Slashdot Mirror
Self-Destructing Virus Kills Off PCs
mpicpp sends word about particularly bad virus making the rounds, with this snippet from the BBC: "A computer virus that tries to avoid detection by making the machine it infects unusable has been found. If Rombertik's evasion techniques are triggered, it deletes key files on a computer, making it constantly restart. Analysts said Rombertik was 'unique' among malware samples for resisting capture so aggressively. On Windows machines where it goes unnoticed, the malware steals login data and other confidential information. Rombertik typically infected a vulnerable machine after a booby-trapped attachment on a phishing message had been opened, security researchers Ben Baker and Alex Chiu, from Cisco, said in a blogpost. Some of the messages Rombertik travels with pose as business inquiry letters from Microsoft. The malware 'indiscriminately' stole data entered by victims on any website, the researchers said. And it got even nastier when it spotted someone was trying to understand how it worked. 'Rombertik is unique in that it actively attempts to destroy the computer if it detects certain attributes associated with malware analysis,' the researchers said."
This was an obvious evolutionary next step
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
No, it just means that Windows can't boot. Mount it on another machine and all the data is still there, ready to be analysed
Of all the destructive things one could do, it rewrites the MBR? That's it? That's fairly easy to fix, and your data is still easily intact by copying it with a second machine.
To be honest, a much more dangerous one would be one that sits dormant for, oh, say six months or so. In doing that, it gets itself into all of your backups (if you have any), and now you're going to have trouble separating your data from the virus. If it then activates a random amount of days (1-14) after being restored, it's not obvious which backups are infected and which ones aren't.
Of course, this is all purely theoretical, and I highly discourage anyone from actually implementing this - it's just an idea...
"Set a man a fire, he'll be warm for the rest of the night. Set a man afire, he'll be warm for the rest of his life."
Sure, but by which point you're doing much more involved forensics and hunting this down.
In many companies, a misbehaving computer is just re-imaged.
We used to have a receptionist who put so much crap on her PC that every couple of months when she decided she'd broken it enough, they'd just re-image it.
Why nobody ever told her to stop putting that crap on in the first place I'll never understand.
In that kind of scenario, nobody would even know she had any specific malware or what it did.
Lost at C:>. Found at C.
It sounds like the receptionist is the malicious part of this scenario.
Sounds to me just like the viruses of the 80's and 90's, pre-internet days. Back then, it wasn't about stealing passwords or holding data for ransom. It was about causing mayhem, and wiping a computer some time after infection, or otherwise damaging the computer's ability to operate normally was the norm (until Windows 95 came along and called it a feature).
It's not just a virus. It's a retrovirus.
*ducks*
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
It's curious why the virus would clear the MBR - if you have a large drive (> 2TB) or Windows 8, your hard drive uses GPT and not MBR. Sure a GPT disk has an MBR (called a "protective MBR") that basically blocks out the GPT partitions, but that's to prevent existing partitioning tools from screwing up the GPT partitions as they'll see a fully partitioned disk.
If you have GPT, an MBR wipe out means absolutely squat - your partitioner might complain that the protective MBR is missing, but that's trivial to recreate since it basically covers the entire disk (or the first 2TB, the maximum MBR can cover).
Yeah, he was.
Yup, my Amiga days were the first thing to come to mind.
Upon reading the headline, my first thought was that the virus was wiping out the firmware, which really kills most devices as hardly anything has a ROM backup. Overwriting system files? Yawn.
A computer is not "destroyed" if you have to repair the MBR or reinstall Windows. It may be a pain to do, but the computer itself is fine.
This sounds like some high school student prank.
Speaking of high-school pranks. One funny MBR-related thing we did back in the day was creating a loop in the chain of logical partitions (the MBR can only define 4 primary partitions. If you want more than 4 partitions, you created an extended partition which contains a linked list of logical partitions. And we made this linked list loop back to its beginning).
Windows (or DOS) versions back in the day were so buggy that they didn't notice the loop, and kept scanning, and scanning, and scanning until they reached the end of the list (which happened never, because it was a loop).
Result: unbootable machine. Even from a floppy. Because the DOS on the floppy was also doing the inventory of all storage media attached to the machine and stumbled upon the same partition loop. And if you removed the (internal) hard disk, well, then you couldn't obviously reinstall Windows on it.
The only fix was to boot Linux from a floppy, and remove the loop from there. However, back in the day Linux was still obscure enough that the "powers that be" didn't know about this fix...
From the Cisco link, it does wipe the partition table. In this case, MBR doesn't mean just initial boot code, but the whole boot sector of the system, which contains the partition table as well. (Probably one of those legacy PC things we're still living with... most other sane systems generally move the boot code or the partition table elsewhere.).
Basically it rewrites sector 0.
Which on a modern Windows system, does squat since we're using EFI boot which no longer does the sector chainboot the old BIOS does. Plus, modern systems don't use MBR partitioning, they use GPT, which while having an MBR, the MBR is marked as protective so MBR aware tools won't try to inadvertently create a MBR partition table over the GPT one.
GPT tools can reasily rebuild the protective MBR without even reading the GPT since the protective MBR partition is fixed type, and spans the whole disk (or first 2TB, maxing out MBR).
This malware is very hard to detect under normal conditions. But it is outfitted with counter measures. When it detects activities that are consistent with malware detection, study and or/and removal it responds in many destructive ways. It makes it difficult for a white hat to suss it. But, no, it does not give itself away by cutting up rough. It only starts the visible signs of infection when it deems the jig is up anyway.
There is a very good (and somewhat scary) article from The Register. on Rombertik.
This is as nasty a piece of work as you will ever not wish to see anywhere near your equipment.
"No fear. No envy. No meanness." Liam Clancy