The evolution of TDL: conquering x64 - Revision history

Eric.freyssinet at 03:39, 12 August 2015

2015-08-12T03:39:05Z

← Older revision		Revision as of 03:39, 12 August 2015
Line 5:		Line 5:
	\|Operation=,		\|Operation=,
	\|Year=2011		\|Year=2011
	\|Date=30 ~~mars 2011~~		\|Date=2011-03-30
	\|Editor=ESET		\|Editor=ESET
	\|Link=http://www.eset.com/us/resources/white-papers/The_Evolution_of_TDL.pdf		\|Link=http://www.eset.com/us/resources/white-papers/The_Evolution_of_TDL.pdf

Eric.freyssinet at 03:38, 12 August 2015

2015-08-12T03:38:23Z

← Older revision		Revision as of 03:38, 12 August 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|~~Image~~=		\|Botnet=,
	\|~~Legend~~=		\|Malware=TDL-4 (bot), TDL-3 (bot),
	\|~~Document~~=		\|CCProtocol=HTTP, HTTPS, Kademlia P2P,
	\|~~Licence~~=		\|Operation=,
	~~\|Video=~~		\|Year=2011
	~~\|Link=http://www.eset.com/us/resources/white-papers/The_Evolution_of_TDL.pdf~~
	~~\|Author=Eugene Rodionov, Aleksandr Matrosov~~,
	\|~~NomRevue~~=~~ESET white papers~~
	\|Date=30 mars 2011		\|Date=30 mars 2011
	\|Editor=ESET		\|Editor=ESET
	\|~~Year~~=~~2011~~		\|Link=http://www.eset.com/us/resources/white-papers/The_Evolution_of_TDL.pdf
	\|~~ISBN=~~		\|Author=Eugene Rodionov, Aleksandr Matrosov,
	~~\|Page~~=
	\|Abstract=It has been about two years since the Win32/Olmarik (also known as TDSS, TDL and Alureon) family of		\|Abstract=It has been about two years since the Win32/Olmarik (also known as TDSS, TDL and Alureon) family of
	malware programs started to evolve. The authors of the rootkit implemented one of the most		malware programs started to evolve. The authors of the rootkit implemented one of the most
Line 32:		Line 28:
	involved in distributing the malware. Afterwards we go deeper into the technical details of the bootkit		involved in distributing the malware. Afterwards we go deeper into the technical details of the bootkit
	implementation.		implementation.
	\|~~Botnet~~=,		\|Document=
	\|~~Malware~~=~~TDL-4 (bot), TDL-3 (bot),~~		\|Licence=
	\|~~CCProtocol~~=~~HTTP, HTTPS, P2P (Kad),~~		\|Video=
	\|~~Operation~~=,		\|NomRevue=ESET white papers
	\|Keyword=bootkit,		\|ISBN=
			\|Page=
			\|Keyword=bootkit,
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:13Z

1 revision imported

← Older revision	Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet at 21:22, 20 February 2012

2012-02-20T21:22:43Z

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.eset.com/us/resources/white-papers/The_Evolution_of_TDL.pdf
|Author=Eugene Rodionov, Aleksandr Matrosov,
|NomRevue=ESET white papers
|Date=30 mars 2011
|Editor=ESET
|Year=2011
|ISBN=
|Page=
|Abstract=It has been about two years since the Win32/Olmarik (also known as TDSS, TDL and Alureon) family of
malware programs started to evolve. The authors of the rootkit implemented one of the most
sophisticated and advanced mechanisms for bypassing various protective measures and security
mechanisms embedded into the operating system. The fourth version of the TDL rootkit family is the
first reliable and widely spread bootkit targeting x64 operating systems such as Windows Vista and
Windows 7. The active spread of TDL4 started in August 2010 and since then several versions of the
malware have been released. Comparing it with its predecessors, TDL4 is not just a modification of the
previous versions, but new malware. There are several parts that have been changed, but the most
radical changes were made to its mechanisms for self-embedding into the system and surviving reboot.
One of the most striking features of TDL4 is its ability to load its kernel-mode driver on systems with an
enforced kernel-mode code signing policy (64-bit versions of Microsoft Windows Vista and 7) and
perform kernel-mode hooks with kernel-mode patch protection policy enabled. This makes TDL4 a
powerful weapon in the hands of cybercriminals.
It is the abundance of references to TDL4 combined with an absence of a fully comprehensive source of
essential TDL4 implementation detail that motivated us to start this research. In this report, we
investigate the implementation details of the malware and the ways in which it is distributed, and
consider the cybercriminals’ objectives. The report begins with information about the cybercrime group
involved in distributing the malware. Afterwards we go deeper into the technical details of the bootkit
implementation.
|Botnet=,
|Malware=TDL-4 (bot), TDL-3 (bot),
|CCProtocol=HTTP, HTTPS, P2P (Kad),
|Operation=,
|Keyword=bootkit,
}}