2

Assume a USB drive has an MBR or GPT that has malware in it. I already understand that booting from such a USB device would execute the malware as part of the bootloader. If I understand correctly, if a clean computer was booted into a traditional OS (macOS, Windows 10, Ubuntu, etcetera) and then the infected device was inserted then the OS would not execute code but would still see the MBR or GPT.

Is it correct that

A: an infected MBR or GPT introduced to a clean, already-running OS would have no malicious effect at that time...

And B: would have to remain inserted during a reboot (and be the booted device called by the BIOS) in order to have a malicious effect?

Please note that this question is limited in scope and does not pertain to the firmware layer of the USB drive, nor to the data on its data partition. IMO those questions should be handled discreetly, not conflated.

  • I suppose there could be vulnerabilities in code that handles the reading of such things, but this is just speculation. – multithr3at3d Dec 10 '18 at 0:12
  • @multithr3at3d So in general, if the OS is handling things as intended then no code in the GPT/MBR would execute? – MasterOfNone Dec 10 '18 at 0:16
1

For classical boot-sector viruses, generally no. Those require execution of actual code embedded in the boot sector (which happens to coincide with the partition table in MBR arrangements, but not in GPT configurations), and no sane OS executes code from the boot sector of removable media.

There is at least one notable exception to this though, the Amiga Rigid Disk Block (RDB) partition table format can embed filesystem drivers in the partition table itself, so it is theoretically possible for malware to be spread that way, though it's extremely unlikely (it would only work on systems running AmigaOS or compatible operating systems, and the market for such malware is nearly nonexistent).

There's a relatively small but still present chance however that the OS itself may have a bug in the parsing of the partition table that would eventually allow for an ACE exploit that could be used to infect the system. For an MBR, this is extremely unlikely, the format has been around for decades, is a fixed size, and is trivial to parse. For GPT, it's a bit more likely, as the GPT structure is variably sized (though it's rare to see one that isn't the standard 128 entries). Other partition table formats would have varying probabilities, but probably don't matter much anymore today.

  • Thanks! The Amiga RDB thing is a surprising and good catch to the question! Quick question, in GPT where IS the boot sector? I thought it was part of the GPT just like the MBR. – MasterOfNone Dec 11 '18 at 1:22
  • For GPT it depends on if you're using UEFI or a legacy boot mode. For UEFI, there is no boot sector, instead there's a dedicated partition that contains the bootloader as a regular executable which gets loaded by the firmware. For legacy boot modes, there's a special 'BIOS Boot Partition' which contains the code that would be in the boot sector, together with a bit of code in the protective MBR that finds and jumps to this code. – Austin Hemmelgarn Dec 11 '18 at 1:24
  • Oh, interesting! But for the purposes of the original question, a "normal" OS acting as intended would not execute code in either case, correct? It only has to do with BIOS settings which are relevant at system boot. – MasterOfNone Dec 11 '18 at 12:26
  • As a general rule, yes, there wouldn't be any code executed from the context of a normal OS. – Austin Hemmelgarn Dec 11 '18 at 12:45

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.