New "Mebroot" MBR-Modifying Rootkit Analyzed 65
I Don't Believe in Imaginary Property writes "F-Secure has a writeup on a highly obfuscated, advanced new rootkit they recently discovered which uses a number of old techniques like MBR modification in new ways. It modifies the MBR, starts up its downloader with an ntoskrnl.exe hook set to nt!Phase1Initialization (which conveniently removes it from memory afterwards), and hooks IRP_MJ_READ and IRP_MJ_WRITE in disk.sys to hide itself in empty sectors. It also bypasses software firewalls by calling the NDIS API directly, using a 'code pullout' technique to load just the parts of ndis.sys that it needs. F-Secure believes it was written by professionals who are after financial information."
Would these issues affect EFI to the same degree? (Score:4, Interesting)
Re: (Score:1, Funny)
Re: (Score:1, Funny)
Re:Would these issues affect EFI to the same degre (Score:4, Insightful)
That sounds a little naive. It's wrong for several reasons:
Re: (Score:3, Interesting)
No, but about 85% of computer users do, and financial information is a question of hitting as many people as possible.
This isn't worth saying seperately, and this is an AV issue.
Re: (Score:2)
Bullshit. AV penetration might be that high, but what's the percentage when expired 90-day "came with my computer" trials are excluded? I work at a University, and if college students are any indicator of what they're parents are doing, even with our best efforts to educate them and provide campus purchased AV for use on personal computers, a large number either have nothing or don't realize
Re: (Score:2)
You're guessing. Acting like you know someone else is wrong, when you don't, makes you look like an asshole.
As a janitor, maybe. People don't get university jobs of quality when they can't sort out the difference between "they're", "there" and "their".
They aren't.
Given your surreal quality of language and your seeming unawareness that you're supposed to bring
Re: (Score:2)
Re: (Score:2)
Congratulations: you're the first slashdotter to genuinely disappoint me in more than a year.
Re: (Score:2)
Re: (Score:2)
Naivity belongs to you, not grandparent.
No, but about 85% of computer users do, and financial information is a question of hitting as many people as possible.
According a recent survey only about 50% of computer users do use AV software, the % of up-to-date AV software is even lower.
According to afore mentioned survey, far less than 50% of computer users do use anti malware software.
Anti malware isn't a AV issue. Yes, sometimes anti malware comes bundled with an AV package, but it isn't the same as AV software.
Re: (Score:2)
Please show me this survey that contradicts CERT by 35%.
Please show me this survey that contradicts CERT by 35%.
That's funny, MBR viruses like this show up all over Norton's and Kaspersky's lists. Funny how the antivirus authors seem to disagree with you
Re:Would these issues affect EFI to the same degre (Score:5, Informative)
EFI is more complex than the simple boot block / partition table that fits in a single disk sector. More complex means fewer people who will fully understand it, more bad implementations in firmware with potential security problems, etc.
Of course there are good reasons for it to replace the MBR/partion table, like running into a brick wall on the max drive size.
Re:Would these issues affect EFI to the same degre (Score:5, Informative)
http://home.no.net/tkos/info/embr.html [no.net]
And the Bios has supported 64 bit LBA addresses in int 13 for ages, so there is no disk size problem for a very long time - probably many decades. Seriously, you don't need EFI to get 64 bit LBA support.
Re:Would these issues affect EFI to the same degre (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
That way my boot & nuke / clean-up key never gets accidentally formatted by someone.
-nB
Re: (Score:2)
including Sony
So, you recommend i incorporate myself as a corporate so that i may successfully produce rootkits without fear of conviction?
Lawyer for victim: "The accused here caused massive financial damages to my client by putting in a rootkit and stealing bank account information thus enabling 3rd parties who used the rootkit to steal money from my client's accounts."
Lawyer for accused: "Your honor, i present for your perusal, information from earlier such cases where the corporate was trying to protect intellectual
Re: (Score:1)
Re: (Score:2)
Name one case where a corporation was convicted of being a hacker and made to pay out millions.
Now go and count the cases where a poor individual hacker was convicted of hacking?
Re: (Score:1)
Name one case where a corporation was convicted of being a hacker and made to pay out millions
Large companies with deep pockets are hit with lawsuits all the time. This one seems frivolous to me, someone sued Apple because the battery in the iPhone was non replaceable. But that's something he should have checked before he bought it. I don't like my iPod touch, but there's no way I'd sue Apple for all the misfeatures.
http://www.techcrunch.com/2007/07/27/iphone-class-action-lawsuit/ [techcrunch.com]
This one seems more sympathetic - a judge ordered a bunch of spam companies to pay $1bn, presumably bankrupting them. As
Re:Would these issues affect EFI to the same degre (Score:3, Informative)
http://it.slashdot.org/article.pl?sid=06/01/27/1327228 [slashdot.org]
Nice Job (Score:3, Interesting)
Not that I'd ever encourage such behavior.
Re: (Score:3, Interesting)
you're totally right tho. Back in the day, this would have just been called a boot infector with some interesting stealth. I gotta say, i'm really surprised that stuff like this still works..
Re: (Score:2)
But yes, the old-style viruses tend to have lost out the past few years. I can remember quaking in fear when I read about a virus that was polymorphic, stealth, boot-sector infecting, "hold your partition table to ransom", able to transfer to floppies, hard disks and even CD's (WOW!), plus across IPX networks, randomising data destruction etc.
Now THAT was a virus to be scared of.
Re: (Score:1)
Re: (Score:2)
For example.
Re: (Score:2)
Re: (Score:1)
Originally a root kit was a set of tools to hide your tracks, like replaced versions of 'ls', 'ps', etc so that it became that much harder to detect you.
