Advantage of File Format Weaknesses ·Using Anti-emulation Techniques ·Using Anti-disassembling Techniques ·Disrupting Code Analyzers through Anti-analysis ·More Anti-Anti-Anti... ·Causing File Format Confusion ·Automating Evasion of Scanners ·Initial Steps ·Installing ClamAV ·Installing Avast ·Installing AVG ·Installing F-Prot ·Installing Comodo ·Installing Zoner Antivirus ·MultiAV Configuration ·peCloak ·Writing the Final Tool Chapter 9 Evading Heuristic Engines ·Heuristic Engine Types ·Static Heuristic Engines ·Bypassing a Simplistic Static Heuristic Engine ·Dynamic Heuristic Engines ·Userland Hooks ·Bypassing a Userland HIPS ·Kernel-Land Hooks Chapter 10 Identifying the Attack Surface ·Understanding the Local Attack Surface ·Finding Weaknesses in File and Directory Privileges ·Escalation of Privileges ·Incorrect Privileges in Files and Folders ·Incorrect Access Control Lists ·Kernel-Level Vulnerabilities ·Exotic Bugs ·Exploiting SUID and SGID Binaries on Unix-Based Platforms ·ASLR and DEP Status for Programs and Binaries ·Exploiting Incorrect Privileges on Windows Objects ·Exploiting Logical Flaws ·Understanding the Remote Attack Surface ·File Parsers ·Generic Detection and File Disinfection Code ·Network Services, Administration Panels and Consoles ·Firewalls, Intrusion Detection Systems and Their Parsers ·Update Services ·Browser Plug-ins ·Security Enhanced Software Chapter 11 Denial of Service ·Local Denial-of-Service Attacks ·Compression Bombs ·Creating a Simple Compression Bomb ·Bugs in File Format Parsers ·Attacks against Kernel Drivers ·Remote Denial-of-Service Attacks ·Compression Bombs ·Bugs in File Format Parsers Part III Analysis and Exploitation Chapter 12 Static Analysis ·Performing a Manual Binary Audit ·File Format Parsers ·Remote Services Chapter 13 Dynamic Analysis ·Fuzzing ·What is a Fuzzer? ·Simple Fuzzing ·Automating Fuzzing of Antivirus Products ·Using Command-Line Tools ·Porting Antivirus Kernels to Unix ·Fuzzing with Wine ·Problems, Problems and More Problems ·Finding Good Templates ·Finding Template Files ·Maximizing Code Coverage ·Blind Code Coverage Fuzzer ·Using Blind Code Coverage Fuzzer ·Nightmare, the Fuzzing Suite ·Configuring Nightmare ·Finding Samples ·Configuring and Running the Fuzzer Chapter 14 Local Exploitation ·Exploiting Backdoors and Hidden Features ·Finding Invalid Privileges, Permissions and ACLs ·Searching Kernel-Land for Hidden Features ·More Logical Kernel Vulnerabilities Chapter 15 Remote Exploitation ·Implementing Client-Side Exploitation ·Exploiting Weakness in Sandboxing ·Exploiting ASLR, DEP and RWX Pages at Fixed Addresses ·Writing Complex Payloads ·Taking Advantage of Emulators ·Exploiting Archive Files ·Finding Weaknesses in Intel x86, AMD x86_64 and ARM Emulators ·Using JavaScript, VBScript, or ActionScript ·Determining What an Antivirus Supports ·Launching the Final Payload ·Exploiting the Update Services ·Writing an Exploit for an Update Service ·Server-Side Exploitation ·Differences between Client-Side and Server-Side Exploitation ·Exploiting ASLR, DEP and RWX Pages at Fixed Addresses Part IV Current Trends and Recommendations Chapter 16 Current Trends in Antivirus Protection ·Matching the Attack Technique with the Target ·The Diversity of Antivirus Products ·Zero-Day Bugs ·Patched Bugs ·Targeting Home Users ·Targeting Small to Medium-Sized Companies ·Targeting Governments and Big Companies ·The Targets of Governments Chapter 17 Recommendations and the Possible Future ·Recommendations for Users of Antivirus Products ·Blind Trust Is a Mistake ·Isolating Machines Improves Protection ·Auditing Security Products ·Recommendations for Antivirus Vendors ·Engineering Is Different from Security ·Exploiting Antivirus Software Is Trivial ·Perform Audits ·Fuzzing ·Use Privileges Safely ·Reduce Dangerous Code in Parsers ·Improve the Safety of Update Services and Protocols ·Remove or Disable Old Code Summary Index


Best Sellers



Product Details
  • ISBN-13: 9788126558766
  • Publisher: Wiley India Pvt Ltd
  • Binding: Paperback
  • No of Pages: 384
  • ISBN-10: 8126558768
  • Publisher Date: 2015
  • Language: English
  • Weight: 700 gr

Related Categories

Similar Products

Add Photo
Add Photo

Customer Reviews

     4.6  |  8 Reviews 
out of (%) reviewers recommend this product
Top Reviews
Rating Snapshot
Select a row below to filter reviews.
5
4
3
2
1
Average Customer Ratings
     4.6  |  8 Reviews 
00 of 0 Reviews
Sort by :
Active Filters

00 of 0 Reviews
SEARCH RESULTS
1–2 of 2 Reviews
    BoxerLover2 - 5 Days ago
    A Thrilling But Totally Believable Murder Mystery

    Read this in one evening. I had planned to do other things with my day, but it was impossible to put down. Every time I tried, I was drawn back to it in less than 5 minutes. I sobbed my eyes out the entire last 100 pages. Highly recommend!

