Slashdot Mirror
Boot Record Rootkit Threatens Vista, XP, NT
Paul sends us word on a new exploit seen in the wild that attacks Windows systems completely outside of the control of the OS. "Unfortunately, all the Windows NT family (including Vista) still have the same security flaw — MBR [Master Boot Record] can be modified from usermode. Nevertheless, MS blocked write-access to disk sectors from userland code on VISTA after the pagefile attack, however, the first sectors of disk are still unprotected... At the end of 2007 stealth MBR rootkit was discovered by MR Team members (thanks to Tammy & MJ) and it looks like this way of affecting NT systems could be more common in near future if MBR stays unprotected."
That'd require changes to the partition table, which is protected from NT's usermode IIRC.
Are you trolling?
Macs use EFI and PC's use BIOS. That's why.
1) That's "Slashdot". -1 for capitalization, -5 for spelling.
2) Nazi is capitalized.
3) Your sig is an automatic Godwin. Might want to fix that.
4) You didn't end your sentence with punctuation. This one calls for a period.
5) Arrogant? You bet!
Hail Eris, full of mischief...
E pluribus sanguinem
It's not a troll. I just want to know. If I put my code to MBR and LILO loader somewhere else and then start it, will it work? I guess so.
Hen and egg. How does the virus get there in the first place. SOMEONE must first of all get it to execution. Malware doesn't suddenly jump in and exists. It has to be brought into the machine. A virus or trojan does jack when it just sits on your machine. It is a program. It has to be executed to do its "magic".
There are exactly three ways to get this done. First, remote (RPC) exploits, which is easy to defeat with a router that does not allow any packets in to sensitive ports. Second, exploits in programs. This is harder to secure, since you can never know whether your mail client or your web browser (or one of its myriad plugins) has such a vulnerability. Your best bet is to use something that has nearly no market share (and is thus not interesting for commercial malware users).
And finally, the user himself can execute it. And, believe it or not, this is the most used and most successful way of infecting a machine. In other words, the main security problem is not in the machine. It's in front of it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Yeah, like something that could fit in a 512 byte MBR...
Why bother?
That's what this does. It modifies the MBR to load the virus as a driver out of a pair of sectors.
This already does whatever it wants. And the "files open" comment is non-sensical, the pre-boot environment has no concept of "open files", it's just a little 512 byte loader.
There isn't much Windows (or any) OS can do when it isn't running.
If you read the article (it contains scary things like x86 assembly, I know, but you can skip that) you'd see that the describe this hooks into the load routines used by Windows. By intercepting these calls and redirecting them, it prevents you from overwriting the MBR or even detecting that it's changed (to a degree). To fix this you have to open a clean environment (like the recovery console off the Windows CD) and have it fix the MBR.
Amazing how even with all we've got, things go back to the same kind of viruses that were written back in the days of DOS 2.
I wonder if this would be so easily possible with EFI based booting. OS X uses it. Vista SP1 supports booting using EFI off disks don't partitioned with the old DOS partition format.
PS: Whoever modded the parent as informative either doesn't know what they're talking about, is drunk, or is in cahoots.
PPS: Sorry. I've been looking for an excuse to use the word "cahoots" all day.
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
Alright, I get the defense in depth concept, but I don't consider it to be a severe vulnerability that the MBR is writable while Windows is running. I consider that to be a feature, one I wish Microsoft did more of -- for example, I can install Linux from a Linux LiveCD, or I can install a second copy of it on another partition, etc. As far as I can tell, OS X is similarly flexible -- it forces you to type your password, but it can deliver a firmware update from within the OS -- think equivalent to a BIOS update, so even earlier than the MBR.
So, to clarify: It's writable from userland, which is not the same as being writable by any user. If they have Admin access (which means you already clicked a "This program wants to modify your Master Boot Record, are you sure?"), you're already screwed -- kind of like how, on Linux, if they have root, you're already screwed.
In other words, it's possible to modify your Master Boot Record without rebooting your computer. This is a good thing.
What's more, this is not new. All that's new is that it's both in the wild (Blue Pill does the same thing), and that it's a rootkit (MBR Viruses have been around for a very long time now). If someone was trying to apply for a patent, you'd be jumping all over them with prior art...
