[AV-TEST] Windows 10, Home User, October 2017

[Deleted member 65228]

Missed out on this comment from F-Secure and it's interesting IMO on several points. Have no clue if they added something in any updates or upcoming versions but I would still suggest the use of Talos MBR Filter as one of several security layers.

MBR Filter is great but the problem is you will never know if something did try to attack MBR. It just auto-blocks, it doesn't notify you at all.. not even a log file. So if malware gets blocked and has a connection to a malicious server the attacker can use to communicate to the sample with (e.g. known as C&C - Command and Control server) then if the action is blocked and the attacker can find out, then it could send an update to do something different like just steal data and what-not

I mean unrealistic unless its like a backdoor or something because bootkits alone aren't prevalent unless you're thinking of ransomware like Petya, NotPetya, BadRabbit or Rombertik but still that is the weakness of MBR Filter. Not to mention that if you did happen to get hit with Rombertik or something alike it, not being able to hijack the MBR = another payload sometimes for encrypting all your documents

Of course malware could do both before rebooting for the hijacked bootloader but still..

MBR Filter is effective but because it doesn't even suspend the responsible process to ask to allow/block or even have a log file it is pretty much a bit of a weak spot if I am honest. AV suites which protect the MBR also will have better self-protection for their drivers, I doubt MBR Filter protects its driver from being unloaded by an attacker (e.g. UM process with the correct privileges)?

 

[upnorth]

I agree but it's just as I mentioned " one of several security layers " so alone it's ofcourse not enough. You do actually get a notification when it works as shown in this video.



Quote : " MBR Filter, once installed, requires the system to boot in Safe Mode to enable write access to make changes to the device. ". Normaly that requires administrator privileges.

Source : MBR Filter - Cisco Talos

 

[Deleted member 65228]

@upnorth Yeah it does protect its driver then, I did think it was a bit strange if they didn't... I still think a weakness is that it doesn't have a log about attacks or auto-block because then malware may attempt a second payload if the MBR attack was the first. But I still think that MBR Filter is great and I used to use it myself

 

[Deleted member 65228]

@upnorth Hold on a minute! Does MBR Filter protect its registry keys?

HKLM\SYSTEM\CurrentControlSet\Services Registry Tree

You'd have to be elevated because its HKEY_LOCAL_MACHINE but if they don't protect it then you would be able to change their entry so their driver doesn't start-up, or a rogue one does (if its signed on x64 -> unless you abused bcdedit.exe as you'd be elevated anyway so the next restart loads an unsigned driver)

Hijacking the MBR requires elevation anyway so if someone is going to do it then doing something like trying to exploit the software in other ways like doing the above would actually be realistic IMO. if someone can hijack the MBR themselves without copy pasting code and write their own proper bootloader (16-bit ASM) to be loaded instead of just destructing it so nothing works then I'm sure they'd be experienced enough to work the registry and what-not

 

[upnorth]

@upnorth Hold on a minute! Does MBR Filter protect its registry keys?

Found this.

Quote : " To remove MBRFilter, follow these steps:

- Remove the line MBRFilter from the UpperFilters registry key in (only
remove MBRFilter, there might be other disk drivers here):

HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}

- Reboot

Source : GitHub - Cisco-Talos/MBRFilter: Cisco Talos MBR Filter Driver

How well protected that is other then what they state that this is only possible to remove in Safe Mode I can't answer on as I simply don't know but your point is good. Seams very odd if that wasen't already tested by Talos themself.

 

[Deleted member 65228]

Hmmmm. I'll test it out now if I can and let you know if it protects without being in safe-mode via registry or not. Either way it can be fixed easily if they use CmRegisterCallbackEx to block attacks to there without being in safe mode, I'm sure they could do it since they used KM for protecting the MBR and VBR

 

[bribon77]

MBR Filter I've used it, but I do not think it's necessary if you use Comodo or Eset or Kaspersky because it already protects the MBR.

