WEBVTT

1
00:00:00.040 --> 00:00:03.439
<v Speaker 1>All right, So today we're going deep into root kits

2
00:00:03.439 --> 00:00:07.519
<v Speaker 1>and boot kits. Oh yeah, and into fun stuff, fun stuff, right,

3
00:00:07.519 --> 00:00:09.080
<v Speaker 1>We're not just going to talk about what they are,

4
00:00:09.119 --> 00:00:11.679
<v Speaker 1>but how they actually work. You know, those sneaky tricks

5
00:00:11.679 --> 00:00:14.240
<v Speaker 1>they use, the kind of damage they can do. We've

6
00:00:14.240 --> 00:00:16.760
<v Speaker 1>got a whole stack of research here. Oh nice, some

7
00:00:16.960 --> 00:00:22.480
<v Speaker 1>real deep dives into some specific malware examples. Awesome, Ready

8
00:00:22.480 --> 00:00:23.199
<v Speaker 1>to get technical?

9
00:00:23.559 --> 00:00:27.519
<v Speaker 2>Absolutely, I think we'll be able to break down these

10
00:00:27.559 --> 00:00:31.600
<v Speaker 2>complex concepts, make sure you walk away knowing what the

11
00:00:31.679 --> 00:00:34.679
<v Speaker 2>key takeaways are, and maybe even throw in some surprises

12
00:00:34.719 --> 00:00:35.320
<v Speaker 2>along the way.

13
00:00:36.679 --> 00:00:40.399
<v Speaker 1>I like surprises. So imagine this. You boot up your computer.

14
00:00:42.600 --> 00:00:48.359
<v Speaker 1>Everything seems fine, But hiding just beneath the surface is

15
00:00:48.359 --> 00:00:53.240
<v Speaker 1>a root kit, a program silently pulling the strings. Maybe

16
00:00:53.240 --> 00:00:57.840
<v Speaker 1>it's stealing your data. Yeah, maybe it's giving someone else control.

17
00:00:58.560 --> 00:01:03.679
<v Speaker 1>Pretty creepy. But that's just the start. We're going even deeper, okay,

18
00:01:03.719 --> 00:01:04.760
<v Speaker 1>into bootkits.

19
00:01:04.879 --> 00:01:08.840
<v Speaker 2>All right. So bootkits, yeah, these take control at an

20
00:01:08.840 --> 00:01:13.680
<v Speaker 2>even earlier stage. Oh wow, infecting the very process that

21
00:01:13.760 --> 00:01:16.959
<v Speaker 2>starts your computer. Okay, you can think of it like this,

22
00:01:17.760 --> 00:01:22.159
<v Speaker 2>someone changing the locks on your house before you even

23
00:01:22.239 --> 00:01:22.640
<v Speaker 2>move in.

24
00:01:22.799 --> 00:01:25.439
<v Speaker 1>Oh that's sneaky, right, So how do they pull this off? Yeah,

25
00:01:25.560 --> 00:01:29.319
<v Speaker 1>let's start with rootkits okay, using a real world example, right,

26
00:01:29.359 --> 00:01:33.640
<v Speaker 1>TDL three. TDL three, this thing was a master of disguise,

27
00:01:34.200 --> 00:01:38.760
<v Speaker 1>hiding deep within the operating system. Our sources dig into

28
00:01:38.840 --> 00:01:42.879
<v Speaker 1>how it targeted those bootstar drivers, right, the ones that

29
00:01:43.000 --> 00:01:44.519
<v Speaker 1>load when your computer starts up.

30
00:01:44.599 --> 00:01:47.359
<v Speaker 2>Makes sense. Yeah, what's fascinating about TDL three is that

31
00:01:47.400 --> 00:01:50.040
<v Speaker 2>it didn't just like disable these drivers or block them.

32
00:01:50.439 --> 00:01:55.439
<v Speaker 2>It actually modified their code. Oh where imagine a spy, okay,

33
00:01:55.439 --> 00:01:59.239
<v Speaker 2>slipping a secret message into a courier's bag without them

34
00:01:59.319 --> 00:01:59.959
<v Speaker 2>ever noticed.

35
00:02:00.200 --> 00:02:03.120
<v Speaker 1>Oh that's a good analogy. But how does it change

36
00:02:03.159 --> 00:02:06.480
<v Speaker 1>the code without setting off any alarms? It seems like

37
00:02:06.480 --> 00:02:07.680
<v Speaker 1>it'd be pretty hard to pull off.