Don't thank God, thank a doctor!
How on earth does Ramen relate to MBR and Windows variants?
John 3:16. Know it.
Drink Yourself Healthy: MonaVie
well if it's going to attack liek that it would need higher privilages- that is it needs to exploit another flaw to exploit this one. That being said, it appears that pretty much any OS that has that particular method used [seperate partition + virus] would be affected. No doubt delivered in the same way it has always been, users downloading a new program. you can patch the OS all you want, you still can't patch the user.
Sigs are too short to say anything truly profound so read the above post instead.
I know I'll get flamed for saying it, but this is exactly the sort of problem that a TPM can solve.
I see that you are not an adherent of the True Church of the Flying Spaghetti Monster. The FSM has *everything* to do with Windows; we don't call it spaghetti code for nothing!
Hail Eris, full of mischief...
E pluribus sanguinem
Almost all BIOSes released in the past 5 years had MBR protection. Install your OS, turn on MBR protection and let the virus try.
I hated it at first, Linux installs failing as LILO not getting to write to the MBR until you turned it off.
Do not look at laser with remaining good eye.
... to write to the MBR.
For all other sectors Vista prevents writes to raw disk sectors even with admin permissions.
Users withouts admin permissions/without elevation cannot write to the MBR in Vista.
If these so-called invisible rootkits are so effective, why aren't we seeing them everywhere? Huh?
http://www.nuklearpower.com/daily.php?date=080103
The ______ Agenda
I can't imagine that would make any difference. The computer needs to boot somehow, there are legitimate reasons for modifying the boot code (such as installing a new OS, or fixing flaws in it) so you can't just block it wholesale, and any program that runs at the boot stage will necessarily have complete control of your computer. About the best you can do is require the user to confirm before overwriting the MBR - something I thought windows already did (and if it doesn't, there's really no excuse for it not to) - but that's far from foolproof.
I am trolling
"Security flaw"? Heck, I'm almost finished with the virus that overwrites the MBR with GRUB stage 1!
Alright, I guess I'm forced to admit I'm just kidding.
Tomato wedge sperm darts that are Republican.
Please correct me if this isn't a good way to prevent this
It's more likely than you think.
What is this? 1986?
+0 Meh
Do not anger the worm.
If these so-called invisible rootkits are so effective, why aren't we seeing them everywhere? Huh?
You keep using that word. I do not think it means what you think it means.
Whether it's a an MBR record or an executable file stored on a filesystem the firmware may understand, the concepts are the same. Any sane operating system will allow you to modify boot files (after all, how else do you upgrade early-execution code). Whether it's an MBR or a more sophisticate piece of firmware, the principle is the same. The question is whether users have been trained to always be administrator, or if they've been trained the more disciplined way where uncommon (at least should be)/privileged operations can only be executed at significant obious pain.
Under linux even, a number of distributions have on occasion ventured down the very dangerous/wrong approach of skipping user accounts and going all root for the sake of convenience. However, the mainstream usage of linux (and OSX) is thankfully non-root users, and as such any *serious* applications accomodate that usage pattern (with the bonus of being sanely multi-user.
Meanwhile, Windows heritage has been less optimal. The consumer oriented MS platforms right up until XP didn't have a meaningful non-administrator concept, as well as much of a multi-user concept. As a consequence, many application developers did bad things that would break (i.e. using registry entries that are machine specific rather than user specific, or even writing things like saved documents/games to the application Program Files directory. Win9x even provided relevant spots that would evolve to something meaningful, but without significant meaning, many third parties ignored it, especially after Win3.x training. XP was the first definitive wake up call to a WIDE variety of developers. Even so, the majority of users ended up being administrative users to make up for the gap (as well as having no easy automatic privilege escalation). Hell, even a customized preload I saw sets up one user, renaming the administrator user (and in fact, calls an un-renamed administrator account a security risk... indeed).
OSX made a clean break with OSX (relegating "classic" applications to a relatively severe sandbox"), Linux never had such an unclean history to overcome. So while OSX implementing clean privilege escalation, and Linux has been working on facilities that lend itself well to that (i.e. DBus). Windows XP did not make a clean break, and Vista didn't etiher, but Vista's UAC is an attempt at giving users a facility to do privilege escalation. It's annoying because of bad programs and bad habits. But non-admin default usage + UAC is the only way they have of maintaining a sane featureset without being considered so vulnerable.
