Rootkit gömmer sig i hårddiskens startsektor

[brainslicer]

Rootkit gömmer sig i hårddiskens startsektor

Ett ytterst farligt rootkit som infekterar hårddiskens startsektor har nu letat sig in i tusentals datorer. Något som gör det hela extra komplicerat är att det är näst intill omöjligt att upptäcka.

New rootkit hides in hard drive's boot record

Cloaking malware holes up where Windows can't find it, say researchers.

A rootkit that hides from Windows on the hard drive's boot sector is infecting PCs, security researchers said today. Once installed, the cloaking software is undetectable by most current anti-virus programs. The rootkit overwrites the hard drive's master boot record (MBR), the first sector -- sector 0 -- where code is stored to bootstrap the operating system after the computer's BIOS does its startup checks. Because it hides on the MBR, the rootkit is effectively invisible to the OS and security software installed on that OS.

 

Matthew Richards, the director of VeriSign's iDefense Labs, pegged the start of the MBR rootkit's in-the-wild appearance as Dec. 12, with a second round of attacks on Dec. 19. So far, said Richards, nearly 5,000 PCs have been infected by the rootkit.

 

From the recovery console, advised Elia Florio, another Symantec researcher, users can run the "fixmbr" command to remove the rootkit. "To help prevent similar attacks in the future, and if your system BIOS includes the Master Boot Record write-protection feature, now is a good time to enable it"

[Tottyville]

Bra att veta

 

Saxxat från IDG:

"Rotkitet drabbar enbart datorer med Windows XP eftersom det är specialskrivet för det operativsystemet."

[brainslicer]

Jo, lite mer om de från engelska artikeln:

 

The rootkit is hard-coded in such a way as to only work on Windows XP systems. But even if it was tweaked, Vista users would have to explicitly approve the installation of the MBR rootkit by accepting a UAC (User Account Control) warning, since the rootkit requires needs administrative level approval to install to the hard drive's master boot record.

If it gets on the drive, though, the MBR rootkit is very difficult to detect, Friedrichs admitted. The best defense, therefore, is to sniff it out before it manages to worm its way onto sector 0.

That's the approach Symantec and other anti-virus vendors have taken. Symantec, for example, detects the rootkit as a Trojan dubbed "Mebroot" when it attempts to first install after, say, a successful attack using one of the exploits hosted on the compromised sites serving as attack launch pads.

"But once it's on your system, it becomes much more difficult to deal with," said Friedrichs. "Once it's tampered with the master boot record, the only way to remove it is to boot using the Windows installation disk and run the Windows Recovery Console."

[Hox]

Snabbare fixat med fdisk /mbr från en bootdisk.

[Joeduck]

Jag har hört att de har lyckats gömma rootkits i BIOS med, lycka till med din fdisk då / p.o.c ('oskadlig') finnes via google

 

För att tillägga något utav värde, så patchas oftast MBR,startsektorn vid uppstart o speciellt i NT miljöer är det svårt att få rättigheter eller att inte AV eller annat ska skrika BU alternativt att maskinen hänger sig. De smittade datorerna ifråga gissar jag är infekterade via USB memory sticks, just för att det är lättast så.

Därför ska man inte låta något annat än sitt operativsystem starta upp maskinen,startsekvens ändras i BIOS. Allt för många x86's har USB förvalt. Det skall man alltså ändra. helst ska man ju använda GuestKontot när man surfar oxå, men det är överkill

[Joeduck]

Inte riktigt samma, lite äckligare (VM, virtualisation rootkits)

http://bluepillproject.org/

 

Subverting Vista Kernel For Fun And Profit

 

Finns nu också till MAC. : D

 

Nästa gen, HW VM rootkits (?)

[brainslicer]

MBR Rootkit, A New Breed of Malware (vilken flashback, those days are back....)

 

News broke out earlier this year of a new breed of rootkit using techniques never before seen in modern malware. The most notable of them is the fact that the rootkit replaces the infected system's Master Boot Record (MBR).

 

The MBR is the first physical sector of the hard drive and contains the first code loaded and executed from the drive during the boot process.

 

In the competition between rootkits and rootkit detectors, the first to execute has the upper hand. And you can't execute earlier than from the MBR. Of course, MBR viruses used to be very common in the DOS days, 15 years ago or so. But this is 2008.............