DEF CON Safe Mode - Bill Demirkapi - Demystifying Modern Windows Rootkits

This talk will demystify the process of writing a rootkit, moving past theory and instead walking the audience through the process of going from a driver that says "Hello World" to a driver that abuses never-before-seen hooking methods to control the user-mode network stack. Analysis includes common patterns seen in malware and the drawbacks that come with malware in kernel-mode rather than user-mode.

We'll walk through writing a rootkit from scratch, discussing how to load a rootkit, how to communicate with a rootkit, and how to hide a rootkit. With every method, we'll look into the drawbacks ranging from usability to detection vectors. The best part? We'll do this all under the radar, evading PatchGuard and anti-virus.

[williamfasoli]

Bill amazing talk. I love the clarity of your thinking process and how well you articulated it. Absolutely brilliant!

[camarada]

Sitting here with a masters in cyber security and getting schooled by a 19 year old kid on windows rootkits.. #feelsbadman

[ben-brady]

I feel like we're gonna be seeing this kid again at DEFCON.

[anthonything]

Great talk! Learned a lot. The applications for some of these concepts are really cool.

I discovered you via your cyberpatriot writeup a while back and its really cool to see you doing a defcon talk.

[jonathanacosta]

Microsoft security team furiously taking notes I imagine

[badermeinhof]

Great talk. Even if i just understood "root kit" it was very clear and informative. Like the format with good picture and quality compared to previous Def Con live talks Will look at some more presentations .. Good job (Y)

[Capsayin]

Idk if anyone can help me, but can anyone list down any resources on how to take control of hypervisors? Thx

[jaredtownsel]

Seriously, who put a thumbs down? Did they miss the other button?

[juandiego]

i now feel stupid. You man are amazing

[itaybarok]

Wow that was a really nice, clear and interesting presentation. Thanks for sharing this video.
BTW, does anybody have the presentation pages for recap?

[deepdivedisco]

A lot of malware still uses plaintext HTTP to communicate with C2, at least the lame shit. Rarely will a hacker bother to write a rootkit, but if you get compromised by one it's game over.

[tsmith]

Currently dealing with this. Pretty sure someone i pissed of in "Elyon" sharked it cause theres very few ppl who play it and did exactly this to my comp