bootkit threats: in-depth reverse engineering & defense
DESCRIPTION
Although bootkit technology isn’t new, it plays an important role nowadays in attack scenarios against the Microsoft Windows 64-bit platform. Currently more and more sophisticated threats rely on bootkit components to bypass OS security mechanisms and load kernel-mode driver into the system by stealth. Such notorious in-the-wild threats like Win64/Olmarik (TDL4), Win64/Olmasco (MaxSS) and Win64/Rovnix employ bootkit technology so as to be loaded before the operating system is and, thus, are able to bypass Microsoft’s Kernel-Mode Code Signing Policy.In this presentation we are going to perform in-depth, low-level reverse engineering of the latest modification of the Win64/Rovnix bootkit. The malware is chosen in preference to others due to its noteworthy implementation details (tracing the OS bootloader and kernel, for instance) and its somewhat unusual approach to installing the bootkit component in the system – that is, patching OS bootstrap code. We will start with an overview of bootkit design principles: main modules, their interconnection with each other, ways to receive control before OS kernel and which hooks are necessary to setup in a preboot environment in order to disable security mechanisms so as to be able to load a payload module. We will also enumerate major obstacles that bootkit have to deal with to successfully stay active in the system until the payload receives control. Furthermore, we will concentrate on Win64/Rovnix bootkit implementation details, namely: infected VBR layout, tracing the OS kernel using debugging registers, surviving execution mode switching and loading a kernel-mode driver into system address space. We will look at the OS boot loader and kernel internals that are abused by the bootkit. There will be some live demos of debugging Win64/Rovnix with the disassembler IDA Pro and the Bochs emulator. In the end of the talk, some bootkit prevention techniques are considered. We will analyze implementation details of new features appearing in the Windows 8 operating system such as Secure Boot and the early anti-malware launch module, which are intended to protect the system from bootkit threats.TRANSCRIPT
![Page 1: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/1.jpg)
Bootkit Threats:
In Depth Reverse Engineering & Defense
Eugene Rodionov
Aleksandr Matrosov
![Page 2: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/2.jpg)
Outline of The Presentation
Bootkit technology
Why? How?
Bootkit design principles
Architecture
Analysis instrumentation
Rovnix bootkit in-depth analysis
Infected VBR analysis
Infection strategy
Bootkit remediation techniques
![Page 3: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/3.jpg)
Bootkit technology
![Page 4: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/4.jpg)
Bootkit evolution over time
o Bootkit PoC evolution:
eEye Bootroot (2005)
Vbootkit (2007)
Vbootkit v2 (2009)
Stoned Bootkit (2009)
Evilcore x64 (2011)
o Bootkit Threats evolution:
Win32/Mebroot (2007)
Win32/Mebratix (2008)
Win32/Mebroot v2 (2009)
Win64/Olmarik (2010/11)
Win64/Olmasco (2011)
Win64/Rovnix (2011/2012)
![Page 5: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/5.jpg)
Why?
Why there is a return to bootkit technology nowadays
Microsoft kernel-mode code signing policy
• loading unsigned kernel-mode driver
High level of stealth
• there are no malicious files in the file system
High degree of survival
• difficult to detect and remove
Ability to disable security software • the malware is launched before security software
![Page 6: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/6.jpg)
How?
