Slashdot Mirror
Researchers Report Spike In Boot Time Malware
wiredmikey writes "In their most recent intelligence report, Symantec researchers pointed out a massive increase in the amount of boot time malware striking users, noting there have already been as many new boot time malware threats detected in the first seven months of 2011 as there were in the previous three years. Also known as MBR (master boot record) threats, the malware infect an area of the hard disk that makes them one of the first things to be read and executed when a computer is turned on. This enables the threats to effectively dodge many security defenses."
Soon you'll be telling me they're back to using TSR!
Could some form of encryption based on the BIOS password be used to lock the MBR?
No actual information in the linked article. No way of verifying what they're saying is true or useful.
But don't worry. I am sure Symantec will happily sell you something that will "protect" you from this flood of MBR viruses.
It breaks my pluginses, my precious!
I'm sorry, but that is an incorrect answer. The correct answer is, "And then Obama will try to shift the blame onto Bush".
MBR malware is ooooooooooooooold. They existed back in the DOS days. (yes, that clunky old substitute of a shell pretending to be a real OS while being shamelessly marketed as Bill Gates invention despite being written in Canada by someone else).
A few years ago they were deemed to be extincted.
The fix in those days (using the shell/command line) : fdisk /mbr
Done.
Don't know for sure anymore, but it used to be that each partition on the disk had 512 bytes of meta-data associated with it. On boot slices, that 512 was the MBR. On non-boot slices that 512 held info about extended partitions and such. You could save that 512 bytes to some disk medium and write it back later. Cheaper than paying mcaffe/symantec/extorsion.
save MBR from first scsi (sata) disk
dd if=/dev/sda of=/media/usb/mbr.bin bs=512 count=1
when you need to restore:
dd if=/media/usb/mbr.bin of=/dev/sda bs=512 count=1
Join the Slashcott! Feb 10 thru Feb 17!
No worries, I've got a DOS boot floppy with F-Prot on it right here. Now I just need to find a floppy drive...
i remember in the early 90's catching a boot sector virus from a public library terminal
Of course it's Obama's fault. He's the current president and everybody always blames that guy for everything.
And this entire thread deserves to be modded offtopic.
Get a bootable windows 95 disk with fdisk on it and type fdisk /mbr. That will rewrite the boot record and make things less nasty
an increase in this type of malware in my occupation, I suppose it could be called a spike if +2 since January indicates a spike. Oh, part of my job is detecting and informing users of malware infections on a Class A network.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Got a good question..
I've noticed a lot of newer motherboards, especially "sandy bridge" generation Intel systems and later, are shipping with EFI firmware (Usually with a bios compatibility mode enabled by default, though*). If you went the EFI route and booted from a GPT partitioned disk, would you be immune to old style boot sector viruses?
I guess it would depend on how the machine's firmware handled boot.
*Actually a lot of motherboards have been EFI from since before then, but with bios compatibility mode forced on with no way to turn it off - See InsydeH20
No, that was a Chinese whore.
Who probably did it.
PCs should come with a button that says "RESCUE ME" that if pressed on power-on boots to a read-only BIOS that boots a locked-down, vendor-signed operating system that gives the user local rescue options and, if network-connected, some network-based rescue options.
On machines sold as Windows machines this would include:
* An online virus check and remediation for common viruses that prevent booting into Windows "safe mode with networking" without the infection loading. Any other viruses can be remediated by booting into that mode
* Backing up the entire drive or portions of it to DVD, USB device, or other common devices.
* Reloading an authenticated copy of the "normal" (non-rescue) BIOS from a CD, memory stick, or the hardware vendor web site.
* Re-creating the MBR to factory settings, except leaving the partition table alone
* If there is a recovery partition, validating it and rebuilding it from the web or DVDs if it is corrupted. If there is not and the disk is not full, offer to create one.
* An option to rebuild the disk from scratch using data from the Internet, DVD, or USB device.
Rescue plans for other devices like Routers or PCs that don't ship with an OS could be much simpler - their read-only rescue bios should provide a means to reset a corrupted boot configuration or replace a corrupted BIOS. Their "rescue me" button would also likely be much more obscure - probably a set of jumpers on a PC motherboard or an "insert paper clip" button on a router.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Taken directly from the article. "Ramnit spreads through removable drives and by infecting executable files such as .DLL, .EXE and .HTM extensions."
Disable autoplay and don't allow the browser to run scripts. These are two basic security measures that users should implement by default anyways. Not doing so is just asking for trouble.
Symantec keeps you safe by hogging all the CPU cycles for itself. A buddy of mine bought a new laptop to run protools software for recording and Symantec keeps the app because its using too much memory. Great job!
The problem is that these viruses affect not only the master boot, but many other stages :
the bootloader,
they run rootkits,
etc.
