Rootkit (English Wikipedia)

Russinovich, Mark (June 2005). "Unearthing Root Kits". Windows IT Pro. Archived from the original on 2012-09-18. Retrieved 2010-12-16.
"BlackLight". F-Secure. Archived from the original on 21 September 2012. Retrieved 8 August 2011.
"Radix Anti-Rootkit". usec.at. Archived from the original on 21 September 2012. Retrieved 8 August 2011.
"Strider GhostBuster Rootkit Detection". Microsoft Research. 2010-01-28. Archived from the original on 2012-07-29. Retrieved 2010-08-14.

arstechnica.com

Salter, Jim (July 31, 2020). "Red Hat and CentOS systems aren't booting due to BootHole patches". Ars Technica. Retrieved July 24, 2021.

avast.com

"Rootkit & Anti-rootkit". Retrieved 13 September 2017.

bbc.co.uk

news.bbc.co.uk

"Sony's long-term rootkit CD woes". BBC News. 2005-11-21. Retrieved 2008-09-15.

bestantivirus.com

Steinberg, Joseph (June 9, 2021). "What You Need To Know About Keyloggers". bestantivirus.com. Retrieved July 24, 2021.

blackhat.com

Dai Zovi, Dino (2009-07-26). Advanced Mac OS X Rootkits (PDF). Blackhat. Endgame Systems. Retrieved 2010-11-23.
Ortega, Alfredo; Sacco, Anibal (2009-07-24). Deactivate the Rootkit: Attacks on BIOS anti-theft technologies (PDF). Black Hat USA 2009 (PDF). Boston, MA: Core Security Technologies. Retrieved 2014-06-12.
Kumar, Nitin; Kumar, Vipin (2007). Vbootkit: Compromising Windows Vista Security (PDF). Black Hat Europe 2007.
Heasman, John (2006-01-25). Implementing and Detecting an ACPI BIOS Rootkit (PDF). Black Hat Federal 2006. NGS Consulting. Retrieved 2010-11-21.

bleepingcomputer.com

Gatlan, Sergiu (May 6, 2021). "New Moriya rootkit used in the wild to backdoor Windows systems". Bleeping Computer. Retrieved July 24, 2021.

books.google.com

Evancich, N.; Li, J. (2016-08-23). "6.2.3 Rootkits". In Colbert, Edward J. M.; Kott, Alexander (eds.). Cyber-security of SCADA and Other Industrial Control Systems. Springer. p. 100. ISBN 9783319321257 – via Google Books.
Andrew Hay; Daniel Cid; Rory Bray (2008). OSSEC Host-Based Intrusion Detection Guide. Syngress. p. 276. ISBN 978-1-59749-240-9 – via Google Books.
Greg Hoglund; James Butler (2006). Rootkits: Subverting the Windows kernel. Addison-Wesley. p. 4. ISBN 978-0-321-29431-9 – via Google Books.
"Symantec Releases Update for its Own Rootkit". HWM (March): 89. 2006 – via Google Books.
Anson, Steve; Bunting, Steve (2007). Mastering Windows Network Forensics and Investigation. John Wiley and Sons. pp. 73–74. ISBN 978-0-470-09762-5.
Bettany, Andrew; Halsey, Mike (2017). Windows Virus and Malware Troubleshooting. Apress. p. 17. ISBN 9781484226070 – via Google Books.
Skoudis, Ed; Zeltser, Lenny (2004). Malware: Fighting Malicious Code. Prentice Hall PTR. p. 335. ISBN 978-0-13-101405-3.

broadcom.com

community.broadcom.com

Butler, James; Sparks, Sherri (2005-11-16). "Windows Rootkits of 2005, Part Two". Symantec Connect. Symantec. Retrieved 2010-11-13.
Butler, James; Sparks, Sherri (2005-11-03). "Windows Rootkits of 2005, Part One". Symantec Connect. Symantec. Retrieved 2010-11-12.
Burdach, Mariusz (2004-11-17). "Detecting Rootkits And Kernel-level Compromises In Linux". Symantec. Retrieved 2010-11-23.
Cuibotariu, Mircea (2010-02-12). "Tidserv and MS10-015". Symantec. Retrieved 2010-08-19.
Hoang, Mimi (2006-11-02). "Handling Today's Tough Security Threats: Rootkits". Symantec Connect. Symantec. Retrieved 2010-11-21.