It also doesn't help that so many Windows users see "click here for free smilies" and think it's a good idea to do so.
XML is like violence. If it doesn't solve the problem, use more.
As I know, most 3rd party motherboards offer "anti-virus" or the "write protect MBR" options. Even if available I doubt they will work when using onboard RAID features.
Basically, you leaves these options off when installing the OS. Once you're finished, you can safely turn them on. I'm not sure how often NTFS needs access to the MBR, but I know I've never had trouble leaving these features enabled with FAT32.
Life is not for the lazy.
Two-word noun phrases are only hyphenated when used in adjective form. For instance:
Gamma rays are a type of ionizing radiation.
but
The gamma-ray burst released 4.3 blargajoules of energy.
This is much less important in real operating systems, which don't allow mail clients or web browsers to muck up boot sectors and the like. Unfortunately, a whole lot of people are using toy operating systems by this criterion.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
You, sir, are truly a Windows man: "Any attempt to separate users and administrators is a bad thing".
A program running as root takes over a machine. News at 11!
It's really annoyed me that security companies continually report these things when they have no relevance to actual security. The concentration should always be on preventing malware from acquiring root access in the first place. Vista, despite its faults, actually does a much better job of this than its predecessors.
Also, this is Slashdot. Slashdot has Linux users, and wouldn't Linux users know that overwriting is even easier to do in Linux than NT? "dd if=trojan.bin of=/dev/hda", anyone?
By the way, there are many more bad things you can do as Administrator than just hack the boot sector. You can use bcdedit to create a fake Windows XP boot entry then put your Trojan kernel there.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
You get moderated down because you open your fool mouth without thinking. Remember the molten salt solar plant post? You basically repeatedly opened your gob to say, "I have no idea how all this works, but I'm much smarter than the guys who get paid megabux to design this stuff so <idiocy/>, <idiocy/>, <idiocy/>."
Indeed, the common cold has been around slightly longer, and we still haven't figured out how to prevent that, either.
Not as hard as finding such a flaw in the first place. Why, have you found one?
Visual IRC: Fast. Powerful. Free.
If these so-called invisible rootkits are so effective, why aren't we seeing them everywhere? Huh?
You forgot to select the tachyon detection grid option in your virus scanner. Duh.
The latter, because "Fuck off" is an imperative verb form and has nothing to do with adjectives.
If a person wanted to be sure, couldn't you burn a boot loader onto a CD, have the CD boot first, and have that direct the loading? IANLWK (I am no Linux Whiz Kid), but in my imperfect knowledge of the world, that seems like it would completely defend against this type of attack. I yearn for correction of my ways if this wouldn't work.
Or better yet, a USB key - an key that lets you start your computer. No key, no start. Faster than a CD, no moving parts, etc. Me likes.
Here.
It actually looks reasonable - you can still perform raw disk writes from userland (with admin rights, of course) - you just can't write over a mounted volume. Disk imaging utilities will still work, provided they dismount any volumes before they overwrite them (which they ought to be doing anyway; I should know, I wrote a Windows disk imaging utility at my last job).
And of course, you can't dismount a disk with an active pagefile on it, so it solves that vulnerability. But it does so in a reasonable way--I can't really imagine why a well-behaved program would want to scribble over a mounted volume; you don't know whether the cache is just going to clobber what you wrote in a second anyway. So I apologize for my FUD in the parent message; this security feature actually seems to strike a good balance.
Now the FUD in TFA is another story...
(which was only a few years ago 1999ish :)) we used to refer to it as PEBCAC errors. Problem Exists Between Keyboard And Chair.
Also of course was the prevalent ID10T virus. I swear, we once actually told a guy that after he wiped his pc for the n'th time, and he ate it all up...
Seven Days with Ubuntu Unity
SNIP consider the average user^H^H^H^H^H^H^H^H^H Windows user has to rely on AOL for their anti-virus.
[I am shaking my head while my hand are vigorously rubbing my brow in shock, sadness, and disbelief. Later I will pull out some hair. ]
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Once again, I thought Vista was supposed to be a complete re-write of Windows code. How do they manage to keep the same old buggy code from NT 4.0?
