I know it's annoying to hear this, but I'm going to keep saying it: this stuff is silly. The DLL injection stuff in the CIA leaks should embarrass the CIA. If you're calibrating your defenses based on the idea that application programs on Windows and OS X can defend against malware, you're playing to lose.
Here's the rootkits track from Black Hat 2008 --- keep in mind that this is almost a decade old and that it's public work:
* Deeper Door: Exploiting NIC Chipsets
* A New Breed of Rootkit: The System Management Mode Rootkit
* Insane Detection of Insane Rootkits
* Crafting OS X Kernel Rootkits
* Viral Infections on Cisco IOS
* Detecting And Preventing Xen Hypervisor Subversions
* Bluepilling (implementing a hypervisor rootkit) The Xen Hypervisor
This is just one year's work. If you summed all of it together, you're talking ~2.5 FTEs across 7 different research projects which we will very generously assume took a full year to develop (spoiler: no, none of them did). People who can write hypervisor rootkits command a pretty decent salary, but it's not 2x the prevailing SFBA senior salary. So this is at most mid-single-digit millions worth of work.
I don't know why the CIA has this team of people bumbling around with DLL injectors and AV bypasses. Maybe it's some weird turf thing they're doing against NSA? But the stuff in the CIA leaks is not the standard you need to be protecting yourself against.
Here's the rootkits track from Black Hat 2008 --- keep in mind that this is almost a decade old and that it's public work:
* Deeper Door: Exploiting NIC Chipsets
* A New Breed of Rootkit: The System Management Mode Rootkit
* Insane Detection of Insane Rootkits
* Crafting OS X Kernel Rootkits
* Viral Infections on Cisco IOS
* Detecting And Preventing Xen Hypervisor Subversions
* Bluepilling (implementing a hypervisor rootkit) The Xen Hypervisor
This is just one year's work. If you summed all of it together, you're talking ~2.5 FTEs across 7 different research projects which we will very generously assume took a full year to develop (spoiler: no, none of them did). People who can write hypervisor rootkits command a pretty decent salary, but it's not 2x the prevailing SFBA senior salary. So this is at most mid-single-digit millions worth of work.
I don't know why the CIA has this team of people bumbling around with DLL injectors and AV bypasses. Maybe it's some weird turf thing they're doing against NSA? But the stuff in the CIA leaks is not the standard you need to be protecting yourself against.