ca.com

"Spyware Detail: XCP.Sony.Rootkit". Computer Associates. 2005-11-05. Archived from the original on 2010-08-18. Retrieved 2010-08-19.

cansecwest.com

Sacco, Anibal; Ortéga, Alfredo (2009). Persistent BIOS infection (PDF). CanSecWest 2009. Core Security Technologies. Archived from the original (PDF) on 2011-07-08. Retrieved 2010-11-21.

cmu.edu

ece.cmu.edu

Thompson, Ken (August 1984). "Reflections on Trusting Trust" (PDF). Communications of the ACM. 27 (8): 761. doi:10.1145/358198.358210.

cnet.com

reviews.cnet.com

"Security Watch: Rootkits for fun and profit". CNET Reviews. 2007-01-19. Archived from the original on 2012-10-08. Retrieved 2009-04-07.

doi.org

Thompson, Ken (August 1984). "Reflections on Trusting Trust" (PDF). Communications of the ACM. 27 (8): 761. doi:10.1145/358198.358210.
King, Samuel T.; Chen, Peter M.; Wang, Yi-Min; Verbowski, Chad; Wang, Helen J.; Lorch, Jacob R. (2006-04-03). "SubVirt: Implementing malware with virtual machines" (PDF). 2006 IEEE Symposium on Security and Privacy (S&P'06). Institute of Electrical and Electronics Engineers. pp. 14 pp.-327. doi:10.1109/SP.2006.38. ISBN 0-7695-2574-1. S2CID 1349303. Retrieved 2008-09-15.
Wang, Zhi; Jiang, Xuxian; Cui, Weidong; Ning, Peng (2009-08-11). "Countering Kernel Rootkits with Lightweight Hook Protection" (PDF). In Al-Shaer, Ehab (General Chair) (ed.). Proceedings of the 16th ACM Conference on Computer and Communications Security. CCS 2009: 16th ACM Conference on Computer and Communications Security. Jha, Somesh; Keromytis, Angelos D. (Program Chairs). New York: ACM New York. doi:10.1145/1653662.1653728. ISBN 978-1-60558-894-0. Retrieved 2009-11-11.
Seshadri, Arvind; et al. (2005). "Pioneer". Proceedings of the twentieth ACM symposium on Operating systems principles. Carnegie Mellon University. pp. 1–16. doi:10.1145/1095810.1095812. ISBN 1595930795. S2CID 9960430.
Li, Yong-Gang; Chung, Yeh-Ching; Hwang, Kai; Li, Yue-Jin (2021). "Virtual Wall: Filtering Rootkit Attacks to Protect Linux Kernel Functions". IEEE Transactions on Computers. 70 (10): 1640–1653. doi:10.1109/TC.2020.3022023. S2CID 226480878.

eeye.com

Soeder, Derek; Permeh, Ryan (2007-05-09). "Bootroot". eEye Digital Security. Archived from the original on 2013-08-17. Retrieved 2010-11-23.

eset.com

Matrosov, Aleksandr; Rodionov, Eugene (2010-06-25). "TDL3: The Rootkit of All Evil?" (PDF). Moscow: ESET. p. 3. Archived from the original (PDF) on 2011-05-13. Retrieved 2010-08-17.
Matrosov, Aleksandr; Rodionov, Eugene (2011-06-27). "The Evolution of TDL: Conquering x64" (PDF). ESET. Archived from the original (PDF) on 2015-07-29. Retrieved 2011-08-08.

f-secure.com

"BlackLight". F-Secure. Archived from the original on 21 September 2012. Retrieved 8 August 2011.

freedom-to-tinker.com

Felton, Ed (2005-11-15). "Sony's Web-Based Uninstaller Opens a Big Security Hole; Sony to Recall Discs".

gmer.net

"GMER". Retrieved 8 August 2011.

ieee.org

spectrum.ieee.org

Vassilis Prevelakis; Diomidis Spinellis (July 2007). "The Athens Affair".

ieeexplore.ieee.org

Li, Yong-Gang; Chung, Yeh-Ching; Hwang, Kai; Li, Yue-Jin (2021). "Virtual Wall: Filtering Rootkit Attacks to Protect Linux Kernel Functions". IEEE Transactions on Computers. 70 (10): 1640–1653. doi:10.1109/TC.2020.3022023. S2CID 226480878.

infoworld.com

Hultquist, Steve (2007-04-30). "Rootkits: The next big enterprise threat?". InfoWorld. Retrieved 2010-11-21.

kaspersky.com

"What is Rootkit – Definition and Explanation". www.kaspersky.com. 2021-04-09. Retrieved 2021-11-13.

mcafee.com

"Rootkits, Part 1 of 3: The Growing Threat" (PDF). McAfee. 2006-04-17. Archived from the original (PDF) on 2006-08-23.
"Rootkits Part 2: A Technical Primer" (PDF). McAfee. 2007-04-03. Archived from the original (PDF) on 2008-12-05. Retrieved 2010-08-17.

megasecurity.org

Chuvakin, Anton (2003-02-02). An Overview of Unix Rootkits (PDF) (Report). Chantilly, Virginia: iDEFENSE. Archived from the original (PDF) on 2011-07-25. Retrieved 2010-11-21.

mhprofessional.com

Davis, Michael A.; Bodmer, Sean; LeMasters, Aaron (2009-09-03). "Chapter 10: Rootkit Detection" (PDF). Hacking Exposed Malware & Rootkits: Malware & rootkits security secrets & solutions. New York: McGraw Hill Professional. ISBN 978-0-07-159118-8.

microsoft.com

blogs.technet.microsoft.com

Russinovich, Mark (2005-10-31). "Sony, Rootkits and Digital Rights Management Gone Too Far". TechNet Blogs. Microsoft. Retrieved 2010-08-16.
"Restart Issues After Installing MS10-015". Microsoft. 2010-02-11. Retrieved 2010-10-05.

research.microsoft.com

Wang, Zhi; Jiang, Xuxian; Cui, Weidong; Ning, Peng (2009-08-11). "Countering Kernel Rootkits with Lightweight Hook Protection" (PDF). In Al-Shaer, Ehab (General Chair) (ed.). Proceedings of the 16th ACM Conference on Computer and Communications Security. CCS 2009: 16th ACM Conference on Computer and Communications Security. Jha, Somesh; Keromytis, Angelos D. (Program Chairs). New York: ACM New York. doi:10.1145/1653662.1653728. ISBN 978-1-60558-894-0. Retrieved 2009-11-11.
"Strider GhostBuster Rootkit Detection". Microsoft Research. 2010-01-28. Archived from the original on 2012-07-29. Retrieved 2010-08-14.

msdn.microsoft.com

"Device Guard is the combination of Windows Defender Application Control and virtualization-based protection of code integrity (Windows 10)". 11 July 2023.
"Signing and Checking Code with Authenticode". Microsoft. Retrieved 2008-09-15.

technet.microsoft.com

Cogswell, Bryce; Russinovich, Mark (2006-11-01). "RootkitRevealer v1.71". Microsoft. Retrieved 2010-11-13.
Danseglio, Mike; Bailey, Tony (2005-10-06). "Rootkits: The Obscure Hacker Attack". Microsoft.

support.microsoft.com

download.microsoft.com

"Understanding Anti-Malware Technologies" (PDF). Microsoft. 2007-02-21. Archived from the original (PDF) on 2010-09-11. Retrieved 2010-08-17.

microsoft.com

"Driver Signing Requirements for Windows". Microsoft. Retrieved 2008-07-06.

networkworld.com

Messmer, Ellen (2006-08-26). "Experts Divided Over Rootkit Detection and Removal". NetworkWorld.com. Framingham, Mass.: IDG. Retrieved 2010-08-15.

newscientist.com

Knight, Will (2005-11-11). "Sony BMG sued over cloaking software on music CD". New Scientist. Retrieved 2010-11-21.

ngsconsulting.com

Heasman, John (2006-11-15). "Implementing and Detecting a PCI Rootkit" (PDF). Next Generation Security Software. CiteSeerX: 10.1.1.89.7305. Retrieved 2010-11-13.

nvlabs.in

"BOOT KIT: Custom boot sector based Windows 2000/XP/2003 Subversion". NVlabs. 2007-02-04. Archived from the original on June 10, 2010. Retrieved 2010-11-21.

pcworld.com

Bort, Julie (2007-09-29). "Six ways to fight back against botnets". PCWorld. San Francisco: PCWorld Communications. Retrieved 2009-04-07.

phrack.org

Kdm. "NTIllusion: A portable Win32 userland rootkit". Phrack. 62 (12).
Hoglund, Greg (1999-09-09). "A *REAL* NT Rootkit, Patching the NT Kernel". Phrack. 9 (55). Retrieved 2010-11-21.
Sacco, Anibal; Ortéga, Alfredo (2009-06-01). "Persistent BIOS Infection: The Early Bird Catches the Worm". Phrack. 66 (7). Retrieved 2010-11-13.

prevx.com

pxnow.prevx.com

Marco Giuliani (11 April 2011). "ZeroAccess – An Advanced Kernel Mode Rootkit" (PDF). Webroot Software. Retrieved 10 August 2011.

psu.edu

citeseerx.ist.psu.edu

Myers, Michael; Youndt, Stephen (2007-08-07). An Introduction to Hardware-Assisted Virtual Machine (HVM) Rootkits (Report). Crucial Security. CiteSeerX 10.1.1.90.8832.
Heasman, John (2006-11-15). "Implementing and Detecting a PCI Rootkit" (PDF). Next Generation Security Software. CiteSeerX: 10.1.1.89.7305. Retrieved 2010-11-13.

sans.org

Dai Zovi, Dino (2011). "Kernel Rootkits". Archived from the original on September 10, 2012. Retrieved 13 Sep 2012.
Hannel, Jeromey (2003-01-23). "Linux RootKits For Beginners - From Prevention to Removal". SANS Institute. Archived from the original (PDF) on October 24, 2010. Retrieved 2010-11-22.

schneier.com

Schneier, Bruce (2009-10-23). "'Evil Maid' Attacks on Encrypted Hard Drives". Retrieved 2009-11-07.

semanticscholar.org

api.semanticscholar.org

King, Samuel T.; Chen, Peter M.; Wang, Yi-Min; Verbowski, Chad; Wang, Helen J.; Lorch, Jacob R. (2006-04-03). "SubVirt: Implementing malware with virtual machines" (PDF). 2006 IEEE Symposium on Security and Privacy (S&P'06). Institute of Electrical and Electronics Engineers. pp. 14 pp.-327. doi:10.1109/SP.2006.38. ISBN 0-7695-2574-1. S2CID 1349303. Retrieved 2008-09-15.
Seshadri, Arvind; et al. (2005). "Pioneer". Proceedings of the twentieth ACM symposium on Operating systems principles. Carnegie Mellon University. pp. 1–16. doi:10.1145/1095810.1095812. ISBN 1595930795. S2CID 9960430.
Li, Yong-Gang; Chung, Yeh-Ching; Hwang, Kai; Li, Yue-Jin (2021). "Virtual Wall: Filtering Rootkit Attacks to Protect Linux Kernel Functions". IEEE Transactions on Computers. 70 (10): 1640–1653. doi:10.1109/TC.2020.3022023. S2CID 226480878.

sigsac.org

Wang, Zhi; Jiang, Xuxian; Cui, Weidong; Ning, Peng (2009-08-11). "Countering Kernel Rootkits with Lightweight Hook Protection" (PDF). In Al-Shaer, Ehab (General Chair) (ed.). Proceedings of the 16th ACM Conference on Computer and Communications Security. CCS 2009: 16th ACM Conference on Computer and Communications Security. Jha, Somesh; Keromytis, Angelos D. (Program Chairs). New York: ACM New York. doi:10.1145/1653662.1653728. ISBN 978-1-60558-894-0. Retrieved 2009-11-11.

sogeti.com

esec-lab.sogeti.com

Delugré, Guillaume (2010-11-21). Reversing the Broacom NetExtreme's Firmware (PDF). hack.lu. Sogeti. Archived from the original (PDF) on 2012-04-25. Retrieved 2010-11-25.

sophos.com

"Sophos Anti-Rootkit". Sophos. Retrieved 8 August 2011.

sourceforge.net

"Zeppoo". SourceForge. 18 July 2009. Retrieved 8 August 2011.

stoned-vienna.com

Kleissner, Peter (2009-09-02). "Stoned Bootkit: The Rise of MBR Rootkits & Bootkits in the Wild" (PDF). Archived from the original (PDF) on 2011-07-16. Retrieved 2010-11-23.
Kleissner, Peter (2009-10-19). "Stoned Bootkit". Peter Kleissner. Retrieved 2009-11-07.^{[self-published source]}

symantec.com

"Windows Rootkit Overview" (PDF). Symantec. 2006-03-26. Archived from the original (PDF) on 2010-12-14. Retrieved 2010-08-17.
"Stuxnet Introduces the First Known Rootkit for Industrial Control Systems". Symantec. 2010-08-06. Archived from the original on August 20, 2010. Retrieved 2010-12-04.
Harriman, Josh (2007-10-19). "A Testing Methodology for Rootkit Removal Effectiveness" (PDF). Dublin, Ireland: Symantec Security Response. Archived from the original (PDF) on 2009-10-07. Retrieved 2010-08-17.

sysinternals.com

Russinovich, Mark (6 February 2006). "Using Rootkits to Defeat Digital Rights Management". Winternals. SysInternals. Archived from the original on 14 August 2006. Retrieved 2006-08-13.

techtarget.com

searchenterprisedesktop.techtarget.com

Dillard, Kurt (2005-08-03). "Rootkit battle: Rootkit Revealer vs. Hacker Defender".

theregister.co.uk

Goodin, Dan (2010-11-16). "World's Most Advanced Rootkit Penetrates 64-bit Windows". The Register. Retrieved 2010-11-22.
Modine, Austin (2008-10-10). "Organized crime tampers with European card swipe devices: Customer data beamed overseas". The Register. Situation Publishing. Retrieved 2008-10-13.
Goodin, Dan (2009-03-24). "Newfangled rootkits survive hard disk wiping". The Register. Situation Publishing. Retrieved 2009-03-25.

theregister.com

Francisco, Neil McAllister in San. "Microsoft tightens grip on OEM Windows 8 licensing". www.theregister.com.

tiscali.co.uk

Kyriakidou, Dina (March 2, 2006). ""Greek Watergate" Scandal Sends Political Shockwaves". Reuters. Retrieved 2007-11-24. ^{[dead link]}

trendmicro.com

blog.trendmicro.com

"Hacking Team Uses UEFI BIOS Rootkit to Keep RCS 9 Agent in Target Systems - TrendLabs Security Intelligence Blog". 2015-07-13.

trlokom.com

Trlokom (2006-07-05). "Defeating Rootkits and Keyloggers" (PDF). Trlokom. Archived from the original (PDF) on 2011-07-17. Retrieved 2010-08-17.

trustedcomputinggroup.org

"Stopping Rootkits at the Network Edge" (PDF). Beaverton, Oregon: Trusted Computing Group. January 2017. Retrieved 2008-07-11.
"TCG PC Specific Implementation Specification, Version 1.1" (PDF). Trusted Computing Group. 2003-08-18. Retrieved 2010-11-22.

umich.edu

eecs.umich.edu

King, Samuel T.; Chen, Peter M.; Wang, Yi-Min; Verbowski, Chad; Wang, Helen J.; Lorch, Jacob R. (2006-04-03). "SubVirt: Implementing malware with virtual machines" (PDF). 2006 IEEE Symposium on Security and Privacy (S&P'06). Institute of Electrical and Electronics Engineers. pp. 14 pp.-327. doi:10.1109/SP.2006.38. ISBN 0-7695-2574-1. S2CID 1349303. Retrieved 2008-09-15.

usec.at

"Radix Anti-Rootkit". usec.at. Archived from the original on 21 September 2012. Retrieved 8 August 2011.

usenix.org

Brumley, David (1999-11-16). "Invisible Intruders: rootkits in practice". USENIX.

vividmachines.com

Steve Hanna (September 2007). "Using Rootkit Technology for Honeypot-Based Malware Detection" (PDF). CCEID Meeting.

washingtonpost.com

Marks, Joseph (July 1, 2021). "The Cybersecurity 202: DOJ's future is in disrupting hackers, not just indicting them". The Washington Post. Retrieved July 24, 2021.

