17 January 2008 | 9,451 views

New Rootkits Infecting the MBR

Prevent Network Security Leaks with Acunetix

Ah I remember some of the nastiest viruses back in the day attaching themselves in the MBR (Master Boot Record) rendering most anti-virus software useless (as it sits on top of the OS).

Now it seems MBR infection is back in fashion for a new age of rootkits.

Security mavens have uncovered a new class of attacks that attach malware to the bowels of a hard drive, making it extremely hard to detect and even harder to remove.

The rootkit modifies a PC’s master boot record (MBR), which is the first sector of a storage device and is used to help a PC locate an operating system to boot after it is turned on. The result: the rootkit is running even before Windows loads. There have been more than 5,000 infections in less than a month, researchers say.

“Master boot record rootkits are able to subvert the Windows kernel before it loads, which gives it a distinct stealth advantage over rootkits that load while Windows is running,” said Matthew Richard, director of the rapid response team for iDefense, a security provider owned by VeriSign. “It gives it a great stealth mechanism that allows it to persist even after removal.” Such rootkits can even survive reinstallation of the operating system, he said.

Pretty stealthy and extremely sticky, time to be a little more wary. MBR infectors are extremely nasty and the majority of people won’t even know they are. Plus as they can subvert the Windows kernel before it even loads…it has a huge stealth advantage.

The new rootkit is part of the arms race between security vendors and malware writers, he said. “We’re definitely making it harder and harder for the bad guys to do stuff to the operating system,” he said. They respond by attacking new parts of a PC.

Every version of Windows, including Vista, is vulnerable to the rootkit.

About 30,000 websites, mostly located in Europe, are actively trying to install the rootkit by exploiting users who have failed to install Windows updates, Richard says. There were 5,000 infections from December 12 to January 7. The rootkit is being spread by the same group responsible for distributing the Torpig banking Trojans, which are used to steal online banking credentials.

(Info from Securiteam)

A timeline is available from SANS here.

Source: The Register



Recent in General Hacking:
- Kali Linux – The Most Advanced Penetration Testing Linux Distribution
- Microsoft Says You SHOULD Re-use Passwords Across Sites
- Dradis v2.9 – Information Sharing For Security Assessments

Related Posts:
- Windows Rootkits
- Open Source Blamed for Rootkits?
- Sophos Offers Free Rootkit Detection Tool/Software

Most Read in General Hacking:
- 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) - 1,139,614 views
- Hack Tools/Exploits - 583,716 views
- Password Cracking with Rainbowcrack and Rainbow Tables - 415,475 views

Low-cost VPS Hosting

14 Responses to “New Rootkits Infecting the MBR”

  1. Nobody_Holme 17 January 2008 at 12:58 pm Permalink

    Are there any new vectors they’re installing it through, though?

  2. goodpeople 17 January 2008 at 1:11 pm Permalink

    Another reason why people should regularly update their virusscanners.

  3. Darknet 17 January 2008 at 1:27 pm Permalink

    Same as normal AFAIK – spread via web downloads.

  4. mumble 18 January 2008 at 9:03 am Permalink

    I must be getting old. Everything I got into trouble with back when I was a teenager is coming back to haunt me. MBR viruses…. non-blind DNS and ARP spoofing… What’s happening? Next I’ll be hearing about carding at the sprint reintroduced Pc-Pursuit.

  5. Nobody_Holme 18 January 2008 at 5:17 pm Permalink

    Good good… *feels happy and safe*

    who wants to bet i get owned in about 5 minutes now?

  6. Pantagruel 19 January 2008 at 12:37 am Permalink

    @ mumble

    Better watch out Leisure Suit Larry is also making his return ;)

    Indeed some antiviral packages are oblivious to very old attack vectors, they have become very concerned with spam/scam/phish and blocking content that they haev forgotten about old skool technique’s
    (.. stumbles through a pile of old 5 1/4″ floppies looking for an MBR infecting proogy from the darkages, darn, the C2D is too fast to do old style DOS progs (or cmd is too limited)

  7. mumble 19 January 2008 at 3:14 am Permalink

    Does anyone else remember the ping-pong virus?

    The scary thing is that I might still have a copy bouncing around. That beast was written in simon-pure assembly, and the size was measured in bytes….

  8. Nobody_Holme 19 January 2008 at 1:19 pm Permalink

    Anything oldskool DOS needs some re-writing to make it work these days…
    Ping-pong virus…. The memories!

  9. goodpeople 20 January 2008 at 12:51 pm Permalink

    My best memories lie with the cookiemonster virus…

    .. can I have a cookie?

  10. mumble 20 January 2008 at 8:40 pm Permalink

    @goodpeople – “A Cookie”

    I find it fascinating that a number of older people – among them security researchers and pentesters, all remember this stuff with glee from back when they were behaving like juvenile delinquents. Plus la change, plus la meme chose… (Yes, I mangled that, but I don’t have bindings for French characters on my keyboard….Unicode doesn’t fix the “where’s the any key!?!?” problem.)

  11. eM3rC 7 February 2008 at 5:42 am Permalink

    Props to the ping pong virus!

    I never though MBR viruses would ever make a comeback. Now the black hats reverted to old tactics, it seems AV will be forced to keep up and catch them before they get installed. Another way around this (aside from programs that stop the modification of vital system files) is a program that is called something like shadow drive. This program basically makes an image of your hard drive(s) and all changes made are not actually stored on the hard drive itself but the image. I have not used the program myself but at some point you are allowed to write the files to the hard drive allowing the computer to be both safe and usable.

  12. J. Lion 11 February 2008 at 11:24 pm Permalink

    scary…

    I wonder if my MBR is infected…

  13. eM3rC 12 February 2008 at 1:59 am Permalink

    @J. Lion

    If it was I think you would know already ;)