Boot Sector Viruses & Rootkits Poised For Comeback

Ant writes "Ars Technica says Panda Labs' first quarter 2008 malware report raises a new concern, though it comes from a surprising direction. According to the company, boot sector viruses loaded with rootkits are poised to make a comeback. This honestly sounds a bit odd, considering how long it has been since a boot virus has topped the malware charts, but it's at least theoretically possible (pdf). Such viruses have a simple method of operation. The virus copies itself into the Master Boot Record (MBR) of a hard drive, and rewrites the actual MBR data in a different section of the drive. The report also covers a number of other topics and makes predictions about the types of attacks computer users may see in the future. Forecasting these trends is always tricky."

Comments

With or Without TPM?

[sainttX]

If we have hardware security support, this is not that easy..

Let me guess

[WindBourne]

Panda labs has a new product that protects just this? Call me a cynic, but ....

Re:Let me guess

[Lumpy]

That's ok ASUS has had that protection for decades.

MBR protection has been in every bios on ASUS motherboards for at least 12 years now. turn it on and NOTHING can write to the mbr.

gotta love how old tech solves the "new hotness".

Re:Let me guess

[Anonymous Coward]

Not quite. It protects the bios from hard disk writes using int 13h. It won't protect from programs accessing the hard drive directly using I/O ports, which any modern MBR virus is likely to do.

I can see it now

[oni]

GNU GRUB version 0.95 (638 lower / 288704K upper memory)

Ubuntu, kernel 2.6.12-9-386
Ubuntu, kernel 2.6.12-9-386 (recovery mode)
Ubuntu, memtest86+
Other operating systems:
Windows NT/2000/XP
omfgh4xorz-r00tk1tz3113

Use the up and down keys to select which entry is highlighted.
Press enter to boot the selected OS, 'e' to edit the commands
before booting, or 'c' for a command-line

hmm, something's not right here

Re:I can see it now

[ettlz]

hmm, something's not right here

Yep. The latest grub is 0.97.

Or are you talking about the space-munching change of layout?

Re:I can see it now

[maxch]

call me crazy, but that Windows entry seems suspicious.

The old ways still work

[ais523]

I still check to make sure that there aren't any floppy disks left in the drives before I power-on (and I still have floppy drives, even an external one for the laptop); it seems now the old habits may have a reason. Of course, nowadays malware doesn't have to rely on floppy disks accidentally left in drives and sharing of executables from one computer to another because the Internet exists; but that doesn't stop the old threats working, just provides a more modern alternative that gets more attention.

Re:The old ways still work

[Anonymous Coward]

Or just disable floppy, cdrom and usb from the boot order in your bios

Cool

[dedazo]

The last time any of my machines had anything resembling a virus, malware or trojans it came in a floppy boot sector and it was called "Natas" or something like that.

Bill Clinton was president, the Nasdaq was at 5,000 or something like that and I was smoking pot. Maybe we'll go back to the old days in more ways than one!

Bah!

[Well-Fed Troll]

I spit on thee, thou foul virus writing knaves.
Wilt it doth survive the lowly Format?
Truly I say unto thee, Real Men write CMOS infecting viruses.

Re:Bah!

[MadnessASAP]

Speaking of which, I remember seeing a rather nifty POC for storing a rootkit in a video cards BIOS. I don't think anybody has taken advantage of it yet though.

Watch out for what you buy

[Digi-John]

A danger to be alert to is the possibility of viruses and rootkits that ship with the computer. Consider that most computers have a lot of parts made in China; suppose the Chinese government decides it's going to slip something into your BIOS? That is a major issue for national security, and it's not just speculation; I've seen test viruses that sit in the BIOS and do a SUID root on a specific file in /tmp on every bootup. EFI is just as vulnerable, because it's basically a complete Unix-like OS just for booting.

Why?