 

[ZeroDay]

Some thoughts?
- I think that this topic is about delayed, retarded software.
Don't make big company games: start using serious defenses like anti-scripts... ContentBlockHelper, ScriptSafe, Script Blocker for Chrome, Policeman... NoScript... RequestPolicy Continued... and other HIPS, anti-exe... etc.

I agree to a point. But what we need to understand is your average Joe doesn't want to mess about with any of that. They just want something to protect them and not have to make any decisions. I know that's sad but it's true. I put Comodo firewall on a friends computer, I used CS's settings and two programs got auto sandboxed so he phoned me and said " Can you take this ##### off my computer it's driving me nuts" And that was just because 2 programs got auto sandboxed. I explained in details how to use it and all the benefits of using it but he didn't want to know. He's using Kaspersky internet security now and I've had to leave that at pretty much default settings so nothing gets blocked because I'd tweaked KIS. I've got another friend who got infected that much, not because he didn't know what he was doing, but because he didn't care he thought nevermind because he knew I'd fix the problems.I got that sick of it I told him to just buy a iMac and even though there are infections for Macs he's never had one and we get on much better now lol. People want protection but they don't want to put any effort in themselves. If anyone ever asks me to recommend a paid security software and they're just the average Joe I just recommend KIS. If they want free protection I recommend Avast. At least that way they've got good protection with no hassle for them or me lol. I know people that get frustrated just using an SUA. I agree with the software you mention but that's more for us than the majority of regular users.

 

[Deleted member 65228]

@upnorth

HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}
- You target this the same way as instructed in the uninstallation guide.

My suspicion was correct! If you're elevated, you can force uninstall it. An attacker would need to be elevated to attack the Master Boot Record in the first place, and then they can access the protected registry key to cause MBRFilter not to start-up on the next reboot. The MBRFilter service will still be present after the reboot but the MBR protection will be vanished after targeting the above mentioned key - don't mess it up though or you'll force yourself into a recursive BSOD at start-up related to required boot devices not being able to be found/used.

MBRFilter does mention that it is just really an experiment and should be assessed before being applied in... let's say a work environment for example. I wouldn't say it is hard to remove by default though, you can do it by default just fine if you're elevated. Considering an MBR attack would be elevated anyway.

MBR Filter is open-source and I had previously forgotten this so I took a peak at its driver source code. I should have done that at the start really to determine if there were any real mitigations regarding self-protection... Anyhow, it appears to work by controlling driver control code requests and when it gets a request for the Physical Drive (e.g. PhysicalDrive0) it will cause an alert to mention you have to be in Safe Mode to do this and block the request by returning STATUS_ACCESS_DENIED. These requests go through a mechanism known as IOCTL, where the first two characters "IO" stands for Input/Output and the CTL stands for Control. It is actually a mechanism commonly used for user-mode to kernel-mode communication (e.g. sending up a structure with data with a CTL_CODE and then the driver notices the CTL_CODE, checks the process responsible for the request via IoGetCurrentProcess() and then processes the data send up). Another technique which is not as good as the one applied by MBR Filter would be setting a hook on a function like NtWriteFile (or in kernel-mode -> FltWriteFile) to block the write requests where a handle to the physical drive is being used. The alert is caused by using a function called ExRaiseHardError in kernel-mode which can be used to cause a Message Box dialog appear (kernel-mode doesn't support GUI so instead of injecting into a user-mode process to make an alert show or having a UM component for communication to spawn an alert, it just uses that routine to get it done which is quick, easy and doesn't require UM components in-memory). However it could easily retrieve the process responsible via IoGetCurrentProcess() and then get the Process ID from the returned EPROCESS pointer structure of the process responsible and display these details along with the process name/file-path on the dialog so I am not sure why this wasn't done.

I think it would be more reliable to use a security product like Kaspersky which can protect the Master Boot Record simply because it has more thorough self-protection mechanisms. It also isn't open-source which for these sorts of things would make it more difficult to bypass in my opinion considering a malware author would have to reverse engineer to work out a work-around and that would be quite difficult when you take into account how much they'd have to go through with an AV product (because there is just so much going on constantly).