Yes, it's the super complicated SlashDot moderation system designed specifically to baffle the weak minded. Although some chimps have been known to figure it out, it apparently still has some effectiveness.
- It's not the Macs I hate. It's Digg users. -
Let me get this straight... Windows is so insecure a team of Mental Retards can hack it?
In true /. form, I had not read the Poster's Name, just what they had typed. Thanks Leto-II.
John 3:16. Know it.
Drink Yourself Healthy: MonaVie
MBR was THE attack vector for viruses back in the good old times of MS-DOS and floppies. Now it's new again?
Bot Assisted Blogging
He Who Controls the Bootloader
You are being MICROattacked, from various angles, in a SOFT manner.
Most likely because the way PC's work at a low level hasn't changed all that much. The BIOS is going to load whatever it finds in the first 512 bytes if disk into RAM. And the MBR doesn't necessarily have to be there; it is relocatable.
C|N>K
I can't imagine that would make any difference. The computer needs to boot somehow, there are legitimate reasons for modifying the boot code (such as installing a new OS, or fixing flaws in it) so you can't just block it wholesale, and any program that runs at the boot stage will necessarily have complete control of your computer. About the best you can do is require the user to confirm before overwriting the MBR - something I thought windows already did (and if it doesn't, there's really no excuse for it not to) - but that's far from foolproof.
I think most modern Bios's have MBR/boot sector virus protection options. Basically you set the option in the BIOS and it either prevents MBR access (through the on-chip IDE controller, duno about off-board cards or scsi devices) or interrupts the system and displays an alert screen (similar to an overheat warning some do). To use it, you turn it off, install your OS with boot loader of choice, then go turn it on. Anything trying to write MBR data gets rejected or notifies you in pretty ASCII colors on screen with beeps. I know its prevented me from installing lilo a couple times.Tm
Support TBI Research: http://www.raisinhope.org
No need to create a new partition. On a traditional disk, the first cylinder is reserved to the mbr, but the mbr lives on a single sector. The cyclinder on today's drives is much bigger, well enough for a nasty bug. That's how lilo works, by the way, and such a virus would nuke it on the spot.
... it wants its viruses back!
If you read the OP this is pretty much what DOS viruses were doing 20 years ago. Wow.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
In all the years of virus hunting and gathering, /MBR in the startup sequence.
/MBR then turn it back on in the bios. )
I only got a boot sector virus once. Now, I just fdisk
I may have had anynumber of boot sector viruses. I dont know. They all disappear
before I have a chance to detect them.
Windows cannot protect the MBR if windows is running or not AND THEY SHOUDLNT.
Its really up to the hardware vendors.
Put it into BIOS or have a jumper on the drive.
( Simple effortless fix, vs MAJOR CLUSTER F*** )
( I used to turn it off, and then fdisk
I always thought it was a nice feature. Where the hell did it go?
Most motherboards from the last part of previous century on had boot virus protection in some form, usually a write block on the first sectors of the first harddisk. This was enabled/disabled in the BIOS setup and effectively stopped any attempt to modify these sectors. Had to be turned off for OS installation, lilo modification etc, but I found it well worth the hassle. Has this disappeared? (Found on a P4B close by - so Asus had it recently)
accept no limits but time
I don't know about US usage, but in British usage there's no such rule, according to both Partridge's "Usage and Abusage" and Fowler's "Modern English Usage" (arguably two of the three most influential prescriptive grammars of the 20th century, the third being Fowler's "The King's English", which I don't have to hand).
As Partidge points out, "In the life of a compound word there are three stages: (1) two separate words (cat bird); (2) a hyphenated compound (cat-bird); (3) a single word (catbird)."
Apart from a few cases where the form is forced by a risk of ambiguity, whether a compound is hyphenated is determined by how far along that progression the compound has gone, and there is no rule to determine it. For example, in the same article Partridge uses "Dog-show" as a compound noun, thus hyphenated. And as an example of where a hyphen is forced, Partridge compares "The author's tense-sequence is defective in this passage" (see the hyphenated noun phrase used as a noun there?) with "A tense sequence of events succeeded a dull sequence". Clearly two-word noun phrases are not only hyphenated when used in adjective form.
