New Rootkits Infecting the MBR

The New Acunetix V12 Engine

Ah I remember some of the nastiest viruses back in the day attaching themselves in the MBR (Master Boot Record) rendering most anti-virus software useless (as it sits on top of the OS).

Now it seems MBR infection is back in fashion for a new age of rootkits.

Security mavens have uncovered a new class of attacks that attach malware to the bowels of a hard drive, making it extremely hard to detect and even harder to remove.

The rootkit modifies a PC’s master boot record (MBR), which is the first sector of a storage device and is used to help a PC locate an operating system to boot after it is turned on. The result: the rootkit is running even before Windows loads. There have been more than 5,000 infections in less than a month, researchers say.

“Master boot record rootkits are able to subvert the Windows kernel before it loads, which gives it a distinct stealth advantage over rootkits that load while Windows is running,” said Matthew Richard, director of the rapid response team for iDefense, a security provider owned by VeriSign. “It gives it a great stealth mechanism that allows it to persist even after removal.” Such rootkits can even survive reinstallation of the operating system, he said.

Pretty stealthy and extremely sticky, time to be a little more wary. MBR infectors are extremely nasty and the majority of people won’t even know they are. Plus as they can subvert the Windows kernel before it even loads…it has a huge stealth advantage.

The new rootkit is part of the arms race between security vendors and malware writers, he said. “We’re definitely making it harder and harder for the bad guys to do stuff to the operating system,” he said. They respond by attacking new parts of a PC.

Every version of Windows, including Vista, is vulnerable to the rootkit.

About 30,000 websites, mostly located in Europe, are actively trying to install the rootkit by exploiting users who have failed to install Windows updates, Richard says. There were 5,000 infections from December 12 to January 7. The rootkit is being spread by the same group responsible for distributing the Torpig banking Trojans, which are used to steal online banking credentials.

(Info from Securiteam)

A timeline is available from SANS here.

Source: The Register

Posted in: Hacking News, Malware

, , ,

Latest Posts:

How To Recover When Your Website Got Hacked How To Recover When Your Website Got Hacked
The array of easily available Hacking Tools out there now is astounding, combined with self-propagating malware, people often come to me when their website got hacked and they don't know what to do, or even where to start.
HTTrack - Website Downloader Copier & Site Ripper Download HTTrack – Website Downloader Copier & Site Ripper Download
HTTrack is a free and easy-to-use offline browser utility which acts as a website downloader and a site ripper for copying websites and downloading them for offline viewing.
sshLooter - Script To Steal SSH Passwords sshLooter – Script To Steal SSH Passwords
sshLooter is a Python script using a PAM module to steal SSH passwords by logging the password and notifying the admin of the script via Telegram when a user logs in.
Intercepter-NG - Android App For Hacking Intercepter-NG – Android App For Hacking
Intercepter-NG is a multi functional network toolkit including an Android app for hacking, the main purpose is to recover interesting data from the network stream and perform different kinds of MiTM attacks.
dcipher - Online Hash Cracking Using Rainbow & Lookup Tables dcipher – Online Hash Cracking Using Rainbow & Lookup Tables
dcipher is a JavaScript-based online hash cracking tool to decipher hashes using online rainbow & lookup table attack services.
HTTP Security Considerations - An Introduction To HTTP Basics HTTP Security Considerations – An Introduction To HTTP Basics
HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.

13 Responses to New Rootkits Infecting the MBR

  1. Nobody_Holme January 17, 2008 at 12:58 pm #

    Are there any new vectors they’re installing it through, though?

  2. goodpeople January 17, 2008 at 1:11 pm #

    Another reason why people should regularly update their virusscanners.

  3. Darknet January 17, 2008 at 1:27 pm #

    Same as normal AFAIK – spread via web downloads.

  4. mumble January 18, 2008 at 9:03 am #

    I must be getting old. Everything I got into trouble with back when I was a teenager is coming back to haunt me. MBR viruses…. non-blind DNS and ARP spoofing… What’s happening? Next I’ll be hearing about carding at the sprint reintroduced Pc-Pursuit.

  5. Nobody_Holme January 18, 2008 at 5:17 pm #

    Good good… *feels happy and safe*

    who wants to bet i get owned in about 5 minutes now?

  6. Pantagruel January 19, 2008 at 12:37 am #

    @ mumble

    Better watch out Leisure Suit Larry is also making his return ;)

    Indeed some antiviral packages are oblivious to very old attack vectors, they have become very concerned with spam/scam/phish and blocking content that they haev forgotten about old skool technique’s
    (.. stumbles through a pile of old 5 1/4″ floppies looking for an MBR infecting proogy from the darkages, darn, the C2D is too fast to do old style DOS progs (or cmd is too limited)

  7. mumble January 19, 2008 at 3:14 am #

    Does anyone else remember the ping-pong virus?

    The scary thing is that I might still have a copy bouncing around. That beast was written in simon-pure assembly, and the size was measured in bytes….

  8. Nobody_Holme January 19, 2008 at 1:19 pm #

    Anything oldskool DOS needs some re-writing to make it work these days…
    Ping-pong virus…. The memories!

  9. goodpeople January 20, 2008 at 12:51 pm #

    My best memories lie with the cookiemonster virus…

    .. can I have a cookie?

  10. mumble January 20, 2008 at 8:40 pm #

    @goodpeople – “A Cookie”

    I find it fascinating that a number of older people – among them security researchers and pentesters, all remember this stuff with glee from back when they were behaving like juvenile delinquents. Plus la change, plus la meme chose… (Yes, I mangled that, but I don’t have bindings for French characters on my keyboard….Unicode doesn’t fix the “where’s the any key!?!?” problem.)

  11. eM3rC February 7, 2008 at 5:42 am #

    Props to the ping pong virus!

    I never though MBR viruses would ever make a comeback. Now the black hats reverted to old tactics, it seems AV will be forced to keep up and catch them before they get installed. Another way around this (aside from programs that stop the modification of vital system files) is a program that is called something like shadow drive. This program basically makes an image of your hard drive(s) and all changes made are not actually stored on the hard drive itself but the image. I have not used the program myself but at some point you are allowed to write the files to the hard drive allowing the computer to be both safe and usable.

  12. J. Lion February 11, 2008 at 11:24 pm #


    I wonder if my MBR is infected…

  13. eM3rC February 12, 2008 at 1:59 am #

    @J. Lion

    If it was I think you would know already ;)