18 August 2009 | 22,901 views

Stoned Bootkit – Windows XP, 2003, Vista, 7 MBR Rootkit

Check For Vulnerabilities with Acunetix

What is Stoned Bootkit?

A bootkit is a boot virus that is able to hook and patch Windows to get load into the Windows kernel, and thus getting unrestricted access to the entire computer. It is even able to bypass full volume encryption, because the master boot record (where Stoned is stored) is not encrypted. The master boot record contains the decryption software which asks for a password and decrypts the drive. This is the weak point, the master boot record, which will be used to pwn your whole system. No one’s secure!

For whom is Stoned Bootkit interesting?

  1. Black Hats
  2. Law enforcement agencies
  3. Microsoft

Why is Stoned something new? Because it is the firts bootkit that..

  • attacks Windows XP, Sever 2003, Windows Vista, Windows 7 with one single master boot record
  • attacks TrueCrypt full volume encryption
  • has integrated FAT and NTFS drivers
  • has an integrated structure for plugins and boot applications (for future development)

A bootkit is a rootkit that is able to load from a master boot record and persist in memory all the way through the transition to protected mode and the startup of the OS. It’s a very interesting type of rootkit.” – Robert Hensing about bootkits

You can download Stoned Bootkit here:

Open Source Framework – Stoned Bootkit Framework.zip
Infector file – Infector.exe

Or you can read more here.



Recent in General Hacking:
- Dradis v2.9 – Information Sharing For Security Assessments
- MagicTree v1.3 Available For Download – Pentesting Productivity
- Kvasir – Penetration Testing Data Management Tool

Related Posts:
- Sophos Offers Free Rootkit Detection Tool/Software
- AV Firms Say Windows Vista Security Claims are Bullsh*t
- Kon-Boot – Reset Windows & Linux Passwords

Most Read in General Hacking:
- 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) - 1,137,500 views
- Hack Tools/Exploits - 581,390 views
- Password Cracking with Rainbowcrack and Rainbow Tables - 414,266 views

Advertise on Darknet

13 Responses to “Stoned Bootkit – Windows XP, 2003, Vista, 7 MBR Rootkit”

  1. d3m4s1@d0v1v0 18 August 2009 at 12:27 pm Permalink

    very, very, VERY interesting, thanks for sharing =)

  2. SherifEldeeb 18 August 2009 at 6:40 pm Permalink

    Well, I’ve read this article and the links, and it scared the f…, hell out of me.
    The only detection method will be by booting with a live CD and check the MBR I guess.
    May God save us, and the ones we care about from threats like this…

  3. Only2perCent 18 August 2009 at 10:56 pm Permalink

    Only, when I erased my hard drive were I able to beat this thing!

    Stay away from Microsoft products!

    Linux Mint is a very elegant alternative.

  4. Morgan Storey 19 August 2009 at 12:00 am Permalink

    @Only2perCent : while I do agree about Linux being better, I can assure you that a Linux bootkit would be easier to write than Stoned, it could simply plugin to Lilo/Grub. All os’es are unsecure the only secure ones are ones that aren’t used, and aren’t connected.

  5. Only2perCent 19 August 2009 at 7:31 am Permalink

    @Morgan Storey: In the future we will get use to a life in a hostile environment. As a bacteriologist once said, “Our bodies are only 10% human, – the rest is bacteria.”
    My idea of an OS is a live CD with a persistent home directory and constantly changing MAC address.

  6. d 19 August 2009 at 1:40 pm Permalink

    @SherifEldeeb @Only2perCent: Disable all “boot from” in BIOS except the hard drive.

  7. Morgan Storey 19 August 2009 at 2:25 pm Permalink

    @Only2perCent: Problem with that is how do you add new programs, live ones that run from a usb drive/the home drive. Then the malware just infects there, the programs installed will still have vulnerabilities and be updated slower due to having to burn the updates/new programs. You could do your plan now, but next to no computer does as it isn’t usable. I have seen a few kiosks that use it. MS has steady state for windows that allows you to roll back on boot, that could fix some stuff. But what about a bios virus.
    I agree we will need to get used to living in a hostile environment, I think we already do, put an unpatched windows box on the net not behind a router and it takes what 1minute to get owned.

    @d: Won’t work, as the bootkit installs to your hard disk. If you are talking about stopping a bootdisk/usb it is trivial to do a bios reset to bypass this. Pop the bios battery, flip the dip switch or bridge the reset pins.

  8. d 19 August 2009 at 2:48 pm Permalink

    @Morgan Storey: For high value systems, resets can be mitigated by controls, while not inconveniencing the user. Tamper evident seals and visual checks.

    Granted: laptops, laxed corporate security, and home users are vulnerable.

  9. Only2perCent 20 August 2009 at 1:06 am Permalink

    @Morgan Storey: In my model, a user adds software to the system by upgrading the Live CD. One can assemble a Live CD to one’s liking by adding modules, as it is done at:

    http://www.slax.org/modules.php

  10. Morgan Storey 20 August 2009 at 1:55 am Permalink

    @d: yeah but high value systems are not the target anymore it is easier and more profitable to go after the end users machine and grab all their traffic. Regardless a bootkit installs within the os and doesn’t need a usb/cd to install at boot, it simply changes the boot record/boot loader. So if you get remote access and need to keep it, you bootkit it, and get the bootkit to re-initate your session.

    @Only2perCent: Yeah I understand your model, but the issue still remains you have to store your data somewhere, and that is a place that can be compromised. The other issue of creating a new Live CD whenever a patch is released, or a new app you want to try would become tedious, and with the laxness that even simple patching is done, I doubt most users would bother, that is why the livecd as a full time os is very rarely used.

  11. Only2perCent 20 August 2009 at 2:34 am Permalink

    @ Morgan Storey: It is already too dark, and too late. When every computer in the World is under alphabet attack, it is no longer a matter of convenience, It is the only viable solution to be able to speak.

  12. Halojoe 21 August 2009 at 7:47 pm Permalink

    My BIOS prevents this change. It’s doesn’t seem as scary as it should. I’m going to try it out on a HP laptop.

  13. Rishabh Dangwal 5 September 2009 at 7:03 pm Permalink

    gr8 article..the guys at redmond would now be a bit busy and running scared :P