AVG, Clam (Score:2)
The fix is free: (Score:4, Informative)
To use it, you first go into the Windows XP Recovery Console [microsoft.com]. Then run FixMBR
Here is a discussion [microsoft.com] on the Microsoft web site about tools for fixing the MBR without the Recovery Console. I've never tried them; I've always used the FixMBR utility that comes with the Recovery Console.
FIXMBR -- trust chain (Score:3, Informative)
Ultimate Boot CD for Windows (Score:2)
From the article (Score:2, Informative)
From the article:
I'm pretty sure you can only do that when you're Admin.... Use "Limited User" for crying out loud!
Re: (Score:2)
[Cancel] [Allow]
Re: (Score:1)
Yeah, but the novice user will click "Allow" to get back to work.... Doesn't help. Limited User on XP simply doesn't allow you to do anything that's dangerous. No dialog boxes, no passwords: simply "Access denied" which is how it should be. You want to install something of change configuration login as Admin or use RunAs.
Of course, that would mean that the user knows what he's doing, and we're back to the weakest chain in the link... *sigh*
Re: (Score:2)
If so, I will refrain from asking, "then why don't people use it?" because I know why. And I know why I have not enabled this feature. Simply put, lack of motivation to do so. But since I'm not loading an OS onto my computer every day I use it, or my servers, I could level-up my responsibility stats by write-protecting the MBR. (Of course, any cracker worth his salt (HA!) would find a way
Re: (Score:1)
Hmmmm... With the multitude of different BIOSes out there, I doubt it is possible to have code that would work on every machines. From time to time one hears of BIOS viruses and the like, but I frankly think they're urban myths.
On the other hand, the MBR is on a fixed position on your harddisk and modern operating systems do not need the BIOS to write to it. It might thus be possible to write the MBR without he BIOS noticing.
Re: (Score:2)
Look up Blue Pill rootkit.
-nB
Re: (Score:1)
"not written for fun" (Score:4, Insightful)
Why include this swipe at amateur software development?
Nearly all of the "professionally produced" code that I've read is horrendous and looks like it's been coded by rabid gibbons on LSD, while the best code I've read has been written by people for whom it's a labor of love. Yes, there is also plenty of ugly open-source code, but the fact that it's well written just means that the programmer cared about it.
Re: (Score:2)
This MBR infector could very well have been written by "professionals" with a specific agenda, but to reach that conclusion based solely on the apparent quality of the code is wrong.
-dZ.
Re: (Score:2)
I didn't read it that way at all. The way I read that was "the person who wrote this did so to create a tool for a specific purpose; their goal was not mischief or proving their skill, as is so common in this arena, but rather to create an exploit to make themselves rich."
Intimidating (Score:2)
Re: (Score:1)
DOS Viruses (Score:5, Interesting)
Having said that, it's nice to see something where people have actually invested time and skill into creating a program that bypasses the OS in such a way, rather than just another re-written script with a couple of variables changed.
Lines like:
"This malware is very professionally written and produced. Which of course means it's not written for fun."
might annoy some, though. The old DOS viruses NEVER really acheieved anything useful (even with blackmail attempts while holding your boot sector to ransom) etc. and were written "just because" by teenagers. That didn't stop them from appearing professionally written and breaking genuinely new ground for the time. Just because people are now using such malware for financial gain, doesn't mean that it's ALWAYS the case. And Linux zealots are sure to jump on the above quote with all their hearts.
And then you have the obvious - why is the OS allowing you to modify the MBR without appropriate rights and/or why are users running as users with the rights necessary to do this? This is STILL a problem harking back to the DOS days - everyone as administrator. With a new twist - the average user hasn't needed to BE administrator for quite a long time now.
Re: (Score:2, Informative)
Except in Vista, this isn't true. You need to either have elevated privileges(or have disabled UAC so that everything runs as administrator) to be able
Re: (Score:2)
However I assume that "Boot sector protection" as available in most modern BIOS's should stop this stone dead (I know that I implement it but I doubt everyone does). It's like 1989 all over again...
Granted, the virus is easily cleaned, although it's potential effects may
Re: (Score:1)
Not really. UAC [wikipedia.org] is essentially like sudo, except that when you run in an administrator account, there is no password prompt, only a Allow/Cancel choice. From a non-administrator user, you have to enter the login and password of an administrator. Of course, if you disable
Re: (Score:1)
UAC is essentially like sudo, except that when you run in an administrator account, there is no password prompt, only a Allow/Cancel choice.
This is only true if the built-in Administrator account has no password. If you enable the built-in Administrator account (which can apparently be done any of several ways, but the one I've always used is 'net user administrator /active:yes') and then give it a password, the UAC dialog will thereafter have a password prompt. This has always been the first thing I do on any Vista machine I've had to configure (which fortunately has not been many).
I also remove sudo from every *nix box I admin; 'su -c' does
Re: (Score:1)
Re: (Score:1)
Interesting. I never enabled the Administrator account on my
I disagree. (Score:3, Funny)
Re: (Score:2)
Not just Linux zealots. If you cannot write good code for fun, you cannot write it for money, either.
Yes... (Score:5, Funny)
I'm impressed! (Score:2)
-dZ.
Do we only care about business? (Score:2)
What about its effects on the well-being of us, the humans?
(Provided energy use is bad for the planet, the increase of that might be important, if it's large.)
Re: (Score:1)
Re: (Score:2)
Oups, you are right. I'll creep back into my hole now.
Hackers,Phishers,Virii writers (Score:1)
It wouldn't surprise me to find legislation in many countries,unopposed by the citizenry(even the U.S.) for capital punishment or at least cutting off their hands.