Bootkits in the wild: Infecting:
MBR (Master Boot Record)
VBR (Volume Boot Record)
Proof of Concept Bootkits: Infecting UEFI
![Page 7: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/7.jpg)
Bootkit design principles
![Page 8: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/8.jpg)
Boot process
Description of OS boot process:
real mode protected mode
with paging
protected mode without paging
BIOS initialization
BIOS interface
MBR VBR bootmgr
bootmgr interface
winload.exeKernel
initialization
![Page 9: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/9.jpg)
Bootkit Architecture
• Performing malicious activities
•Hooking system routines, maintaining hidden storage and injecting payload
• Locating & loading driver
• Locating & loading loader code
Starter Loader
Payload Driver
![Page 10: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/10.jpg)
Injecting Payload
Injection approach
APC routines
Patching entry point of the
executable
Bootkit hidden storage
Kernel-mode driver
Process1 Process2 Process3 ProcessN
Payload1 Payload2 Payload3 PayloadN
Payload1 Payload2 Payload3 PayloadN
kernel-mode
user-mode
![Page 11: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/11.jpg)
Hidden Storage Architecture
Malicious kernel-mode driver
Malware payload
File system interface
Physical storage interface
Hard drive
OS File system driver
OS storage device driver stack
Hidden FS area
Applications
kernel-mode address space
user-mode address space
![Page 12: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/12.jpg)
Bootkit Analysis Instrumentation
![Page 13: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/13.jpg)
Debugging bootkit with Bochs
./configure --enable-debugger
![Page 14: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/14.jpg)
Debugging bootkit with Bochs
Bochs internal debugger interface
Bochs Core
CPU
devices
memoryOperation
System
IDA Pro debugger
![Page 15: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/15.jpg)
LIVE DEMO
![Page 16: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/16.jpg)
Rovnix Reverse Engineering
![Page 17: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/17.jpg)
![Page 18: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/18.jpg)
![Page 19: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/19.jpg)
![Page 20: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/20.jpg)
![Page 21: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/21.jpg)
Interesting Carberp sample (October 2011)
![Page 22: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/22.jpg)
Interesting Carberp sample (October 2011)
![Page 23: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/23.jpg)
functionality Rovnix.A Carberp with bootkit Rovnix.B
VBR modification
polymorphic VBR
Malware driver storage
Driver encryption algorithm
custom (ROR + XOR)
custom (ROR + XOR)
custom (ROR + XOR)
Hidden file system
FAT16 modification
FAT16 modification
File system encryption algorithm
RC6 modification
RC6 modification
Rovnix Kit Hidden File Systems Comparison
![Page 24: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/24.jpg)
Rovnix Architecture
Dropper
Infected VBR
Kernel-mode driver x86
Payload x86
Kernel-mode driver x64
Payload x64
![Page 25: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/25.jpg)
Installation Into the System
Check administrative privileges
Check OS version
Locate free space on the hard drive to store kernel-mode driver & hidden FS image
Store the driver & hidden FS image in the located area.
Overwrite bootstrap code of the active partition with malicious one
![Page 26: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/26.jpg)
Callgraph of Bootkit Installation Routine
![Page 27: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/27.jpg)
VBR Code Information
VBR is responsible for loading OS boot components (bootmgr, BCD, etc.).
JMP
[3 b]
Extended BPB (EBPB)
[48 b]
Signature
[2 b]
Boot Code
[426 b]
OEM ID
[8 b]
BIOS Parameter Block (BPB)
[25 b]
NTFS Boot Sector (Volume Boot Record)
Bootstrap code (IPL)VBR
NTFS bootstrap code(15 sectors)
1 sector
Partition data
![Page 28: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/28.jpg)
Rovnix Polymorphic VBR
Polymorphic decryptor
Encrypted malicious
VBR
Compressed original
VBR
Polymorphic decryptor
Basic block 1
Basic block 2
Basic block 3
Basic block N
... ...
![Page 29: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/29.jpg)
Rovnix Polymorphic VBR
Polymorphic decryptor
Encrypted malicious
VBR
Compressed original
VBR
Polymorphic decryptor
Basic block 1
Basic block 2
Basic block 3
Basic block N
... ...
![Page 30: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/30.jpg)
Decrypted VBR code
Decompress & Restore Original VBR
continue normal boot process
Hook BIOS int 15h handler
intercept memory map requests protect its memory location
Hook BIOS int 13h handler
intercept hard drive I/O requests patch bootmgr system module
![Page 31: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/31.jpg)
Hooking BIOS int 15h Handler
Used by operating system to
query system address map.