In my honest opinion it is great that people like the ones who developed MBR Filter are making things like this for the community for free. Not everyone wants to purchase a full AV suite for specific protection like MBR so this is a good alternate for those people. And also general researchers. The technique applied to protect the MBR is interesting and I like it.

 

[Deleted member 65228]

Why are we discussing MBR? Don't the majority of people use GPT and UEFI, just like people no longer use xp and vista? Especially since more and more people will start using windows 10 in the coming years, GPT and UEFI should be used by the majority in this case, those are just speculations though, I have 0 stats

A lot of people still use the Master Boot Record. Even though UEFI is much more secure, it can still be abused for bootkit technology as well (there have been open-source bootkit experimental projects for UEFI for years now).

Intel are pushing for UEFI by 2020 I believe, according to recent news. There'll still be people using MBR afterwards though. Anyway, look at how much effect Petya, NotPetya, and BadRabbit had. All three of those targeted the Master Boot Record and all-in-all between them sabotaged millions of systems.

 

[mlnevese]

I agree to a point. But what we need to understand is your average Joe doesn't want to mess about with any of that. They just want something to protect them and not have to make any decisions. I know that's sad but it's true. I put Comodo firewall on a friends computer, I used CS's settings and two programs got auto sandboxed so he phoned me and said " Can you take this ##### off my computer it's driving me nuts" And that was just because 2 programs got auto sandboxed. I explained in details how to use it and all the benefits of using it but he didn't want to know. He's using Kaspersky internet security now and I've had to leave that at pretty much default settings so nothing gets blocked because I'd tweaked KIS. I've got another friend who got infected that much, not because he didn't know what he was doing, but because he didn't care he thought nevermind because he knew I'd fix the problems.I got that sick of it I told him to just buy a iMac and even though there are infections for Macs he's never had one and we get on much better now lol. People want protection but they don't want to put any effort in themselves. If anyone ever asks me to recommend a paid security software and they're just the average Joe I just recommend KIS. If they want free protection I recommend Avast. At least that way they've got good protection with no hassle for them or me lol. I know people that get frustrated just using an SUA. I agree with the software you mention but that's more for us than the majority of regular users.

I agree completely. Many consumer market security software seem to have finally noticed this as well and is starting, either to automate some things or to ship with slightly better defaults. Bitdefender in autopilot mode and Kaspersky defining a software rights by asking its cloud about trustworthiness are good examples of it.

 

[ZeroDay]

I agree completely. Many consumer market security software seem to have finally noticed this as well and is starting, either to automate some things or to ship with slightly better defaults. Bitdefender in autopilot mode and Kaspersky defining a software rights by asking its cloud about trustworthiness are good examples of it.

Bitdefender,that's another one I recommend to people who don't want to be hassled. Like you say BD have autopilot mode which is perfect for a lot of people. And I agree - Many security firms seem to finally be realising that the average user needs more protection but less hassle.

 

[Evjl's Rain]

Why are we discussing MBR? Don't the majority of people use GPT and UEFI, just like people no longer use xp and vista? Especially since more and more people will start using windows 10 in the coming years, GPT and UEFI should be used by the majority in this case, those are just speculations though, I have 0 stats

according to somebody, even when we use GPT, it still uses a small MBR partition to do something. If that partition is corrupted, windows might not be able to boot
so MBR ransomwares can still corrupt GPT system

 

[Evjl's Rain]

Isn't there a cmd command that you can fix the boot partition with? I remember having problems with installing os-es left and right before I switched to gpt for my ssd so my windows 10 got corrupted, I searched for a solution and I found that with a windows 10 installation iso on a usb you can enter cmd and then it was as simple as typing some commands, something with bootrec and bcdboot and after that the boot partition is like new

