Stoned déjà vu - again

The Stoned Bootkit is back! 1987, 2009, 2010! After following the mentality of the original Stoned virus there is now the second version of the Stoned Bootkit, attacking now 64-bit Windows and Linux (still under development).

Peter Kleissner, Software Dev. Guru in Vienna 

Your PC is now Stoned! ..again

Open source is a development method for software that harnesses the power of distributed peer review and transparency of process. The promise of open source is better quality, higher reliability, more flexibility, lower cost, and an end to predatory vendor lock-in.

http://www.stoned-bootkit.info/ - Main site (this site, redirects here)
http://de.wikipedia.org/wiki/Stoned_(Computervirus) - Stoned (Computervirus)
http://sourceforge.net/projects/bootkit

I continued where I stopped at Black Hat - discussing now the extended features and the usage of the bootkit. The presentation itself is lightweight, this means at this time I focused the presentation more on my talk rather than on the slides. All the technical information are written down in the paper.

Compiling and testing

The source of the Stoned Bootkit is available via the sourceforge svn repository. You can also browse the source online. If you want to compile the bootkit, read "Stoned v2 Introduction.txt", and you need following programs installed:

Press statement - removed project from sourceforge

On January 31, 2010 the entire project was removed from sourceforge.net due to:

  • Abuse of the code
  • SourceForge #fail of censorship in Iran, North Korea, Syria, Sudan and Cuba
  • Fail of Kaspersky and local law enforcements

It is the magic of open source that makes us to publish our software as open source. 

The Stoned Bootkit is developed accordingly to the AG_OnlineDurchsuchung_Endbericht.pdf:
  Page 13: Verhinderung der Fremdnutzung: Expiration dates, customized encryption keys
  Page 13: Verhinderung der Nachahmung: Encryption, AV Tracker 2
You can get a copy of the document at http://www.stoned-bootkit.info/downloads/AG_OnlineDurchsuchung_Endbericht.pdf.

Press statement: Whistler Bootkit ain't Stoned Bootkit (20.03.2010)

Time ago allvirusthanks.org blogged about a 'Whistler Bootkit' and while they failed to censor the pictures, there's no reason to worry about. I published the Stoned Bootkit as open source to all developers to harness the power of distributed peer review and transparency of process. The Stoned Bootkit was published for months at SourceForge, because I believe in open source. Instead of taking advantage of the bootkit technology, I decided to talk about it open and presented it at Black Hat, Hacking at Random and DeepSec. The Stoned Bootkit is not criminal and its usage is not illegal, it's just an open source unsigned code loader. Even if Kaspersky thinks it would capture electromagnetic signals.

The source of Whistler Bootkit was just simply "stolen" from SourceForge from Stoned Bootkit in January (this is why I removed it from SF too). I have not tried to sell it, and let immediately remove the forum entry of opensc.ws. The Stoned Bootkit 2 source code is not for sale to anyone. Also this http://www.w32whistler.com/ fake website has nothing to do with the Stoned Bootkit.

Anti-Bootkit

There is a nice Anti-Bootkit program available at http://ebfes.wordpress.com/. You can boot it from Floppy and CD and you view the hashes of the MBR and display the hex dump. Unfortunately it doesn't seem to provide a 'directly boot the OS' feature or a 'restore default MBR' feature. I tried to contact the author, but so far there is no response.

The project is available as source (no specific license), written by a German guy and is written in Assembler. That project has quite some potential, there may be some cool features for the future like detecting bootkits based on signatures and heuristics, removing them, displaying information about them etc. Sinowal (Mebroot) for example stores the MBR backup on unpartitioned space and also its configuration there, so the C&C server URL could be extracted from there (it's stored as plain text).

You can download this Anti-Bootkit (including the source) under http://ebfe.de.vu/antibootkit/release085.zip


^ Top
Last modified: 4 May 2010

Previous page: The Rise of MBR Rootkits & Bootkits in the Wild