Hello and welcome to another
application of the minor attack
framework discussion today
we're going to be looking at boot
kit or boot kits.
So what are the objectives
of today's discussion?
Well, again, pretty straightforward.
First, we're going to describe what
boot kits are, how they
can be used.
So mitigation techniques.
And then, of course, we're going to
finish out with detection techniques
now moving
over to boot kits, a boot kit
is malware, OK?
That modifies the boot sector
of a hard drive impacting
areas such as the
master boot record and
the volume boot record.
Now, this is a persistance
mechanism that exists below the
operating system, and these
types of tools are typically
difficult to remediate.
And so just an example of some boot
kits or things like rock boot and
boot rash. And now
I've had the pleasure
of having to clean up boot
kits in the past and things of that
nature. And there are tools out
there that will assist
in doing pre boot scans
and pre boot cleanup.
Now, it's not always a guarantee
that it's going to completely get
the root cause of the
system.
And so you may run into
an instance where you have to
completely clean
out the system, maybe reflash a few
things, reinstall
that kind of boot order, do things
of that nature just to ensure
that you get the infection
completely off of the system.
Because, again, this isn't something
that's in the operating system.
It is something that persists
prior to the loading of the
operating system.
So looking at some
instances, touching on both
Ember and TVB are components.
So changes to the
master boot record a
threat and can make changes to the
number, which is
the section of the disk, of course,
that is first loaded after
completion of hardware initiation
by the BIOS.
This can result in the third act of
diverting normal startup execution
to malicious code.
Now same but different
with the VEBER
or the volume boot record,
the NBER passes control
of the boot process to the VEBER.
And again, much like that, the
adversary in this case diverts
execution during startup
to malicious code.
And so again, that's what makes this
very difficult to take care
of and very difficult to clean up
because you're working with an
environment that is pre
operating system reboot.
Now let's talk about some mitigation
techniques for
boot kits.
So utilize some form of boot
integrity, use something like
a TPM chip or trusted platform
module and essentially
a trusted boot process.
And so if you disable TPM,
maybe you want to run
dual boot. I know in some cases you
may have to disable
or use legacy boot or if you're
trying to boot from media or
something of that nature that
changes the integrity of that boot
order or the way that the system
boots can
result in you having to disable
this process.
And so if you have to for
troubleshooting or changes or
things that, you know, are for
business purpose and then good
ensure that you revert those changes
and implement everything back to the
way it was prior to those those
either changes to the boot order
or the way that the system boots
so that in the future you don't get
something that can take advantage of
that and then ensure that at least
privilege is properly implemented
within the environment to make
the job of installing a boot kit
harder for the threat.
Actor again,
Lisse privilege is a commonality
between all of the discussions that
we have and in some form or fashion
liste privilege can be used
to reduce the capabilities of what
the threat after is able to achieve
or able to do, at least in that
instance. So if they're using
automated tools and
they're not directly engaging with
the system in that tool is limited
to user permissions,
then, you know, that could
again reduce the impact to maybe
just a few system folders.
Maybe it doesn't get into the boot
record if you're dealing with
something like ransomware or
something of that nature.
But it's central to permissions
and things of that nature.
And we've seen where, you know, it
may only get a few folders instead
of the entire network.
So, again, we'll talk about
least privilege over and over again
because of the importance that it
plays in protecting systems and
mitigating some risks there.
Now, detection techniques,
the recommendation here is to
perform checks on the master boot
record or the volume boot
record.
So what you would do is essentially
have kind of like a golden image or
the standard for the organization
for those areas.
You would do some maybe hashes or
check some things of that nature
and then you would compare those
checks to a known
good sample. So you would take.
Your system has
the particular areas or check the
particular areas, and
then you would compare that
information against
the known good sample.
And so in this case, changes to
either should be reported and
reviewed.
Now, this is,
of course, something that you can do
to combat these types of threats if
they are going to be real for your
organization, especially if
other mitigating factors are not in
place like these privilege or
if you let's just say,
have a sales team that is wide open
as far as being able to use laptops
in any way, shape or form that they
see fit, you could run into
these types of issues.
And so this could be beneficial.
But in my experience,
and I'm just speaking transparently
here, I'm not run into an
organization
that was doing some
form of regular
integrity checks on
Bhoot records and things of that
nature. Now, that may be different
from person to person, but
in my experience, I have not come
across an organization that is a
part of their security posture
and risk mitigation techniques
was using this.
But that doesn't mean that it's not
something you should implement if
you have a need.
Now, let's do a quick check on
learning.
True or false, a boot kit
is used for cleaning or taking care
of boot issues on a system.
All right, well, if you need some
additional time, please take a
moment to pause the video.
And if you want to go back and
review the information, you're
welcome to a boot kit
is used for cleaning or taking care
of food issues on a system.
So first off, this is convincing,
but a boot kit in this case
is malicious.
And so it is not used for cleaning
or taking care of boot issues on a
system.
Quite the contrary, it is
the reason that we would be
cleaning or trying to diagnose
boot issues on the system.
So it is definitely malicious.
So this is a false
statement.
So with that in mind, let's go ahead
and jump over to the summary for
today's discussion.
So we described what boot kits
are. Again, these are
pieces of malware, either as
a part of a malware package that
is establishing persistence
for the threat actor by manipulating
and taking advantage of
the boot record,
either the master boot record, the
volume boot record right before
that operating system loads up, its
executing or putting malicious code
into the system to be used by
the threat actor.
Now, when we looked at mitigation
techniques, we looked
at things such as, again,
privilege and ensuring that those
things are taken care of there.
And that, of course, would not
allow malware and things of that
nature to run if it
needed administrative privilege to
make those modifications, as
well as looking at trusted
platform modules or having systems
with teams in place, TPM chips
so that the boot
record cannot be manipulated as long
as those things are in place.
Now, I've seen again where you can
disable those and you may have
business reason for doing so.
Just know that this does open you up
to manipulation of the boot record.
And then we looked at some detection
techniques. Again,
somewhat hard to implement in
practice if you don't have
the scope or the personnel to
do so.
But taking a known good hash of
a boot record and
then comparing that to suspected
systems that maybe have been
tampered with or have issues would
definitely be something that
you can do in these cases.
So with that in mind, I want to
thank you for your time today, and I
look forward to seeing you again
soon.