Petya actually encrypted the partition, I'm not sure if the command can repair GPT drive or not
definitely not able when MBR drive is encrypted

 

[Deleted member 65228]

@Yo Whats Up

I think you're referring to repairing the Extensible Firmware Interface (EFI) boot-loader (used for GPT hard-drives). There's a really good article about this and it does reference the commands you mentioned. You can find it here: How to repair the EFI bootloader on a GPT HDD for Windows 7, 8, 8.1 and 10 on your Dell PC | Dell US

It's provided by Dell and its a tutorial for people in need of recovery so it is bound to be of a decent quality, I'd say it is pretty damn good of them to have made that article considering I'd say its high-quality. It is clear and straight to the point, I doubt it would be too complicated for even an "sort of" beginner to follow it.

 

[Deleted member 65228]

Petya actually encrypted the partition, I'm not sure if the command can repair GPT drive or not
definitely not able when MBR drive is encrypted

Petya encrypts the Master File Table (MFT) which is used to locate files on the disk.

GPT HDD also has an Master Boot Record (for backwards compatibility support). If you get hit with Petya and are using GPT then the Master Boot Record will be overwritten as well as the GPT data followed after the 512 bytes for the Master Boot Record, so it affects GPT as well. So literally the data for the GPT partition located after the backwards compatible MBR will be gone, poof...

So you're right about recovery AFAIK

 

[ZeroDay]

Some great info on this thread now.

 

[Deleted member 65228]

Some great info on this thread now.

Thanks to you The post you made earlier blew me away, seriously. I wasn't expecting to read something so magnificent (of course I agreed with you 100% haha). It crept up on me like a powerful zero-day which could not be stopped!

 

[Deleted member 65228]

So, if we encrypt the boot partition ourselves, petya or other ransomware won't be able to encrypt it since it would first need to decrypt it from our encryption?

The only way is to block it from accessing in the first place for write

 

[Deleted member 65228]

Isn't this what encryption does? No one has access to the encrypted thing unless they can decrypt it? Based on your answer I'd say no, but I still wonder

Nope

Encryption will prevent someone from comprehending the data, it won't prevent them from accessing it. For example, a secure web-based service will not store passwords for user accounts in plain text-form within the database/s, instead they'll encrypt the credentials. Now if an attacker manages to gain access to these credentials, they'll be unable to actually make use of the data to understand what the real credentials are to make use of them, without being able to decrypt them.

In the case of encryption for what you are talking about, the malware simply will not care. It doesn't identify if something is encrypted or not and then decide whether to go ahead. Let's say you could do what you are thinking, it'd just be affected twice. Once by yourself and a second time by the malware. Now you'd have to decrypt the encryption performed by the malware before you can make use of your own private key to decrypt the original which you had encrypted.

For ransomware threats like Petya, NotPetya and BadRabbit, if you block access to the Master Boot Record then it'll fail to deploy that part of the payload. Hopefully, the security would just auto-quarantine when this attempt is made, to prevent alternate payloads being executed should any be supported if the boot sector hijacking fails. For example, some ransomware will attempt to alter the boot sector and if this fails then it'll go ahead and try to do something else like encrypt all the user documents it can (Rombertik does this - so if you're using MBRFilter and get hit with that ransomware variant, your system will boot without needing MBR recovery but your files will be a good-bye without a backup although with Petya variants if the MBR hijacking succeeds you have a tougher problem than just recovering the MBR due to the MFT encryption which is performed by the Petya boot-loader).

You will find some ransomware (as an example) which will be unable to identify files which would have been encrypted should they be encrypted already (e.g. third-party software). This is a common scenario when the encryption software you applied makes it impossible for the caller querying and reading details about the currently found file which is encrypted to determine whether the file is of the correct extension to be applied for encryption (since third-party encryption software would be masking the PE File Format, and if they change the extension then other file formats for media and so on will also be better-protected). This isn't always the case though because some malware simply won't care and will just encrypt = double encryption now.