MBRFilter: new tool by Talos to protect MBR

 

To help combat ransomware that attempts to modify the MBR, Talos has released a new tool to the open source community, MBRFilter, a driver that allows the MBR to be placed into a read-only mode, preventing malicious software from writing to or modifying the contents of this section of the storage device.

http://blogs.cisco.com/security/talos/mbrfilter-cant-touch-this

You can also read an article by Lawrence Abrams aka Grinler here Testing MBRFilter against Ransomware that modify the Master Boot Record

The only concerning thing i have is how simple it is to remove so im assuming the malware writers will just create a registry removal routine and then reboot, on reboot it will start encrypting.

The only concerning thing i have is how simple it is to remove so im assuming the malware writers will just create a registry removal routine and then reboot, on reboot it will start encrypting.

Update: 10/20/2016 - MBRFilter has been intentionally made difficult to remove to prevent malware from simply disabling or removing this protection during the infection process. Test thoroughly before deploying within production environments.

from Cisco Talos Blog: MBRFilter - Can't Touch This!

Im talking about this

To remove MBRFilter, follow these steps:

- Remove the line MBRFilter from the UpperFilters registry key in (only
remove MBRFilter, there might be other disk drivers here):

HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}

- Reboot

 

The only concerning thing i have is how simple it is to remove so im assuming the malware writers will just create a registry removal routine and then reboot, on reboot it will start encrypting.

You could use the registry removal routine to remove the reg key and not force a reboot and just wait till the owner reboots and start encrypting, This way the owner is none the wiser.

PS

Hey Jammer long time no see.

Edited by NickAu, 24 October 2016 - 10:51 PM.

 

 

The only concerning thing i have is how simple it is to remove so im assuming the malware writers will just create a registry removal routine and then reboot, on reboot it will start encrypting.

You could use the registry removal routine to remove the reg key and not force a reboot and just wait till the owner reboots and start encrypting, This way the owner is none the wiser.

 

PS

Hey Jammer long time no see.

 

Hey mate.

yes i just thought you could remove the registry key and be done with it, im assuming also removing the .sys file would help as well.

Good point. Keep in mind, however, that if there are problems caused by the driver, it is very important to have an easy way to uninstall it. (You could probably do it in the Recovery Environment?). I'm sure the authors will update MBRFilter in the future, once it is stable.