New Rootkits Infecting the MBR

Ah I remember some of the nastiest viruses back in the day attaching themselves in the MBR (Master Boot Record) rendering most anti-virus software useless (as it sits on top of the OS).

Now it seems MBR infection is back in fashion for a new age of rootkits.

Security mavens have uncovered a new class of attacks that attach malware to the bowels of a hard drive, making it extremely hard to detect and even harder to remove.

The rootkit modifies a PC’s master boot record (MBR), which is the first sector of a storage device and is used to help a PC locate an operating system to boot after it is turned on. The result: the rootkit is running even before Windows loads. There have been more than 5,000 infections in less than a month, researchers say.

“Master boot record rootkits are able to subvert the Windows kernel before it loads, which gives it a distinct stealth advantage over rootkits that load while Windows is running,” said Matthew Richard, director of the rapid response team for iDefense, a security provider owned by VeriSign. “It gives it a great stealth mechanism that allows it to persist even after removal.” Such rootkits can even survive reinstallation of the operating system, he said.

Pretty stealthy and extremely sticky, time to be a little more wary. MBR infectors are extremely nasty and the majority of people won’t even know they are. Plus as they can subvert the Windows kernel before it even loads…it has a huge stealth advantage.

The new rootkit is part of the arms race between security vendors and malware writers, he said. “We’re definitely making it harder and harder for the bad guys to do stuff to the operating system,” he said. They respond by attacking new parts of a PC.

Every version of Windows, including Vista, is vulnerable to the rootkit.

About 30,000 websites, mostly located in Europe, are actively trying to install the rootkit by exploiting users who have failed to install Windows updates, Richard says. There were 5,000 infections from December 12 to January 7. The rootkit is being spread by the same group responsible for distributing the Torpig banking Trojans, which are used to steal online banking credentials.

(Info from Securiteam)

A timeline is available from SANS here.

Source: The Register

Posted in: Hacking News, Malware

, , ,

Latest Posts:

Socialscan - Command-Line Tool To Check For Email And Social Media Username Usage Socialscan – Command-Line Tool To Check For Email And Social Media Username Usage
socialscan is an accurate command-line tool to check For email and social media username usage on online platforms, given an email address or username,
CFRipper - CloudFormation Security Scanning & Audit Tool CFRipper – CloudFormation Security Scanning & Audit Tool
CFRipper is a Python-based Library and CLI security analyzer that functions as an AWS CloudFormation security scanning and audit tool
CredNinja - Test Credential Validity of Dumped Credentials or Hashes CredNinja – Test Credential Validity of Dumped Credentials or Hashes
CredNinja is a tool to quickly test credential validity of dumped credentials (or hashes) across an entire network or domain very efficiently.
assetfinder - Find Related Domains and Subdomains assetfinder – Find Related Domains and Subdomains
assetfinder is a Go-based tool to find related domains and subdomains that are related to a given domain from a variety of sources including Facebook and more.
Karkinos - Beginner Friendly Penetration Testing Tool Karkinos – Beginner Friendly Penetration Testing Tool
Karkinos is a light-weight Beginner Friendly Penetration Testing Tool, which is basically a 'Swiss Army Knife' for pen-testing and/or hacking CTF's.
Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.

13 Responses to New Rootkits Infecting the MBR

  1. Nobody_Holme January 17, 2008 at 12:58 pm #

    Are there any new vectors they’re installing it through, though?

  2. goodpeople January 17, 2008 at 1:11 pm #

    Another reason why people should regularly update their virusscanners.

  3. Darknet January 17, 2008 at 1:27 pm #

    Same as normal AFAIK – spread via web downloads.

  4. mumble January 18, 2008 at 9:03 am #

    I must be getting old. Everything I got into trouble with back when I was a teenager is coming back to haunt me. MBR viruses…. non-blind DNS and ARP spoofing… What’s happening? Next I’ll be hearing about carding at the sprint reintroduced Pc-Pursuit.

  5. Nobody_Holme January 18, 2008 at 5:17 pm #

    Good good… *feels happy and safe*

    who wants to bet i get owned in about 5 minutes now?

  6. Pantagruel January 19, 2008 at 12:37 am #

    @ mumble

    Better watch out Leisure Suit Larry is also making his return ;)

    Indeed some antiviral packages are oblivious to very old attack vectors, they have become very concerned with spam/scam/phish and blocking content that they haev forgotten about old skool technique’s
    (.. stumbles through a pile of old 5 1/4″ floppies looking for an MBR infecting proogy from the darkages, darn, the C2D is too fast to do old style DOS progs (or cmd is too limited)

  7. mumble January 19, 2008 at 3:14 am #

    Does anyone else remember the ping-pong virus?

    The scary thing is that I might still have a copy bouncing around. That beast was written in simon-pure assembly, and the size was measured in bytes….

  8. Nobody_Holme January 19, 2008 at 1:19 pm #

    Anything oldskool DOS needs some re-writing to make it work these days…
    Ping-pong virus…. The memories!

  9. goodpeople January 20, 2008 at 12:51 pm #

    My best memories lie with the cookiemonster virus…

    .. can I have a cookie?

  10. mumble January 20, 2008 at 8:40 pm #

    @goodpeople – “A Cookie”

    I find it fascinating that a number of older people – among them security researchers and pentesters, all remember this stuff with glee from back when they were behaving like juvenile delinquents. Plus la change, plus la meme chose… (Yes, I mangled that, but I don’t have bindings for French characters on my keyboard….Unicode doesn’t fix the “where’s the any key!?!?” problem.)

  11. eM3rC February 7, 2008 at 5:42 am #

    Props to the ping pong virus!

    I never though MBR viruses would ever make a comeback. Now the black hats reverted to old tactics, it seems AV will be forced to keep up and catch them before they get installed. Another way around this (aside from programs that stop the modification of vital system files) is a program that is called something like shadow drive. This program basically makes an image of your hard drive(s) and all changes made are not actually stored on the hard drive itself but the image. I have not used the program myself but at some point you are allowed to write the files to the hard drive allowing the computer to be both safe and usable.

  12. J. Lion February 11, 2008 at 11:24 pm #


    I wonder if my MBR is infected…

  13. eM3rC February 12, 2008 at 1:59 am #

    @J. Lion

    If it was I think you would know already ;)