Dedication |
|
v | |
List of Figures |
|
xi | |
Preface |
|
xv | |
|
|
1 | (10) |
|
|
1 | (1) |
|
1.2 The Myth of Absolute Security |
|
|
2 | (1) |
|
|
3 | (1) |
|
1.4 The Number of Threats |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
7 | (1) |
|
1.8 Some Words of Warning |
|
|
7 | (4) |
|
2. DEFINITIONS AND TIMELINE |
|
|
11 | (16) |
|
|
11 | (8) |
|
|
12 | (1) |
|
|
12 | (1) |
|
|
13 | (1) |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
17 | (1) |
|
2.1.9 Hybrids, Droppers, and Blended Threats |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
19 | (2) |
|
|
21 | (1) |
|
|
22 | (5) |
|
|
27 | (26) |
|
3.1 Classification by Target |
|
|
28 | (6) |
|
3.1.1 Boot-Sector Infectors |
|
|
28 | (2) |
|
|
30 | (3) |
|
|
33 | (1) |
|
3.2 Classification by Concealment Strategy |
|
|
34 | (14) |
|
|
34 | (1) |
|
|
35 | (2) |
|
|
37 | (1) |
|
|
38 | (1) |
|
|
38 | (8) |
|
|
46 | (1) |
|
|
47 | (1) |
|
|
48 | (5) |
|
|
53 | (44) |
|
4.1 Detection: Static Methods |
|
|
55 | (16) |
|
|
55 | (14) |
|
|
69 | (1) |
|
|
70 | (1) |
|
4.2 Detection: Dynamic Methods |
|
|
71 | (8) |
|
4.2.1 Behavior Monitors/Blockers |
|
|
71 | (3) |
|
|
74 | (5) |
|
4.3 Comparison of Anti-Virus Detection Techniques |
|
|
79 | (1) |
|
4.4 Verification, Quarantine, and Disinfection |
|
|
80 | (5) |
|
|
81 | (1) |
|
|
82 | (1) |
|
|
82 | (3) |
|
4.5 Virus Databases and Virus Description Languages |
|
|
85 | (3) |
|
|
88 | (9) |
|
4.6.1 Anti-Stealth Techniques |
|
|
88 | (1) |
|
4.6.2 Macro Virus Detection |
|
|
89 | (1) |
|
4.6.3 Compiler Optimization |
|
|
90 | (7) |
|
5. ANTI-ANTI-VIRUS TECHNIQUES |
|
|
97 | (12) |
|
|
97 | (2) |
|
5.2 Entry Point Obfuscation |
|
|
99 | (1) |
|
|
99 | (2) |
|
|
99 | (1) |
|
|
100 | (1) |
|
|
100 | (1) |
|
|
101 | (4) |
|
|
101 | (2) |
|
|
103 | (2) |
|
|
105 | (1) |
|
5.6 Integrity Checker Attacks |
|
|
106 | (1) |
|
|
106 | (3) |
|
|
109 | (34) |
|
|
109 | (25) |
|
|
110 | (3) |
|
|
113 | (10) |
|
|
123 | (2) |
|
6.1.4 Format String Vulnerabilities |
|
|
125 | (2) |
|
|
127 | (5) |
|
|
132 | (2) |
|
|
134 | (9) |
|
|
136 | (7) |
|
|
143 | (14) |
|
|
144 | (4) |
|
7.1.1 Xerox PARC, c. 1982 |
|
|
144 | (1) |
|
7.1.2 The Internet Worm, November 1988 |
|
|
145 | (3) |
|
|
148 | (9) |
|
|
149 | (1) |
|
|
150 | (7) |
|
|
157 | (20) |
|
|
158 | (9) |
|
|
158 | (1) |
|
|
158 | (5) |
|
|
163 | (4) |
|
8.2 Capture and Containment |
|
|
167 | (5) |
|
|
168 | (1) |
|
|
169 | (1) |
|
|
170 | (2) |
|
8.3 Automatic Countermeasures |
|
|
172 | (5) |
|
|
177 | (12) |
|
|
177 | (1) |
|
|
178 | (1) |
|
9.3 Access-for-Sale Worms |
|
|
179 | (2) |
|
|
181 | (1) |
|
|
182 | (3) |
|
|
185 | (4) |
10. PEOPLE AND COMMUNITIES |
|
189 | (12) |
|
|
189 | (2) |
|
|
189 | (1) |
|
|
190 | (1) |
|
10.2 The Anti-Virus Community |
|
|
191 | (10) |
|
|
192 | (1) |
|
10.2.2 Another Day in Paradise |
|
|
192 | (2) |
|
|
194 | (1) |
|
|
195 | (1) |
|
|
196 | (5) |
11. WHAT SHOULD WE DO? |
|
201 | (4) |
References |
|
205 | (18) |
Index |
|
223 | |