So you're right that "grammar Nazi" does not have to be hyphenated, but for the wrong reason.
Quidnam Latine loqui modo coepi?
The MBR is a vulnerability by definition. Almost the only way to protect it is by having a jumper on the HDD itself, which must be fitted to enable writing to the MBR and must be removed to enable booting. That means that everytime you want to install a bootstrap loader, you will have to open up the machine and muck about inside it.
Question is, is the threat from the MBR vulnerability significant enough to warrant such a drastic solution?
Je fume. Tu fumes. Nous fûmes!
Je fume. Tu fumes. Nous fûmes!
1) That's "Slashdot". -1 for capitalization, -5 for spelling.
2) Nazi is capitalized. Also shouldn't it be Nazi's ? You know, just so we'd have something to bitch about on slow days ?
May contain traces of nut.
Made from the freshest electrons.
That's not what my users have been telling me...
Those sneaky weasels !
May contain traces of nut.
Made from the freshest electrons.
There are more good guys, but are there more *qualified* good guys?
How long was the zlib double free present? How long was the hardcoded password in Firebird?
I only got a boot sector virus once. Now, I just fdisk
May contain traces of nut.
Made from the freshest electrons.
I only got a boot sector virus once. Now, I just fdisk
I may have had anynumber of boot sector viruses. I dont know. They all disappear
before I have a chance to detect them. As an aside here's the problem with that scheme :
*time goes by*
Then :
- Machine boots
- MBR loads Windows *and* virus
- Windows overwrites MBR
- Presumably Virus checks for prior infection
- Virus overwrites MBR (sounds familiar?)
- stuff happens (?)
- machine shuts down
Windows cannot protect the MBR if windows is running or not AND THEY SHOUDLNT.Its really up to the hardware vendors.
Put it into BIOS or have a jumper on the drive.
( Simple effortless fix, vs MAJOR CLUSTER F*** )
( I used to turn it off, and then fdisk
I always thought it was a nice feature. Where the hell did it go? If infection of the MBR by a virus is a concern, hardware protection (as in having the controller forbid access) is indeed the only real solution in the current Windows context.
May contain traces of nut.
Made from the freshest electrons.
Since the average Windows user is probably buying a brand name PC, there is no excuse for not enabling the BIOS MBR protection at the factory. Those who are smart enough to install their own OS are *probably* smart enough to notice the warnign and turn it off themselves.
=Smidge=
A relevant quote from somewhere or other:
"Theres no such thing as a foolproof system because fools are too inventive."
I tried to just verify this is the correct quote but it seems to exist in many forms on the net, all have a similar meaning. Incidentally if anyone can point me in the direction of it original source I would be interested to know where it came from.
I dont read
Under linux, that's dictated by /etc/localtime. So, Linux isn't different from Windows in that respect.
There are applications which independently track the time zone, but they piss me off because they don't concur and I don't feel like selecting my time zone per application.
XML is like violence. If it doesn't solve the problem, use more.
I'm not sure if you can blame MS in this case though. If your machine is interfacing with the device through a plextor driver, which similarly allows the firmware update (as a non-privileged user), I'd say the weakness is Plextor's. Drivers need to be able to do their thing, and I'm not really sure that the OS could easily differentiate between a driver reading/writing a DVD or writing firmware. So if this were the case, MS wouldn't really be to blame unless it was actually their driver, or perhaps if the Plextor driver passed MS Certification.
Oooooh, XML compliant snarkism. Nice.
Aw hell, I can't resist:
....
Tutorial:
1) BiCapitalization is bad, mmmkay, especially when the word in question isn't officially so.
2) I got nothin'.
Hail Eris, full of mischief...
E pluribus sanguinem
There is a simple solution: Boot from the Ultimate Boot CD for Windows (UBCD4Win), and run a scan on all the boot sectors of all hard drives. Since the original, possibly infected, operating system and hard drives are not in control, the rootkit has no effect.
My mail client and web browser is run on lowest privilege level there is. No MBR mucking. No system file mucking. I run Vista and IE7 with non-admin rights. This security hole doesn't concern me or any other Vista user who is not stupid enough to turn off UAC.
