Actions and Detail Panel
Melbourne: Windows Kernel Rootkits Techniques and Analysis
Mon., 16/10/2017, 8:30 am – Fri., 20/10/2017, 6:00 pm AEDT
WINDOWS KERNEL ROOTKITS TECHNIQUES AND ANALYSIS
This class is tailored for malware analysts, system developers, forensic analysts, incident responders, or enthusiasts who want to analyze Windows kernel rootkits or develop software for similar tasks. It introduces the Windows architecture and how various kernel components work together at the lowest level. It discusses how rootkits leverage these kernel components to facilitate nefarious activities such as hiding processes, files, network connections, and other common objects. As part of the analytical process, we will delve into the kernel programming environment; we will implement some kernel-mode utilities to aid our understanding.
Needless to say, the class will contain many hands-on labs and exercises using real-world rootkits. There are no made-up examples in the class.
What You Should Expect
After this class, you should have a systematic understanding of Windows kernel to analyze rootkits and develop kernel-mode drivers for your job. You will also understand and apply kernel concepts to carry out forensic investigations on a Windows machine. In addition, you will be able read and understand research on Windows kernel and related subjects. You will no longer feel intimidated by the kernel after this class.
In previous classes, practically all students were able to analyse kernel rootkits and develop drivers on their own at the end of the course. Many of these students have never written a driver before in their life and they felt comfortable doing it after the third day. Here are some examples of what some students accomplished after class: analyzed well-known kernel APTs, analyzed Windows Patchguard, developed a driver to remap keys, researched into hypervisor development.
Malware analysts, systems programmer, forensic analysts, security engineers, network security analysts, kernel enthusiasts.
About the Instructor
Bruce Dang is an information security researcher with interests in low-level systems. He is currently working at Veramine trying to make the world a safer place. He previously worked as a senior security development engineer lead at Microsoft; his team's focus spans all things product security related from hardware, OS, and web services. He specialises in reverse engineering and Windows kernel-level security projects. Before Microsoft, he worked as a developer in the financial sector. He was the first person to publicly discuss techniques of analyzing file format based exploits and has patents in the area of generic shellcode and exploit detection. His public research includes Microsoft Office exploit analysis, ROP detection, shellcode detection, and kernel driver decompilation techniques; on the malware side, he is known for first analyzing vulnerabilities in the Stuxnet worm. He has spoken at major security conferences worldwide, i.e., REcon (Canada), Blackhat (Vegas and Tokyo), Chaos Computer Club (Germany), Computer Antivirus Research Organization (Hungary), etc. In addition to sharing his knowledge at public conferences, he has also provided private training and lectures to government agencies. He is also the author of the bestselling reverse engineering textbook, Practical Reverse Engineering: x86, x64, Windows kernel, and obfuscation, published by John Wiley and Sons in 2014.
Terms and Conditions
Payment methods are either booking online via Event Brite or contacting us for an invoice.
Payment is required at the time of booking.
Cancellation notifications after 14 days prior to course commencement date are not eligible for refund.
Cancellations received between 15 and 28 days prior to course commencement will be charged 50% of the course fee.
Students are allowed 1 reschedule per class. Transfers received between 15 – 28 days prior to course commencement will be charged a $300 (incl GST) administrative fee. The new session date must be given at the time of the reschedule notification and rescheduled classes must be taken within 6 months of original scheduled date.
Transfers received 14 days or less prior to course commencement will be charged 50% of the course fee. The new session date must be given at the time of the reschedule notification and rescheduled classes must be taken within 6 months of original scheduled date.
Payment must be made in full prior to any rescheduling.
Student substitutions can be made in writing 48 hours prior to a class start.
If a student does not attend a scheduled session, there will be no refund or reschedule given. Payment is forfeited. Mossé Security reserves the right to cancel a course and will endeavour to provide participants with as much notice as possible. Upon cancellation, any fees already paid by the participant will be refunded.