Kimmo Kasslin F-Secure
Elia Florio Symantec
download slides (PDF)
The war against invisible malware has been taken down to a new battleground, the lowest level seen so far in the wild: the Master Boot Record. The MBR rootkit, aka Mebroot, appeared in the wild in December 2007 and rapidly evolved from earlier beta versions to a full-working malware product. Mebroot rootkit uses techniques never before seen in modern threats and so it can be considered the next generation of stealth rootkit and kernel infector, written by professional malware developers clearly not for fun. The most notable characteristic of Mebroot is the fact that it replaces the system's Master Boot Record with malicious code that owns the machine completely from the boot, before the operating system itself gets loaded.
Years after Stoned and Michelangelo, Master Boot Record infection has been reborn with Mebroot on modern platforms. However, this technique is only the tip of the iceberg of a bigger cybercriminal project, since the final goal of Mebroot is to download and install additional bank trojan components on the infected machine. In this paper we present an extended view of MBR rootkit's features and its evolution - including a detailed look at its disk stealth, firewall bypassing, anti-analysis and anti-detection techniques.