You don't know what you don't know.
It's a long time since I studied high school grammar, but I'm pretty sure multiple adjectives which qualify the same noun should be separated by commas:
"Give me all your money or I shall throw a fuck-off, big rock at you."
However, there is something fishy about the word order here; so ultimately I'd go for:
"Give me all your money or I shall throw a big, fuck-off rock at you."
Whether EFI or BIOS, this is a (small) part of what TCPA is intended to defeat. The idea is that the EFI or BIOS hands a copy of the boot sector to the TPM before loading it, and the TPM hashes it into a state register. The boot sector code sends a copy of the boot loader code to the TPM for hashing before it loads, then the boot loader sends a copy of the OS kernel to the TPM before it loads, and so on.
Any piece of code along the way, or even user-level code after boot, can check the state register to decide if the boot code integrity is intact. Also, decryption keys can be bound to register states, so you can ensure that if malicious code does somehow get into the boot process, it cannot access data encrypted with those keys.
I fiddled for a while with a TPM-enabled GRUB to allow whole disk encryption keys (dm-crypt) to be bound to the boot state. It's a nice setup in that you have whole-disk encryption without having to enter a boot passphrase or attach a USB key or anything, and it ensures that any malicious modification of loader or kernel disables access to the data on the drive. Unfortuanately, it also loses access to the drive data when any non-malicious modification occurs. It's not terribly difficult to address that issue, but it really needs to be integrated into the package management system and thought through very carefully to ensure that no sort of failure during upgrade can leave your system inaccessible -- and yet the process must also not allow malicious code to do the same sort of "upgrades".
Of course, this is somewhat less of an issue on *nix, because write access to the MBR requires root privs.
One other thought about this situation: Although I'm generally a fan of TCPA for all of the good things it can be used for, I'm also leery of the evil that Microsoft can do with it. My paranoid side wonders if MS doesn't have a hand in this MBR virus -- and more to come -- as justification for pushing universal TPM deployment. TPMs are useful in machines that have high security requirements, but in consumer machines there's little value and lots of risk.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Real Operating systems have been doing that for 20 years, yet MSFT only just introduced it a year ago.
Windows MSFT reinventing Unix Poorly. When MSFT implents something similar to X i will not be able to stop laughing. They already have come up with a real command shell (Powershell)
i thought once I was found, but it was only a dream.
And finally, the user himself can execute it. And, believe it or not, this is the most used and most successful way of infecting a machine. In other words, the main security problem is not in the machine. It's in front of it.
.SWF file and an .EXE file may seem massive to you and me, but it's pretty academic to the average user for whom their computer is just a tool for getting stuff done.
I hate this blame-the-user viewpoint. Executing code is what computers are there to do. We bemoan the abysmal program monoculture of I.E. and Outlook Express, yet we blame unknowing users who try programs they find online. Furthermore, the distinction between a
A computer is a system to run code, whose utility lies in its ability to run a broad range of unexpected applications. What we need is not a culture that discourages experimentation and blames the user, but an OS with a clean separation between system and applications, protected memory, and protected disks outside of an application and user's home spaces. As the line between the desktop and the internet starts to fade, we need at an OS level some of the protections originally intended for untrusted space.
The ______ Agenda
Being appalled is the natural state of existence for a windows sysadmin.
Indeed. When I worked in IT support for 12 years, I cleaned up my fair share of user-executed virus/trojan attachments with such fun names as (paraphrasing, it's been a while) SnowWhiteNakedPics.exe, YourSecretAdmirer.exe, and my favorite, FilthyWhores.exe.
The best was that these were often run by people with high-level or otherwise revered/critical positions within the companies I provided support for...
Up, Up, Down, Down, Left, Right, Left, Right, B, A, START
Why do death penalty advocates mostly oppose abortion while vegans mostly support it?
Because it is easier to justify executing someone for murder or other horrible crime, than for simply being inconvenient.
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
Like everything XML - While it may be compliant it is never the right tool for the job. Correcting this..:
"I have no idea how all this works, but I'm much smarter than the guys who get paid megabux to design this stuff so foo."
