New Rootkits Infecting the MBR

Use Netsparker


Ah I remember some of the nastiest viruses back in the day attaching themselves in the MBR (Master Boot Record) rendering most anti-virus software useless (as it sits on top of the OS).

Now it seems MBR infection is back in fashion for a new age of rootkits.

Security mavens have uncovered a new class of attacks that attach malware to the bowels of a hard drive, making it extremely hard to detect and even harder to remove.

The rootkit modifies a PC’s master boot record (MBR), which is the first sector of a storage device and is used to help a PC locate an operating system to boot after it is turned on. The result: the rootkit is running even before Windows loads. There have been more than 5,000 infections in less than a month, researchers say.

“Master boot record rootkits are able to subvert the Windows kernel before it loads, which gives it a distinct stealth advantage over rootkits that load while Windows is running,” said Matthew Richard, director of the rapid response team for iDefense, a security provider owned by VeriSign. “It gives it a great stealth mechanism that allows it to persist even after removal.” Such rootkits can even survive reinstallation of the operating system, he said.

Pretty stealthy and extremely sticky, time to be a little more wary. MBR infectors are extremely nasty and the majority of people won’t even know they are. Plus as they can subvert the Windows kernel before it even loads…it has a huge stealth advantage.

The new rootkit is part of the arms race between security vendors and malware writers, he said. “We’re definitely making it harder and harder for the bad guys to do stuff to the operating system,” he said. They respond by attacking new parts of a PC.

Every version of Windows, including Vista, is vulnerable to the rootkit.

About 30,000 websites, mostly located in Europe, are actively trying to install the rootkit by exploiting users who have failed to install Windows updates, Richard says. There were 5,000 infections from December 12 to January 7. The rootkit is being spread by the same group responsible for distributing the Torpig banking Trojans, which are used to steal online banking credentials.

(Info from Securiteam)

A timeline is available from SANS here.

Source: The Register

Posted in: Hacking News, Malware

, , ,


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


13 Responses to New Rootkits Infecting the MBR

  1. Nobody_Holme January 17, 2008 at 12:58 pm #

    Are there any new vectors they’re installing it through, though?

  2. goodpeople January 17, 2008 at 1:11 pm #

    Another reason why people should regularly update their virusscanners.

  3. Darknet January 17, 2008 at 1:27 pm #

    Same as normal AFAIK – spread via web downloads.

  4. mumble January 18, 2008 at 9:03 am #

    I must be getting old. Everything I got into trouble with back when I was a teenager is coming back to haunt me. MBR viruses…. non-blind DNS and ARP spoofing… What’s happening? Next I’ll be hearing about carding at the sprint reintroduced Pc-Pursuit.

  5. Nobody_Holme January 18, 2008 at 5:17 pm #

    Good good… *feels happy and safe*

    who wants to bet i get owned in about 5 minutes now?

  6. Pantagruel January 19, 2008 at 12:37 am #

    @ mumble

    Better watch out Leisure Suit Larry is also making his return ;)

    Indeed some antiviral packages are oblivious to very old attack vectors, they have become very concerned with spam/scam/phish and blocking content that they haev forgotten about old skool technique’s
    (.. stumbles through a pile of old 5 1/4″ floppies looking for an MBR infecting proogy from the darkages, darn, the C2D is too fast to do old style DOS progs (or cmd is too limited)

  7. mumble January 19, 2008 at 3:14 am #

    Does anyone else remember the ping-pong virus?

    The scary thing is that I might still have a copy bouncing around. That beast was written in simon-pure assembly, and the size was measured in bytes….

  8. Nobody_Holme January 19, 2008 at 1:19 pm #

    Anything oldskool DOS needs some re-writing to make it work these days…
    Ping-pong virus…. The memories!

  9. goodpeople January 20, 2008 at 12:51 pm #

    My best memories lie with the cookiemonster virus…

    .. can I have a cookie?

  10. mumble January 20, 2008 at 8:40 pm #

    @goodpeople – “A Cookie”

    I find it fascinating that a number of older people – among them security researchers and pentesters, all remember this stuff with glee from back when they were behaving like juvenile delinquents. Plus la change, plus la meme chose… (Yes, I mangled that, but I don’t have bindings for French characters on my keyboard….Unicode doesn’t fix the “where’s the any key!?!?” problem.)

  11. eM3rC February 7, 2008 at 5:42 am #

    Props to the ping pong virus!

    I never though MBR viruses would ever make a comeback. Now the black hats reverted to old tactics, it seems AV will be forced to keep up and catch them before they get installed. Another way around this (aside from programs that stop the modification of vital system files) is a program that is called something like shadow drive. This program basically makes an image of your hard drive(s) and all changes made are not actually stored on the hard drive itself but the image. I have not used the program myself but at some point you are allowed to write the files to the hard drive allowing the computer to be both safe and usable.

  12. J. Lion February 11, 2008 at 11:24 pm #

    scary…

    I wonder if my MBR is infected…

  13. eM3rC February 12, 2008 at 1:59 am #

    @J. Lion

    If it was I think you would know already ;)