[Rurik]

I wonder why a virus writer would even want to do this? Nearly all have learned that instead of wreaking havoc for fun, they can wreak havoc and make money off it. There's a reason most writers stopped writing boot sector viruses. Viruses are more fun when they can perform click-fraud, and other long-term money making actions, instead of destroying a user's computer.

Re:Why?

[eldavojohn]

I don't think this article was talking about viruses that merely hose your hard drive. Granted, that's what most of those did, I think they are dreaming up something that writes your MBR to another piece of the hard drive and gains root access right when you start your computer. If virus writers are sophisticated enough, maybe the write something like an extended firmware interface that loads your operating system normally and you don't even know about it running in the background. Again, that's a high level of sophistication but I was blown away by what the virtual machines have been able to do.

There's also evidence that I am skeptical of like:

The problem with boot viruses is that their attack vector is fairly well-guarded. Any antivirus program worth beans will detect a suspicious attempt to modify the MBR and will alert the end user accordingly. Running as a user rather than an administrator should also prevent such modification even if you don't have an antivirus scanner installed. Panda implies that this kind of exploit could be an issue in Linux, and I suppose that's theoretically possible, but Linux always creates a user account without root access by default. If Panda's report really did imply that, they just lost a whole shitload of credibility in my book. I'm not stupid enough to think that Linux is impenetrable but I know that the Unix-like security scheme with users in userland and superusers in kerneland is always observed.

Re:Why?

[sjames]

Consider the MBR just one of several potential hooks into the system. It need not destroy the machine at all. It could (for example) install itself as ring 0, load the OS below itself and then the fun begins.

Consider the havoc it could create if it can manage to get itself into the SMI handler by playing dirty tricks with the RAM controler that are only possible before the OS switches to protected mode.

Re:Why?

[darkmeridian]

I think the plan is to have a MBR virus plant a rootkit that pwns the OS and zombies the system without anyone realizing what's going on.

Virtualization complications

[wheatking]

so what happens w/ all this virtualization (VMware, Xen, Microsoft/Kidaro, RingCube, Moka5,...) coming in... aren't bare metal vulnerabilities @ the hypervisor layer a bigger deal?

Even worse threats on the horizon...

[jdb2]

For a rootkit, the lower the level it can modify the system at, the better. We've seen this progression, from user-mode,to kernel mode hooks,to kernel mode data structures etc. So, obviously the rootkit authors know that their current methods will be obsolete in the near future, and have "lowered the bar" (pun intended ;) to the MBR. (Heh, that also rhymes ;) Anyway, if you think this is the last safe haven for rootkits, you're wrong -- really wrong. How about a rootkit that splits itself into tiny chunks, compresses them, and then inserts them into the free space available on the various BIOS's in your system eg. Video, Hard Drive, RAID Controller etc.? Impossible you say, well, I advise you to watch this presentation :

http://youtube.com/watch?v=G26oZtzluAQ&fmt=6

Systems with the ability to boot from a storage device other than a hard drive, say, a USB drive, are especially vulnerable, as the rootkit doesn't have to gain access to the BIOSs via the OS. Instead, it modifies the boot sector of the USB drive and then, upon bootup, after the BIOS boots off the USB drive, hides itself via the previously mentioned technique, so as to ensure it will run even if the boot sector of the USB drive is modified. This is possible as, upon bootup, the BIOS scans for memory mapped expansion ROMs (the previously mentioned BIOS's spread throughout your system) and then transfers control to each one.

Something to think about.

jdb2

Windows Malicious Software Removal Tool

[mrbluze]

Windows is a program which inserts code into the master boot record, often before the user has broken open the packaging of their new computer, resulting in loading of malicious code at power-on which causes the computer to phone-home and results in the gradual loss of available disk space on the affected drive. Multiple other vulnerabilities have also been reported.

Various removal tools are available free of charge. This is considered a critical and urgent update.

great idea

[ILuvRamen]

And you know what really helps is writing detailed how-to theory articles, saying it's inevitable, and repeating how effective it could be. That will ensure that all these gloom and doom virus articles come true! That must be what all these authors want or something or they'd all shut up.