Disabling the root account is simply done by having no entry, or an invalid entry (i.e. containing a character in the "scrambled password" field which cannot be generated by the scrambling algorithm, i.e. matching [^A-Za-z0-9./] and thus preventing any rescrambled password from ever matching it), for "root" in the file /etc/shadow.
/etc/passwd, a password which when scrambled matches the corresponding one in /etc/shadow and, if so, launches a program specified in /etc/passwd -- usually a shell -- in the name of the user whose login you typed), you start the shell directly, without having your login checked. You can only have one process going on at once, but that's still enough to have some phun with. And the shell just conveniently assumes your userid number is 0, which is root, so you get all the powers and none of the responsibilities.
/etc/shadow entry for root; and thus even if the root account was disabled before, you've enabled it. Later, you will restore the old (possibly bogus or non-existent) entry to the /etc/shadow file. You really should fix the timestamp on this; but you already left a big enough clue that you'd been mucking around when you rebooted the box. If the sysadmin doesn't notice that, hell, you might as well just pick the machine up and wander out the front door with it. (Probably doesn't even look suspicious if you have a pair of coveralls and an ID badge.)
Booting with "init=/bin/sh" means that instead of starting the process scheduler init (which would then run several instances of getty; each of which runs login, which checks that you entered a valid login that appears in
Once you've done the passwd step, you have now created a valid
Je fume. Tu fumes. Nous fûmes!
Actually, it seems most modern BIOSes do NOT have this option. I have not tested it, but I assume that even if the option is set, it can only trap calls made through the BIOS int13h. (DOS, Windows 3.1, Windows 9x/Me in legacy disk access mode only) Once you transition to protected mode and the 32bit realm, the BIOS is out of the loop for disk access. It is possible that somehow the Southbridge, or disk controller can get programmed to look for LBA 0x00000000 or CHS 0,0,1 accesses and block them, but I do not believe this is the case.
I first saw BIOS-based MBR protection in BIOS code dated 1992 (on a 486 motherboard). It was common enough back then, but fell out of favour during the early Win32 era, probably because it would scream and halt the system when Win9x went to rewrite the MBR (which it does occasionally for no reason that I know of).
I've noticed it's made a comeback in the past few years, and this is a good thing -- it may drive some users crazy, but it's good to HAVE it there if you want to use it.
~REZ~ #43301. Who'd fake being me anyway?
I'm afraid to ask, but how do you use salt in that manner?
Thank God for evolution.
FDISK /MBR is all fine and good if your virus merely resides in the MBR sector, and didn't alter the MBR code itself, and if your virus didn't encrypt the drive (which some did, back in the day). If it did, bye-bye data.
~REZ~ #43301. Who'd fake being me anyway?
Say what you want about Windows 98SE, but it still runs quite a number of games and is immune to Windows 2000/XP/Vista crapware.
On McAfee's site its pretty much the same, there is no definite means of determining the method of attack for virii/trojans and they are viewed as a seperate threat type. Of course they list the same vulnerabilities which could have been used as an attack vector along with some new ones just released today.
I agree that the user is probably the most likely attack vector but then a vulnerability has the potential for a much bigger impact because even the users who are not easy to trick into running an application become prey. So while it seems probably I still wouldn't feel comfortable jumping to conclusions as its just to easy to say "its the dumb users".
I don't know, but it sure sounds painful...
Yes it's an anecdote! Were you expecting original research in a Slashdot comment?
That's a new low, my friend. I generally don't mind the grammar Nazi thing, but this is really sad.
So, just to stoop to your level:
1) "Aw" isn't a word. "Aww" isn't either, but at least it's more accepted.
2) Neither is "mmmkay."
3) Feel free to use a single period at the end of a sentence.
4) "I got nothin'" should read "I have nothing."
- It's not the Macs I hate. It's Digg users. -
I didn't mean to say that exploits aren't used very much. I just think that the user is, has always, and will continue to be the number one avenue of infection.
I think a lot of malware today is spread via any method possible, which is why infection methods are not listed by AV companies. There is too much money involved for the scumbags that spread this crap to leave any door unopened. Today I see all kinds of non-Microsoft Windows programs like flash, java, real player, quicktime, firefox and all of the various IM clients being exploited, as opposed to a several years ago when the majority of vulnerabilities targeted were of outlook express and IE.