Abused by malicious VBR to
protect its memory region from
allocation by OS
System memory
Interrupt vectorsInt 15h handler address
Malicious VBR
Int 13h handler address
Protected memory
![Page 32: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/32.jpg)
Surviving Execution Mode Switching
To be able to survive processor execution mode
switching the malware: detects execution mode switching operation in bootmgr
patches bootmgr right before switching into protected mode
copies itself over the last half of IDT (which isn’t used by OS)
![Page 33: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/33.jpg)
Surviving Execution Mode Switching
To be able to survive processor execution mode
switching the malware: detects execution mode switching operation in bootmgr
patches bootmgr right before switching into protected mode
copies itself over the last half of IDT (which isn’t used by OS)
![Page 34: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/34.jpg)
Surviving Execution Mode Switching
To be able to survive processor execution mode
switching the malware: detects execution mode switching operation in bootmgr
patches bootmgr right before switching into protected mode
copies itself over the last half of IDT (which isn’t used by OS)
![Page 35: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/35.jpg)
Surviving Execution Mode Switching
To be able to survive processor execution mode
switching the malware: detects execution mode switching operation in bootmgr
patches bootmgr right before switching into protected mode
copies itself over the last half of IDT (which isn’t used by OS)
![Page 36: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/36.jpg)
Loading Kernel-mode Driver
To be able to load unsigned kernel-mode driver Rovnix:
• Waits until kernel-mode memory manager is properly initialized:
Sets up hardware breakpoint
• Allocates memory buffer in kernel-mode address space to store the
driver:
Calls BlAllocateAlignedDescriptor system routine to allocate memory
buffer
• Inserts corresponding structure in BootDriverList of KeLoaderBlock.
The driver receives control during boot start drivers initialization
![Page 37: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/37.jpg)
LIVE DEMO
![Page 38: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/38.jpg)
Hidden Storage Layout
• Rovnix bootkit employs modification of FAT16 for hidden partition
• Hidden partition & kernel-mode driver are written either:
before first partition on the disk – if there is more than 2000 (1 Mb)
free sectors
In the end of the hard drive otherwise
MBR VBR Bootstrap Code File System Data
VBRMalicious
CodeFile System Data
Bootstrap Code
MBR
NTFS bootstrap code(15 sectors)
Before Infecting
After InfectingCompressedData
Hidden Partition
Malicious Unsigned
Driver
![Page 39: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/39.jpg)
Hidden Storage Layout
• Rovnix bootkit employs modification of FAT16 for hidden partition
• Hidden partition & kernel-mode driver are written either:
before first partition on the disk – if there is more than 2000 (1 Mb)
free sectors
In the end of the hard drive otherwise
MBR VBR Bootstrap Code File System Data
VBRMalicious
CodeFile System Data
Bootstrap Code
MBR
NTFS bootstrap code(15 sectors)
Before Infecting
After InfectingCompressedData
Hidden Partition
Malicious Unsigned
Driver
![Page 40: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/40.jpg)
\Device\Harddisk0\DR0
Lowest device object
Attached to
Attached to
...
Storage miniport driver object
DriverObject
MajorFunction
IRP_MJ_INTERNAL_DEVICE_CONTROL
Self-defense Mechanisms
To be able to protect VBR & Hidden file system Rovnix bootkit hooks
IRP_MJ_INTERNAL_DEVICE_CONTROL handler:
![Page 41: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/41.jpg)
\Device\Harddisk0\DR0
Lowest device object
Attached to
Attached to
...
