Cisco’s Talos research team has open sourced MBRFilter, a tool that aims to prevent a system’s Master Boot Record (MBR) getting overwritten by malware.
The latest malware families that use this tactic are HDDCryptor (aka Mamba) and Petya, two pieces of ransomware that not only encrypt victims’ files, but also effectively lock them out of their computer by overwriting the MBR.
What is the MBR?
The Master Boot Record is a boot sector located at the beginning of partitioned computer mass storage devices, and contains information about the storage devices’ partitions and file systems, as well as a loader for the operating system installed on the computer.
Messing with it can mess up the entire system.
How does the MBRFilter prevent this from happening?
“MBRFilter is a simple disk filter based on Microsoft’s diskperf and classpnp example drivers,” researchers Edmund Brumaghin and Yves Younan explained.
MBRFilter works by allowing the MBR to be placed into a read-only mode. It’s easy to use – just install it and reboot the system, and it’s ready to do its work.
To be clear, the tool just does that one thing, and won’t stop most ransomware from encrypting files found on the target system (although it did crash Petya in the demonstration).