Stay Ahead With Linux Security News

malwarerootkitprotection

Innovative Hypervisor Tool For Rootkit Defense and Protection

Researchers at North Carolina State University and Microsoft Research have come up with a way to combat rootkits by using the machine's own hardware-based memory protection: the so-called HookSafe tool basically protects the operating system kernel from rootkits.. Rootkits are the most difficult of malware to detect and remove: they often evade detection by anti-malware software, and even if they are discovered, they can still be difficult to completely eradicate. A rootkit typically hijacks "hooks" in the operating system -- basically the control data in the kernel used to augment or extend the features of an OS -- in order to hide out in the OS. This in turn lets the rootkit intercept and manipulate the system's data, remain invisible to the user and anti-malware tools, and to install other malware aimed at stealing data from the system. "Then the rootkit can hijack and manipulate the results seen by the user applications ... only allowing a user to see what it wants them to see," says Xuxian Jiang, assistant professor of computer science at NC State and a member of the research team. The link for this article located at Dark Reading is no longer available. . Uncover the innovative approach taken by scientists to create a solution employing hardware memory safeguards aimed at counteracting rootkit threats.. Rootkit Protection Tools, Hardware Memory Defense, Malware Detection System. . LinuxSecurity.com Team

Nov 04, 2009 • LinuxSecurity.com Team Security Projects