Anytime I start to doubt the sheer determination many people have to infect themselves, I remember a couple of years back when email worms first started to become "popular". Email server all came to the rescue and started implementing virus scanning on the email servers. To avoid detection, malware cretins placed their payload inside of zip files and the worms continued to spread. Email server admins then acted by scanning inside the zip files, and malware cretins promptly responded by encrypting the zip files and placing the password to the zip file in the body of the email...and the worms continued to spread!
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Kaspersky?
- Dan
Nope. Sorry, nope. There may be more people with good intentions than people with bad intentions, but the answer is, as usual: money.
Exploits, especially unknown 0days, are valuable. 4 to 5 digits is not impossible, depending on the impact, an exploit that can infect every machine running Windows, fully patched, without any action necessary by the user (i.e. a new remote exploit) can easily get you more money than you make in a year. Or 10 years, if you happen to be in, say, Uzbekistan.
Now, being "good" and reporting it gets you zip. Nada. Well, maybe a lawsuit from MS.
Question for 500: Do you think more "good" guys are hunting for exploits or more "bad" guys?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
An indicator is "spreading method". If it says email, you can rest assured it relies on social engineering.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
By the way, this technique does NOT work on all systems. I'm not entirely sure about the last time I tried it on Ubuntu, but on at least some systems, the initrd will also respond to init=foo, thus you'll get the initrd environment. That's not to say that you couldn't do similar damage from there (including running a root shell on the "real" system), I'm just stressing that there is no one way to attack all Linux systems.
/sbin/poweroff and such.
/sbin/init", and the system will have absolutely no clue that you changed anything.
Also, some of your stuff here is sloppy, on the systems for which it will work. "init 6" is not what you want -- you don't have init running at all at this point. What you want is to manually unmount, or "mount -o remount,ro", every filesystem, then sync, then either physically reboot or mess with
Or you can simply set everything back to the way you found it (mounted readonly and such), then "exec
Regardless, on anything, you just need physical access to the machine and sufficient time.
Don't thank God, thank a doctor!
"Fuck-off" modifies "big", not "rock", so I think the original is correct.
"Give me all your money or I shall throw a really, big rock at you."
"Give me all your money or I shall throw a big, really rock at you."
Both of these are clearly wrong.
Under capitalism man exploits man. Under communism it's the other way around.
Might be a cultural difference, but here in the UK "fuck-off" used in this way means something like "really big", "devastatingly impressive", "winning"; as in: "That new Radiohead album comes in a fuck-off gatefold sleeve". It is an adjective not an adverb.
I never suggested it was an adverb. In the original version of the sentence it is an adjective modifying another adjective (How big is the rock? Fuck-off big.), which is perfectly acceptable according to my understanding of English grammar.
Under capitalism man exploits man. Under communism it's the other way around.
It seems to me not so much a question of grammar, as of idiom. Where I hang out I tend to hear people say things like: "He threw a fuck-off rock at me"; haven't heard it used to qualify other adjectives - "fuck-off big" has a certain redundancy. But if it is used that way, the sentence I was originally complaining about is perfectly OK and I retract.
I wanted to say, that ONLY my current Gaming RIG. Abit motherboard does NOT have this feature. The Shuttle SB51 Motherboard HAS this feature. and it works well. I put an infected Win98 HD in it and it was lightning up like a chrismas tree. DENY DENY DENY.
Its no longer an issue, and I am ditching my Abit board.
A hardware solution is the only real solution, as Windows cannot tell its *SS from a hole in the ground. The scheduler blows CHUNKS. I am working on a scheduler handler, along the lines of Alan Cox's suggestions for the changes made to the early SGI Linux implementations. ( I have the Kernel book, and its a tough read, even after taking the OS design class...)
Thanks
Virus Encryption is so increadibly rare...
::)) It was kinda cute to fight it off, and see who won. ( I did eventually, Thank you HiREM.. )
Those were the ones that held your data hostage...
Well, If you didnt do backups...
Virus Encryption = HD crash. Same effect, same result.
Since the MBR code is in FDISK...Its write protected, and executable compressed. ( kinda old stuff, but hey... they are extremely unlikely to figure that one out. Much better targets for storm bots....but I did get one from an old rescued HD...