// Ebfe's Anti-B00TKIT Project

The “Ebfe's Anti-B00TKIT Project” is a simple but effective protection against Bootkits, suitable for daily usage. It makes it possible to know if your bootloader was manipulated before booting from disk. A really interesting tool for high-security environments and paranoid persons. :-P

Bootkits1) are used to attack a full disk encryption2) (amongst other things). All “common” data is encrypted on such systems except a small, “special” part: the bootloader. Expressed in simplified terms, the bootloader is needed to store a program which prompts the user for the password to decipher the data and start the encrypted operating system. Bootkits are trying to manipulate the bootloader, making it possible to log the password the user enters and store it within the unencrypted part of the disk afterwards. The user does not see this, he simply gets the normal encryption password promt to start the system. This enables the attacker to come back later to read out the plain, unencrypted password the bootkit stored for him.

Ebfe's Anti-B00TKIT provides a CD to boot from before booting from disk. The program on CD reads out the Master Boot Record entries and displays their checksums (this does only need a few seconds). If all checksums are OK, you can going on to boot from disk by pressing a key. If the checksums are not the same as every day, your harddisk's bootloader was manipulated. To make this check more comfortable, you can create a custom CD containing your original MBR checksums. The CD is able to highlight non-matching checksums automatically then.

Visit the project website for screenshots, how-to and download.

1)
for example the Stoned Bootkit on MS Windows
2)
e.g. LUKS on Ubuntu or TrueCrypt on Windows

Comments

[…] 2010:08:18:ebfe-anti-bootkit - blog.andreas-haerter.com - IT, web and nerdy stuff […]

Leave a comment…




  • E-Mail address will not be published.
  • Formatting:
    //italic//  __underlined__
    **bold**  ''preformatted''
  • Links:
    [[http://example.com]]
    [[http://example.com|Link Text]]
  • Quotation:
    > This is a quote. Don't forget the space in front of the text: "> "
  • Code:
    <code>This is unspecific source code</code>
    <code [lang]>This is specifc [lang] code</code>
    <code php><?php echo 'example'; ?></code>
    Available: html, css, javascript, bash, cpp, …
  • Lists:
    Indent your text by two spaces and use a * for
    each unordered list item or a - for ordered ones.
I'm no native speaker (English)
Please let me know if you find any errors (I want to improve my English skills). Thank you!
QR Code: URL of current page
QR Code: URL of current page 2010:08:18:ebfe-anti-bootkit (generated for current page)