Please use this identifier to cite or link to this item:
A Universal Windows Bootkit: An Analysis of the MBR Bootkit "HDRoot"
|Title:||A Universal Windows Bootkit: An Analysis of the MBR Bootkit "HDRoot"|
|Issue Date:||04 Jan 2017|
|Abstract:||In October, 2015 Kaspersky released an analysis of the bootkit “HDRoot”. Their analysis highlighted mistakes in the bootkit, which made it ineffective at performing its task. Upon attempts to replicate that analysis however, it appears that these conclusions were in error and the bootkit works with any Windows version in the last 16 years. HDRoot represents a serious commitment in time and effort to develop, and an in-depth analysis reveals the work of a significantly capable threat actor. The sample analyzed here dates to 2013, and is the same sample Kasperky reports to have analyzed in their post. However, all evidence points to Kaspersky performing analysis with a 2006 sample, likely the reason for their conclusions. Additionally, mistakes made in reporting the capability of offensive software, provided without means to verify, hurt the security industry by misleading practitioners and limiting their ability for informed decision making.|
|Rights:||Attribution-NonCommercial-NoDerivatives 4.0 International|
|Appears in Collections:||Deception, Digital Forensics, and Malware Minitrack|
Items in ScholarSpace are protected by copyright, with all rights reserved, unless otherwise indicated.