Bootkit Bypasses Hard Disk Encryption

Bootkit = Bootable + Rootkit

This year, at BlackHat security conference, an Austrian IT security specialist Peter Kleissner presented an open development framework for creating rookits that activate early on in the boot process using MBR, aka bootkit.

This bootkit combines a rootkit with the ability to modify a PC's Master Boot Record (MRB), enabling the malware to be activated even before the operating system is started. The bootkit is called Stoned, which is capable of bypassing the TrueCrypt partition and system encryption.

You can access the BH USA 2009 media archives to get a copy of the slides and paper.

New Linux Rootkit Technique

A new rootkit technique is uncovered by a Linux expert using /dev/mem. This is also less obvious thant the established route via traditional LKM method to hide files or processes, or interfere with network traffic.

The trick is that, without requiring extensive rights, libmemrk uses the /dev/mem device driver to write arbitrary code from userspace into main memory. /dev/mem is an interface that enables use of the physically addressable memory.

Interestingly, some platforms are secure against this new rootkit (by default):

• Current RedHat and Fedora (incorporates SELinux )
• Virtual environment (another reason to be virtualized)
  

The detail of the new rootkit is documented in Malicious Code Injection via /dev/mem.

When FireFox 2.0 Meets with JavaScript

Just come across a Firefox extension, called FFsniFF. This is a NOT a password sniffer which can sniff password. See the reference links below for more information.

The question here is not whether it is a password sniffer or not, it is about how do I get rid of it once I installed since it is hidden from the FF Extension Manager? Chicken and egg problem.

Finally, I've no choice but to do it manually. Here's how I remove/disable it manually:

1. Close your FF blowser and locate your FF user profile folder. Eg: %APPDATA%\Mozilla\Firefox\Mozilla\Profiles\[User Profile]\[random string].default\
2. Go into subfolder "extensions\{66cdf40a-d0f2-46d0-abf4-eccba8205aef}\chrome". You should see a file called "ffsniff.jar"
3. Find an unpacker (Eg. 7-zip) to unpack the "ffsniff.jar".
4. Once unpack, go into "content\ffsniff\" folder and look for a file called "ffsniffOverlay.js".
5. Edit the file with notepad. Goto the bottom (line 119), remark the line "hide_me();" with two slashes "//" (without the quote) in front.
6. Save and close the file and put everything back to "ffsniff.jar".
7. Start your FF broswer now and goto the Extension Manager, you should be able to see the extension called "FFsniFF 0.2".
   
8. Now you can disable it.
   

Reference links:

• Disable FFsniFF Manually - J.Track

• http://jtrack.blogspot.com/2008/03/disable-ffsniff-manually.html

• FFsniFF Homepage
  

http://azurit.gigahosting.cz/ffsniff/

http://azurit.elbiahosting.sk/ffsniff/

• Vulnerability Summary CVE-2006-6585

• http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-6585

• SecurityFocus

• http://www.securityfocus.com/archive/1/archive/1/454058/100/0/threaded

Master Boot Record Rootkit

Just found some useful information on MBR rootkit. Below is the timeline.

• Aug 1, 2005 - eEye publishes PoC code
  http://research.eeye.com/html/tools/RT20060801-7.html
• Aug. 3, 2007 - Vbootkit presentation at Black Hat USA
  http://www.blackhat.com/presentations/bh-europe-07/Kumar/Presentation/bh-eu-07-kumar-apr19.pdf
• Oct. 30, 2007 - Original version of MBR rootkit written and tested by attackers
• Dec. 12, 2007 – First known attacks installing MBR code
  about 1,800 users infected in four days.
• Dec. 19, 2007 - Second wave of attacks installing MBR code
  about 3,000 users infected in four days
• Dec. 22, 2007 – Malware Research Form members discover rootkit in the wild
• Jan. 2, 2008 - GMER research and analysis of MBR Rootkit code
  http://www2.gmer.net/mbr/
• Jan. 5, 2008 - Prevx Blog has a good writeup located at http://www.prevx.com/blog/75/Master-Boot-Record-Rootkitis-here-and-ITW.html
  
• Jan. 7, 2008 – First anti-virus vendors detect MBR rootkit components
• McAfee detects the Trojan as StealthMBR (DAT 5204 or above) and Symantec as Trojan.Mebroot. Sophos uses name Troj/Mbroot-A, in turn. There are names like Trojan.Win32.Agent.dsj and TROJ_AGENT.APA assigned too.
• 10th Jan: Trend Micro uses the name TROJ_SINOWAL.AD
• 12th Jan: Symantec sees the infected MBR as Boot.Mebroot. McAfee uses the name StealthMBR!rootkit too.

According to SANS, the next big thing is that those distributing this rootkit, also distribute the Torpig banking Trojan. The rootkit is currently being installed through a set of relatively old, and easy to patch Microsoft vulnerabilities:

• Microsoft JVM ByteVerify (MS03-011)
• Microsoft MDAC (MS06-014) (two versions)
• Microsoft Internet Explorer Vector Markup Language (MS06-055)
• Microsoft XML CoreServices (MS06-071)