0wning Vista from the boot

The VBootkit authors speak out

Build a business case: developing custom apps

How can an attacker deploy it?

Nitin & Vipin: An attacker doesn't need to install, that's the way it has been designed. Just boot the system by placing the vbootkit media (containing vbootkit in bootsectors) in the drive, and start booting. After Vista boots, you can verify that you are running vbootkit, by checking the privilege of any running cmd.exe, the sample converts all low-privileged cmd.exe process to SYSTEM privileges. It also supports system compromise via PXE booting.

It doesn't need any privileges only physical access to the machine. It can also be installed to a remote system under some conditions (without physical access).

Have you developed a persistent version too?

Nitin & Vipin: It was basically designed to run from CD, Flash drives and portable HDD. However, such versions were not persistent, so if the system rebooted, they were gone. So, during development we also worked on a persistent version, meaning it would attach to MBR of the hard-disk. Attaching means we will copy the original MBR to some-other location, and thus replace the MBR. So, when the System starts now, vbootkit awakes from MBR, it bootstraps itself (since it is larger than 446 bytes), then loads the original MBR and thus normal booting continues.

As far as someone using other boot managers, it has no effect on almost 99% of such systems, because it doesn't replace the original boot process, it only inserts itself into it.

Is it small enough to fit inside BIOS flash memory?

Nitin & Vipin: Definitely, It's just about 1500 bytes in size. It can be reduced further. Todays BIOSes are big in size, therefore, it can easily hide in there.

How does vbootkit work?

Nitin & Vipin: A small summary:

BIOS --> Vbootkit code(from CD,PXE etc.) --> MBR --> NT Boot sector --> Windows Boot manager --> Windows Loader --> Vista Kernel.

Just after vbootkit takes control, it hijacks the interrupt 13, then searches for Signature for Vista OS. After detecting Vista, it starts patching Vista, meanwhile hiding itself (in smaller chunks at different memory locations). The patches includes bypassing several protections such as checksum, digital signature verification etc, and takes steps to keep itself in control, while boot process continues to phase 2.

Phase 2 includes patching vista kernel, so as vbootkit maintains control over the system till the system reboots. Several protection schemes of Vista were analyzed such as the famous PE header checksum (every Windows EXE contains it), the Digital Signature of files.

So, you have vbootkit loaded in Vista's Kernel.

Can your vbootkit be used to avoid the DRM ?

Nitin & Vipin: Yes, the vbootkit can be modified to bypass the DRM stuff. Since the DRM has been implemented in such a way, so as if unsigned drivers are loaded, then DRM will not let you play the content. What vbootkit does is let you load code without the OS knowing that it has been compromised, and thus the vbootkit can be misused to bypass DRM.

What other things can vbootkit be used to do...

Nitin & Vipin: vbootkit can be used to to create the long dead boot sector virus. Even some anti-virus vendors have stopped detecting boot sector viruses. It can revive the viruses.

Just imagine the following scenarios.

Suppose vbootkit is running on a computer and someone plugs-in a USB storage device (vbootkit will copy itself to the boot sector of the new device), now whenever mistakenly the USB devices boots up, it gonna attach to the boot process of new system and thus, it can flow from system to system and the legend continues

Now, just take another interesting scenario. vbootkit is running on a system in a company, it captures all MAC address, and at 00:00, in the silence of the midnight, the vbootkit system starts remote booting, and delivers the vbootkit code as boot code though PXE, so slowly and steadily, the whole organization gets going on vbootkit...

It can also be used to implement backdoors (both local and remote), just an idea. Basically, it can do anything you can imagine (that vista could do).

How can vbootkit be spotted once it is running in a system?

Nitin & Vipin: In the current versions, it shows our signature at OS selection time (Boot menu). Secondly, we have added vbootkit signature into the kernel memory, so a physical dump, or a kernel scan will be able to find it.

How would you modify it if you wanted to make it as "invisible" as possible?

Nitin & Vipin: Removing all the signatures from boot menu and memory locations. Invisibility and detection in rootkits/bootkits is a continuous game of modifying your tools to defeat the other.

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
prev story


7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?