If you just wipe out the boot record, the further stages of the virus are still here (only these stages will be less stealthy and won't necessarily come back after deletion, as there's a previous stage missing for hiding/respwanning).
And once the whole system and the whole virus are up and running, it can probably re-write the MBR again.
What you need, after restoring the MBR, is to perform enough system repairs :
restore the boot loader, and scan the OS for infected file, only *then* you can reboot into the OS. Until that point, it's considered infected...
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
They want their boot-sector viruses back.
Welcome to the Panopticon. Used to be a prison, now it's your home.
I don't even see a situation where windows would need to modify the MBR after installation - so why do they even allow it to?
If a bios does not inherent security checking for the mbr of a drive, to see if malware or virus exists, then it is crap, and almost 99% of all bios out there do not have this.....hence...maybe if symantec gave out some free code for mbr checked to all bios writers, it would be a great day in paradise !
PARITY BOOT B
Who else?
There was the one particularly ugly virus that got into the systems of the company I provided IT services for in HS. Back then it kept getting reinstalled with boot-leg versions of DOOM and Duke Nukem 3d that the users would install and uninstall after I went home for the evening. Took me months to figure out how it kept getting back on the systems.
Win what?
You p0wn it you 0wn it.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If malware is infecting the boot sector, then wouldn't a reasonable anti-virus approach be to run the virus scanner in the BIOS?
The laptop I am typing this on has such a rootkit installed. It was the only way to defeat the crazy DRM and WGA. It is called hacktook.killwpa.2 or something of that nature.
It does nothing bad, but using an alternative bootloader is the only way to get around the piracy prevention mechanisms as Windows 7 is pretty locked down. Of course the Windows 7 kernel will not work with a regular bootloader that is unsigned. Grub gets around this by providing a pointer to the MS bootloader, but that wont defeat the anti piracy controls. I bet you places like China or angry Vista users like myself skew the results.
Windows is too expensive for 30% of all pcs from that part of the world. ... however as a precautionary tale I never do any banking or financial transactions on this laptop just to be rather safe than sorry.
http://saveie6.com/
There, the corrected headline .. why not just make the MBR read-only .. ?
That this spike in malware co-incides with Symantec's declining sales of Norton anti-virus products. Why don't they just die quietly?
Seven puppies were harmed during the making of this post.
Cuz mine doesn't.
Drives set up to use the GPT will have an effect on this type of attack. Checking the first sector on boot for corruption/changes, hopefully, will tip the owner off to intrusion.
Having to work for a living is the root of all evil.
Seriously, why is 7 x64 having a higher infection rate? Lack of experience in 64bit malware operation? Bad OS design decisions during the move to 64bit, including some backwards compatibility modes? What's so special about x64?
In Soviet Russia, master boots you!
Kind of along the same lines, one could keep a cron going to check once in a while that nothing has changed:
60 12 * * * 'dd if=/dev/sda bs=512 count=1 | md5sum | grep "fc582407067ad7c6ecc6fa25af44330d" || mail -s "MBR on desktop Compromised!" my@email.com'
That's a legitimate use for my FDD. You can have a write-protected floppy as the first boot device. The BR code of the floppy checksums the first track on the HDD and then boots of the HDD.
yep. just use Linux ..
And, many of the "boot sector based threats" are just that: rootkits based from MBR$ infestations, in combinations with drivers sometimes (as the "indestructable botnet" was done, but was FAR from indestructable) for their operations done prior to UserMode/Ring 3/RPL 3 based ops (in Ring 0/RPL 0/KernelMode).
So, in Windows, you have this method & tools to remove such things from your systems quite easily (2-4 minutes of work tops):
This set of steps, executed in THIS order from the Windows installation media & its Recovery Console can kill even the "indestructable rootkit" of a few weeks ago (in its design then), guaranteed:
---
1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver (e.g. from above -> hello_tt.sys)
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)
---
* It eve worked vs. the current design of this "blended-threat" rootkit-botnet (the allegedly "indestructable rootkit/botnet" a few weeks ago (not, it's VERY "destructable" using the method outlined above))...
IT works, that is until the maker of it starts protecting the registry areas (that the hello_tt.sys loads from, that is)...
APK
P.S.=> Just some "FYI" for you... & IF one of these "hauls in" more malware that operates in "userland" (Ring 3/RPL 3), instead of Ring 0/RPL0/kernel mode (as hello_tt.sys does to protect the bogus bootsector from the example rootkit/botnet above)?
Then, you can use ProcessExplorer.exe to first suspend the bogus processes (even if hidden under other apps because they are implemented in libs/dlls or even services too) to kill it, & it works even when AntiVirus/AntiSpyware signatures based tools fail...
... apk
I don't even remember the last time I've rebooted; I must be safe! ;)
Thank you!
APK