Your computer is now stoned (...again!). The rise of MBR rootkits
Kimmo Kasslin F-Secure
Elia Florio Symantec
download slides (PDF)
The war against invisible malware has been taken down to a new
battleground, the lowest level seen so far in the wild: the Master Boot
Record. The MBR rootkit, aka Mebroot, appeared in the wild in December
2007 and rapidly evolved from earlier beta versions to a full-working
malware product. Mebroot rootkit uses techniques never before seen in
modern threats and so it can be considered the next generation of
stealth rootkit and kernel infector, written by professional malware
developers clearly not for fun. The most notable characteristic of
Mebroot is the fact that it replaces the system's Master Boot Record
with malicious code that owns the machine completely from the boot,
before the operating system itself gets loaded.
Years after Stoned and
Michelangelo, Master Boot Record infection has been reborn with
Mebroot on modern platforms. However, this technique is only the tip of
the iceberg of a bigger cybercriminal project, since the final goal of
Mebroot is to download and install additional bank trojan components on
the infected machine. In this paper we present an extended view of MBR
rootkit's features and its evolution - including a detailed look at its
disk stealth, firewall bypassing, anti-analysis and anti-detection
techniques.
