Assume a USB drive has an MBR or GPT that has malware in it. I already understand that booting from such a USB device would execute the malware as part of the bootloader. If I understand correctly, if a clean computer was booted into a traditional OS (macOS, Windows 10, Ubuntu, etcetera) and then the infected device was inserted then the OS would not execute code but would still see the MBR or GPT.

Is it correct that

A: an infected MBR or GPT introduced to a clean, already-running OS would have no malicious effect at that time...

And B: would have to remain inserted during a reboot (and be the booted device called by the BIOS) in order to have a malicious effect?

Please note that this question is limited in scope and does not pertain to the firmware layer of the USB drive, nor to the data on its data partition. IMO those questions should be handled discreetly, not conflated.

  • I suppose there could be vulnerabilities in code that handles the reading of such things, but this is just speculation. Commented Dec 10, 2018 at 0:12
  • @multithr3at3d So in general, if the OS is handling things as intended then no code in the GPT/MBR would execute? Commented Dec 10, 2018 at 0:16

1 Answer 1


For classical boot-sector viruses, generally no. Those require execution of actual code embedded in the boot sector (which happens to coincide with the partition table in MBR arrangements, but not in GPT configurations), and no sane OS executes code from the boot sector of removable media.

There is at least one notable exception to this though, the Amiga Rigid Disk Block (RDB) partition table format can embed filesystem drivers in the partition table itself, so it is theoretically possible for malware to be spread that way, though it's extremely unlikely (it would only work on systems running AmigaOS or compatible operating systems, and the market for such malware is nearly nonexistent).

There's a relatively small but still present chance however that the OS itself may have a bug in the parsing of the partition table that would eventually allow for an ACE exploit that could be used to infect the system. For an MBR, this is extremely unlikely, the format has been around for decades, is a fixed size, and is trivial to parse. For GPT, it's a bit more likely, as the GPT structure is variably sized (though it's rare to see one that isn't the standard 128 entries). Other partition table formats would have varying probabilities, but probably don't matter much anymore today.

  • Thanks! The Amiga RDB thing is a surprising and good catch to the question! Quick question, in GPT where IS the boot sector? I thought it was part of the GPT just like the MBR. Commented Dec 11, 2018 at 1:22
  • For GPT it depends on if you're using UEFI or a legacy boot mode. For UEFI, there is no boot sector, instead there's a dedicated partition that contains the bootloader as a regular executable which gets loaded by the firmware. For legacy boot modes, there's a special 'BIOS Boot Partition' which contains the code that would be in the boot sector, together with a bit of code in the protective MBR that finds and jumps to this code. Commented Dec 11, 2018 at 1:24
  • Oh, interesting! But for the purposes of the original question, a "normal" OS acting as intended would not execute code in either case, correct? It only has to do with BIOS settings which are relevant at system boot. Commented Dec 11, 2018 at 12:26
  • As a general rule, yes, there wouldn't be any code executed from the context of a normal OS. Commented Dec 11, 2018 at 12:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .