Eric Filiol Virology and Cryptology Lab, Army Signals Academy
download slides (PDF)
Recent advances in stealth techniques have dramatically increased the malware hazard. More recently, rootkits like SubVirt or BluePill have strongly challenged the classical capabilities of malware detection.
In this paper, we formalize stealth and rootkits technologies in a far different way that those typically considered, that is to say as a more or less complex set of hooking and kernel subversions.
By comparing stealth or rootkits to steganographic techniques, we propose a new information theoretic-based formalisation that enables us to define the problem of stealth detection in a more powerful and high level way than the existing ones. Consequently, it yields new perspectives of what detection of stealth really is and how to address the relevant problem on a practical basis. In particular, this modelling gives clues and potential practical approaches to detect the most recent rootkit techniques like SubVirt or BluePill.