Storage miniport driver object
DriverObject
MajorFunction
IRP_MJ_INTERNAL_DEVICE_CONTROL
Self-defense Mechanisms
To be able to protect VBR & Hidden file system Rovnix bootkit hooks
IRP_MJ_INTERNAL_DEVICE_CONTROL handler:
![Page 42: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/42.jpg)
Hidden File System Reader
![Page 43: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/43.jpg)
Hidden File System Reader
![Page 44: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/44.jpg)
LIVE DEMO
![Page 45: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/45.jpg)
Bootkit countermeasures
![Page 46: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/46.jpg)
Problem Description
Untrusted platform problem:
real mode protected mode
with paging
protected mode without paging
BIOS initialization
BIOS interface
MBR VBR bootmgr
bootmgr interface
winload.exeKernel
initialization
Bootmgr OS loader OS kernel
dependencies
OS kernel
Boot-start drivers
Non boot-start kernel-mode drivers
Pre boot firmware
Point of Attack
![Page 47: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/47.jpg)
Bootkits & GPT Disks
There is no MBR & VBR code which is executed in GPT disks
Bootkits in-the-wild aren’t applicable to GPT disks
Protective MBR
Primary GUID partition Table
Primary GUID partitions
Backup GUID partition Table
Primary GUID Partition Table Header
GUID Partition entry 1
GUID Partition entry 1
GUID Partition entry 1
GUID Partition entry 1
GUID Partition entry 1...
GUID Partition Table Entry
Partition type GUID
Unique partition GUID
First LBA
Last LBA
Attributes flags
Partition name
![Page 48: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/48.jpg)
Bootkits & GPT Disks
UEFI Firmware
UEFI Boot Manager
Windows Boot Manager (bootmgr.efi)
Windows OS Loader (winload.efi)
OS Kernel (ntoskrnl.exe)
![Page 49: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/49.jpg)
Windows 8 Security Features
Security enhancements introduced in Windows 8:
• Secure boot technology
Employing UEFI secure boot in conjunction with TPM
• Early anti-malware launch module
Allows antimalware software start before any other third-
party components
![Page 50: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/50.jpg)
Secure Boot
Secure boot prevents running an unknown OS loader:
UEFI will verify OS loader
The key for verification is stored inside TPM
Trust anchorTrust anchor
Bootmgr OS loader OS kernel
dependencies
OS kernel
Boot-start drivers
Non boot-start kernel-mode drivers
UEFI
TPM
![Page 51: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/51.jpg)
Early antimalware launch module
Antimalware component receives control before any
other third-party software at boot time.
Windows OS loader
Kernel initialization
Early antimalware
module
Third-party drivers
![Page 52: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/52.jpg)
Conclusion Bootkit technology allows malware to load unsigned kernel-mode
driver and achieve high degree of stealth in the system
The main target of bootkit infection are MBR & VBR
Rovnix is a first known bootkit infecting VBR
The most interesting features of the latest modification of Rovnix
bootkit are:
Polymorphic infected VBR
Hidden Storage
There are additional security features introduced in Windows 8 OS:
Early antimalware launch module
Secure Boot
![Page 53: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/53.jpg)
References
Rovnix Reloaded: new step of evolution http://blog.eset.com/2012/02/22/rovnix-reloaded-new-step-of-evolution
TDL4 reloaded: Purple Haze all in my brain http://blog.eset.com/2012/02/02/tdl4-reloaded-purple-haze-all-in-my-brain
Bootkit Threat Evolution in 2011 http://blog.eset.com/2012/01/03/bootkit-threat-evolution-in-2011-2
The Evolution of TDL: Conquering x64 http://go.eset.com/us/resources/white-papers/The_Evolution_of_TDL.pdf
Modern bootkit trends: bypassing kernel-mode signing policy http://www.virusbtn.com/conference/vb2011/abstracts/LastMinute1.xml
King of Spam: Festi botnet analysis http://blog.eset.com/2012/05/11/king-of-spam-festi-botnet-analysis
![Page 55: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/55.jpg)
![Page 56: Bootkit threats: in-depth reverse engineering & defense](https://reader033.vdocuments.net/reader033/viewer/2022050906/5538910d55034680358b47ca/html5/thumbnails/56.jpg)
Thank you for your attention!
Aleksandr Matrosov [email protected] @matrosov
Eugene Rodionov [email protected] @vxradius