1

I use Ubuntu 16.04. After I mounted an ISO which may or may not have had malware in it, my system sometimes ends up showing a blank screen after logging into Ubuntu or reboots a minute or two after I log into Ubuntu or like today, when it reached the Grub screen and rebooted. Then it reached the Grub screen and rebooted again. The third time I reached the Grub screen and the countdown for automatic selection of OS was counting down from 25 seconds. This was unusual because I had set the countdown to 10 seconds. I disconnected my smart-phone from the USB port of the computer, hard-rebooted again, and this time the Grub countdown was at 10 seconds and no problem happened.

I've had my phone connected like this to the computer for two months and I've not observed any odd behaviour, so I'm ruling out that the Android phone could be the cause. However, since the Grub timeout was at 25 seconds, I was wondering if there could be a malware that installs its own GRUB and randomly chooses to boot from it, thereby granting itself root privileges in some way.

Is this possible or am I just being paranoid?

P.S. I should also mention that this problem of the computer restarting used to happen three months ago, which I think is approximately the time I mounted the same ISO file in Ubuntu. I had wiped the hard disk and reinstalled the OS suspecting an infection. But I thought the infection might have come from a pen drive I inserted into a friend's computer. It's only now I suspect that the restarts could be related to that ISO.

1

The basics of the boot process

First, you need to know how a bootloader works. When the system first starts up and the BIOS is in charge, it initializes all the devices necessary for boot. It then reads the CMOS to find out the correct device to boot from. It opens the first device, and reads the first 512 byte sector (where the MBR should be installed) into memory. Specifically, it transfers the first sector to physical address 0x7c00. If the last two bytes of the sector are 0x55aa, it considers it a valid bootsector, and executes it. At this point, the BIOS is out of the picture, and the MBR is executing. The MBR is far too small to boot most systems, so instead it boots the second stage of the bootloader. All it has to do is be able to locate and execute some data on the hard drive containing the rest of the bootloader. In this case, the core GRUB modules. At this point, GRUB is fully functional and does all its magic to load your kernel and start the operating system boot process. Now, how can malware hijack this?

Hijacking the process

If malware wants to modify your boot process to randomly make you boot with malicious code in play, it can do one of a few things. In order of increasing levels of sophistication and stealth:

  • It can modify the second stage bootloader or its configuration directly, so when it is executed, it changes its behavior at random, performing malicious actions during some boots.

  • It can modify the MBR at the first sector on the bootable drive to, at random, choose to load a different second stage bootloader. The different second stage would inject malicious code.

  • It could modify your BIOS so it loads a different, malicious MBR for some boots. This is more difficult to pull off, but it is possible. BIOS infections are quite rare.

  • It could modify the hard drive firmware to return malicious data in the first sector randomly. This would require a very high level of expertise, and is exceedingly rare (virtually unheard of).

The displayed symptoms

But here's the important question... Are the symptoms you are describing indicative of any of the above scenarios? Let's look at the symptoms as you described them, one by one:

  • Your bootloader counted down from 25 seconds, despite you having set the timeout lower.

  • Your Ubuntu installation occasionally has a blank screen after you log in, or randomly reboots.

  • It rebooted itself without you commanding it to do so when it loaded GRUB.

Are these symptoms of a bootkit? No. The first issue is most likely a configuration issue. Every update, your Ubuntu installation updates the GRUB configuration file. The configuration file is very complex and has a large number of conditional statements. It would not be surprising if your settings are occasionally overwritten. The second issue just sounds like a bug in Ubuntu. Perhaps a driver for your hardware is buggy. I had an old Ubuntu system that did something similar. An update fixed it. Your third issue sounds like a bug in GRUB, or perhaps a hardware fault. All you are experiencing is the bugginess of software. As bugs are still annoying, you could try reinstalling GRUB, or resetting the configuration. Perhaps look online to see if there are any known errata for your software. Check your system logs to see if it is reporting an application crashing that may lead to the blank screen. And, of course, make sure you are up to date, so you get all the latest bug fixes for your setup.

Malware wants to be stealthy. It doesn't want its presence to be found out. Malware that is good enough to hijack your boot process will be very stealthy, and won't give away its existence through something as tantalizingly simple as a spontaneous crash. So no, this is not malware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.