    BoxerLover2 - 5 Days ago
    A Thrilling But Totally Believable Murder Mystery

    Read this in one evening. I had planned to do other things with my day, but it was impossible to put down. Every time I tried, I was drawn back to it in less than 5 minutes. I sobbed my eyes out the entire last 100 pages. Highly recommend!


Sample text
Photo of
    Media Viewer

    Sample text
    Reviews
    Reader Type:
    BoxerLover2
    00 of 0 review

    Your review was submitted!
    The Antivirus Hackers' Handbook
    Wiley India Pvt Ltd -
    The Antivirus Hackers' Handbook
    Writing guidlines
    We want to publish your review, so please:
    • keep your review on the product. Review's that defame author's character will be rejected.
    • Keep your review focused on the product.
    • Avoid writing about customer service. contact us instead if you have issue requiring immediate attention.
    • Refrain from mentioning competitors or the specific price you paid for the product.
    • Do not include any personally identifiable information, such as full names.

    The Antivirus Hackers' Handbook

    Required fields are marked with *

    Review Title*
    Review
      Add Photo Add up to 6 photos
      Would you recommend this product to a friend?
      Tag this Book Read more
      Does your review contain spoilers?
      What type of reader best describes you?
      I agree to the terms & conditions
      You may receive emails regarding this submission. Any emails will include the ability to opt-out of future communications.

      CUSTOMER RATINGS AND REVIEWS AND QUESTIONS AND ANSWERS TERMS OF USE

      These Terms of Use govern your conduct associated with the Customer Ratings and Reviews and/or Questions and Answers service offered by Bookswagon (the "CRR Service").


      By submitting any content to Bookswagon, you guarantee that:
      • You are the sole author and owner of the intellectual property rights in the content;
      • All "moral rights" that you may have in such content have been voluntarily waived by you;
      • All content that you post is accurate;
      • You are at least 13 years old;
      • Use of the content you supply does not violate these Terms of Use and will not cause injury to any person or entity.
      You further agree that you may not submit any content:
      • That is known by you to be false, inaccurate or misleading;
      • That infringes any third party's copyright, patent, trademark, trade secret or other proprietary rights or rights of publicity or privacy;
      • That violates any law, statute, ordinance or regulation (including, but not limited to, those governing, consumer protection, unfair competition, anti-discrimination or false advertising);
      • That is, or may reasonably be considered to be, defamatory, libelous, hateful, racially or religiously biased or offensive, unlawfully threatening or unlawfully harassing to any individual, partnership or corporation;
      • For which you were compensated or granted any consideration by any unapproved third party;
      • That includes any information that references other websites, addresses, email addresses, contact information or phone numbers;
      • That contains any computer viruses, worms or other potentially damaging computer programs or files.
      You agree to indemnify and hold Bookswagon (and its officers, directors, agents, subsidiaries, joint ventures, employees and third-party service providers, including but not limited to Bazaarvoice, Inc.), harmless from all claims, demands, and damages (actual and consequential) of every kind and nature, known and unknown including reasonable attorneys' fees, arising out of a breach of your representations and warranties set forth above, or your violation of any law or the rights of a third party.


      For any content that you submit, you grant Bookswagon a perpetual, irrevocable, royalty-free, transferable right and license to use, copy, modify, delete in its entirety, adapt, publish, translate, create derivative works from and/or sell, transfer, and/or distribute such content and/or incorporate such content into any form, medium or technology throughout the world without compensation to you. Additionally,  Bookswagon may transfer or share any personal information that you submit with its third-party service providers, including but not limited to Bazaarvoice, Inc. in accordance with  Privacy Policy


      All content that you submit may be used at Bookswagon's sole discretion. Bookswagon reserves the right to change, condense, withhold publication, remove or delete any content on Bookswagon's website that Bookswagon deems, in its sole discretion, to violate the content guidelines or any other provision of these Terms of Use.  Bookswagon does not guarantee that you will have any recourse through Bookswagon to edit or delete any content you have submitted. Ratings and written comments are generally posted within two to four business days. However, Bookswagon reserves the right to remove or to refuse to post any submission to the extent authorized by law. You acknowledge that you, not Bookswagon, are responsible for the contents of your submission. None of the content that you submit shall be subject to any obligation of confidence on the part of Bookswagon, its agents, subsidiaries, affiliates, partners or third party service providers (including but not limited to Bazaarvoice, Inc.)and their respective directors, officers and employees.

      Accept

      New Arrivals



      Inspired by your browsing history


      Your review has been submitted!

      You've already reviewed this product!