Slashdot Mirror
Researchers Report Spike In Boot Time Malware
wiredmikey writes "In their most recent intelligence report, Symantec researchers pointed out a massive increase in the amount of boot time malware striking users, noting there have already been as many new boot time malware threats detected in the first seven months of 2011 as there were in the previous three years. Also known as MBR (master boot record) threats, the malware infect an area of the hard disk that makes them one of the first things to be read and executed when a computer is turned on. This enables the threats to effectively dodge many security defenses."
Could some form of encryption based on the BIOS password be used to lock the MBR?
No actual information in the linked article. No way of verifying what they're saying is true or useful.
But don't worry. I am sure Symantec will happily sell you something that will "protect" you from this flood of MBR viruses.
It breaks my pluginses, my precious!
Don't know for sure anymore, but it used to be that each partition on the disk had 512 bytes of meta-data associated with it. On boot slices, that 512 was the MBR. On non-boot slices that 512 held info about extended partitions and such. You could save that 512 bytes to some disk medium and write it back later. Cheaper than paying mcaffe/symantec/extorsion.
save MBR from first scsi (sata) disk
dd if=/dev/sda of=/media/usb/mbr.bin bs=512 count=1
when you need to restore:
dd if=/media/usb/mbr.bin of=/dev/sda bs=512 count=1
Join the Slashcott! Feb 10 thru Feb 17!
Get a bootable windows 95 disk with fdisk on it and type fdisk /mbr. That will rewrite the boot record and make things less nasty
I didn't know Seattle was in Canada.
an increase in this type of malware in my occupation, I suppose it could be called a spike if +2 since January indicates a spike. Oh, part of my job is detecting and informing users of malware infections on a Class A network.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Who probably did it.
PCs should come with a button that says "RESCUE ME" that if pressed on power-on boots to a read-only BIOS that boots a locked-down, vendor-signed operating system that gives the user local rescue options and, if network-connected, some network-based rescue options.
On machines sold as Windows machines this would include:
* An online virus check and remediation for common viruses that prevent booting into Windows "safe mode with networking" without the infection loading. Any other viruses can be remediated by booting into that mode
* Backing up the entire drive or portions of it to DVD, USB device, or other common devices.
* Reloading an authenticated copy of the "normal" (non-rescue) BIOS from a CD, memory stick, or the hardware vendor web site.
* Re-creating the MBR to factory settings, except leaving the partition table alone
* If there is a recovery partition, validating it and rebuilding it from the web or DVDs if it is corrupted. If there is not and the disk is not full, offer to create one.
* An option to rebuild the disk from scratch using data from the Internet, DVD, or USB device.
Rescue plans for other devices like Routers or PCs that don't ship with an OS could be much simpler - their read-only rescue bios should provide a means to reset a corrupted boot configuration or replace a corrupted BIOS. Their "rescue me" button would also likely be much more obscure - probably a set of jumpers on a PC motherboard or an "insert paper clip" button on a router.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Taken directly from the article. "Ramnit spreads through removable drives and by infecting executable files such as .DLL, .EXE and .HTM extensions."
Disable autoplay and don't allow the browser to run scripts. These are two basic security measures that users should implement by default anyways. Not doing so is just asking for trouble.
The problem is that these viruses affect not only the master boot, but many other stages :
the bootloader,
they run rootkits,
etc.
If you just wipe out the boot record, the further stages of the virus are still here (only these stages will be less stealthy and won't necessarily come back after deletion, as there's a previous stage missing for hiding/respwanning).
And once the whole system and the whole virus are up and running, it can probably re-write the MBR again.
What you need, after restoring the MBR, is to perform enough system repairs :
restore the boot loader, and scan the OS for infected file, only *then* you can reboot into the OS. Until that point, it's considered infected...
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"No worries, I've got a DOS boot floppy with F-Prot on it right here. Now I just need to find a floppy drive..."
No, just use Winimage to make a .IMA file then use that file to burn a floppy-emulation CD/DVD. Throw some utils in the root directory while you are at it.
This is the shit if you want a very well thought out live CD toolkit containing PE/Linux/DOS:
http://falconfour.wordpress.com/2011/03/12/falconfours-ultimate-boot-cdusb-4-5/
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
I should have added "download a boot floppy image" and convert it to a .IMA file. I use Win98SE images but you can Google plenty of choices.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Judging by the number of BC license plates, yes we are.
Have gnu, will travel.
They want their boot-sector viruses back.
Welcome to the Panopticon. Used to be a prison, now it's your home.
I don't even see a situation where windows would need to modify the MBR after installation - so why do they even allow it to?
If a bios does not inherent security checking for the mbr of a drive, to see if malware or virus exists, then it is crap, and almost 99% of all bios out there do not have this.....hence...maybe if symantec gave out some free code for mbr checked to all bios writers, it would be a great day in paradise !
Who else?
There was the one particularly ugly virus that got into the systems of the company I provided IT services for in HS. Back then it kept getting reinstalled with boot-leg versions of DOOM and Duke Nukem 3d that the users would install and uninstall after I went home for the evening. Took me months to figure out how it kept getting back on the systems.
Win what?
You p0wn it you 0wn it.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Yall are doing it the hard way.
Grab ubuntu CD. Boot to live mode. Install "ms-sys". Issue command "ms-sys -m /dev/sda", or whatever the proper switch is for your edition of windows. Browse /dev/sda1, removing all executables from %appdata% and any suspicious drivers. Reboot, and perform a cleanup from safe mode.
No need for specialized disks, and if you really cant stand having to download ms-sys every time you can just re-roll your own custom ubuntu (or mint, or whatever) based distro.
The laptop I am typing this on has such a rootkit installed. It was the only way to defeat the crazy DRM and WGA. It is called hacktook.killwpa.2 or something of that nature.
It does nothing bad, but using an alternative bootloader is the only way to get around the piracy prevention mechanisms as Windows 7 is pretty locked down. Of course the Windows 7 kernel will not work with a regular bootloader that is unsigned. Grub gets around this by providing a pointer to the MS bootloader, but that wont defeat the anti piracy controls. I bet you places like China or angry Vista users like myself skew the results.
Windows is too expensive for 30% of all pcs from that part of the world. ... however as a precautionary tale I never do any banking or financial transactions on this laptop just to be rather safe than sorry.
http://saveie6.com/
There, the corrected headline .. why not just make the MBR read-only .. ?
That this spike in malware co-incides with Symantec's declining sales of Norton anti-virus products. Why don't they just die quietly?
Seven puppies were harmed during the making of this post.
No. By your own premise, virus scanners don't work... clearly, the exploit blew right through and overwrote the boot sector.
A technicality for certain, but "run in the bios" is a nonsense phrase. You most likely mean "as part of the POST"?
help me i've cloned myself and can't remember which one I am
Cuz mine doesn't.
Drives set up to use the GPT will have an effect on this type of attack. Checking the first sector on boot for corruption/changes, hopefully, will tip the owner off to intrusion.
Having to work for a living is the root of all evil.
I don't even remember the last time I've rebooted; I must be safe! ;)
This is correct. Mod parent up!!