web.archive.org

"Rootkits, Part 1 of 3: The Growing Threat" (PDF). McAfee. 2006-04-17. Archived from the original (PDF) on 2006-08-23.
"Windows Rootkit Overview" (PDF). Symantec. 2006-03-26. Archived from the original (PDF) on 2010-12-14. Retrieved 2010-08-17.
"Stuxnet Introduces the First Known Rootkit for Industrial Control Systems". Symantec. 2010-08-06. Archived from the original on August 20, 2010. Retrieved 2010-12-04.
"Spyware Detail: XCP.Sony.Rootkit". Computer Associates. 2005-11-05. Archived from the original on 2010-08-18. Retrieved 2010-08-19.
Kyriakidou, Dina (March 2, 2006). ""Greek Watergate" Scandal Sends Political Shockwaves". Reuters. Retrieved 2007-11-24. ^{[dead link]}
Russinovich, Mark (6 February 2006). "Using Rootkits to Defeat Digital Rights Management". Winternals. SysInternals. Archived from the original on 14 August 2006. Retrieved 2006-08-13.
Kleissner, Peter (2009-09-02). "Stoned Bootkit: The Rise of MBR Rootkits & Bootkits in the Wild" (PDF). Archived from the original (PDF) on 2011-07-16. Retrieved 2010-11-23.
"Rootkits Part 2: A Technical Primer" (PDF). McAfee. 2007-04-03. Archived from the original (PDF) on 2008-12-05. Retrieved 2010-08-17.
"Understanding Anti-Malware Technologies" (PDF). Microsoft. 2007-02-21. Archived from the original (PDF) on 2010-09-11. Retrieved 2010-08-17.
Chuvakin, Anton (2003-02-02). An Overview of Unix Rootkits (PDF) (Report). Chantilly, Virginia: iDEFENSE. Archived from the original (PDF) on 2011-07-25. Retrieved 2010-11-21.
Soeder, Derek; Permeh, Ryan (2007-05-09). "Bootroot". eEye Digital Security. Archived from the original on 2013-08-17. Retrieved 2010-11-23.
"BOOT KIT: Custom boot sector based Windows 2000/XP/2003 Subversion". NVlabs. 2007-02-04. Archived from the original on June 10, 2010. Retrieved 2010-11-21.
Delugré, Guillaume (2010-11-21). Reversing the Broacom NetExtreme's Firmware (PDF). hack.lu. Sogeti. Archived from the original (PDF) on 2012-04-25. Retrieved 2010-11-25.
Sacco, Anibal; Ortéga, Alfredo (2009). Persistent BIOS infection (PDF). CanSecWest 2009. Core Security Technologies. Archived from the original (PDF) on 2011-07-08. Retrieved 2010-11-21.
Matrosov, Aleksandr; Rodionov, Eugene (2010-06-25). "TDL3: The Rootkit of All Evil?" (PDF). Moscow: ESET. p. 3. Archived from the original (PDF) on 2011-05-13. Retrieved 2010-08-17.
Matrosov, Aleksandr; Rodionov, Eugene (2011-06-27). "The Evolution of TDL: Conquering x64" (PDF). ESET. Archived from the original (PDF) on 2015-07-29. Retrieved 2011-08-08.
Trlokom (2006-07-05). "Defeating Rootkits and Keyloggers" (PDF). Trlokom. Archived from the original (PDF) on 2011-07-17. Retrieved 2010-08-17.
Dai Zovi, Dino (2011). "Kernel Rootkits". Archived from the original on September 10, 2012. Retrieved 13 Sep 2012.
Harriman, Josh (2007-10-19). "A Testing Methodology for Rootkit Removal Effectiveness" (PDF). Dublin, Ireland: Symantec Security Response. Archived from the original (PDF) on 2009-10-07. Retrieved 2010-08-17.
"Security Watch: Rootkits for fun and profit". CNET Reviews. 2007-01-19. Archived from the original on 2012-10-08. Retrieved 2009-04-07.
Hannel, Jeromey (2003-01-23). "Linux RootKits For Beginners - From Prevention to Removal". SANS Institute. Archived from the original (PDF) on October 24, 2010. Retrieved 2010-11-22.

windowsitpro.com

Russinovich, Mark (June 2005). "Unearthing Root Kits". Windows IT Pro. Archived from the original on 2012-09-18. Retrieved 2010-12-16.

zdnet.com

Osborne, Charlie (September 17, 2019). "Skidmap malware buries into the kernel to hide illicit cryptocurrency mining". ZDNet. Retrieved July 24, 2021.