38
00:02:08.159 --> 00:02:12.919
<v Speaker 2>So TDL three uses this technique called hooking, And essentially

39
00:02:12.960 --> 00:02:16.919
<v Speaker 2>what it does is it intercepts specific commands going to

40
00:02:16.960 --> 00:02:21.479
<v Speaker 2>the operating system and redirects them to its own malicious code.

41
00:02:21.680 --> 00:02:24.199
<v Speaker 1>So it's like setting up a detour on a busy road.

42
00:02:24.599 --> 00:02:27.800
<v Speaker 2>Yeah, thing of it like that, it's redirecting traffic.

43
00:02:27.960 --> 00:02:31.199
<v Speaker 1>So it's hijacking those commands before the operating system can

44
00:02:31.240 --> 00:02:33.240
<v Speaker 1>even see them exactly. Oh wow.

45
00:02:33.319 --> 00:02:36.719
<v Speaker 2>And TDL three was actually very strategic about where it

46
00:02:36.800 --> 00:02:40.840
<v Speaker 2>placed these detours, so it actually targeted the software that

47
00:02:41.120 --> 00:02:44.759
<v Speaker 2>controlled your hard drive, and it was intercepting those read

48
00:02:44.800 --> 00:02:48.479
<v Speaker 2>and write operations at a very low level, which allowed

49
00:02:48.520 --> 00:02:52.240
<v Speaker 2>it to hide from any security software that was operating

50
00:02:52.240 --> 00:02:53.120
<v Speaker 2>at a higher level.

51
00:02:53.520 --> 00:02:56.400
<v Speaker 1>So if security software is trying to scan for problems,

52
00:02:57.560 --> 00:03:00.599
<v Speaker 1>TDL three has already manipulated things behind the scenes, right,

53
00:03:00.919 --> 00:03:04.360
<v Speaker 1>and the scanner just sees normal activity exactly. Wow, that's

54
00:03:04.400 --> 00:03:06.280
<v Speaker 1>not all. There's more, Okay.

55
00:03:06.280 --> 00:03:10.199
<v Speaker 2>TDL three didn't just hide itself. It created its own

56
00:03:10.280 --> 00:03:11.360
<v Speaker 2>hidden file system.

57
00:03:11.639 --> 00:03:13.680
<v Speaker 1>Wait a minute, a secret.

58
00:03:13.319 --> 00:03:15.319
<v Speaker 2>File system, Yeah, you can think of it like that.

59
00:03:15.439 --> 00:03:19.000
<v Speaker 1>So it's not enough to just hide the malicious code itself.

60
00:03:19.439 --> 00:03:22.479
<v Speaker 1>It needs a whole secret storage space pretty much. What's

61
00:03:22.520 --> 00:03:23.199
<v Speaker 1>the advantage of that.

62
00:03:23.360 --> 00:03:27.560
<v Speaker 2>So this hidden file system, it's essentially a separate encrypted

63
00:03:27.599 --> 00:03:31.280
<v Speaker 2>area on the hard drive. This is where TDL three

64
00:03:31.439 --> 00:03:35.759
<v Speaker 2>kept all of its configuration files okay, malicious payloads and

65
00:03:35.800 --> 00:03:40.360
<v Speaker 2>even stolen data, oh, completely invisible to the operating system

66
00:03:40.960 --> 00:03:44.000
<v Speaker 2>and any security software scanning for problems.

67
00:03:44.000 --> 00:03:45.599
<v Speaker 1>So it's like having a secret room in your house.

68
00:03:45.680 --> 00:03:47.879
<v Speaker 1>You get it that only you know how to access.

69
00:03:47.639 --> 00:03:51.680
<v Speaker 2>Exactly, And This technique, pioneered by TDL three, has since

70
00:03:51.719 --> 00:03:55.479
<v Speaker 2>been adopted by other sophisticated threats. Okay, it really speaks

71
00:03:55.520 --> 00:03:59.360
<v Speaker 2>to how these rootkits are evolving and constantly upping their

72
00:03:59.439 --> 00:04:02.599
<v Speaker 2>game right in terms of evasion and concealment.

73
00:04:02.719 --> 00:04:06.000
<v Speaker 1>Speaking of evolution, our sources also dig into another roode

74
00:04:06.039 --> 00:04:11.080
<v Speaker 1>kit called FESTI. Oh festy, This one seems almost paranoid

75
00:04:11.159 --> 00:04:16.160
<v Speaker 1>in its efforts to avoid detection. Yeah, like really security conscious. Yeah.

76
00:04:16.160 --> 00:04:19.759
<v Speaker 2>Festi is a fascinating case. It had this modular design,

77
00:04:20.120 --> 00:04:24.959
<v Speaker 2>which means it was super flexible, adaptable. Attackers could easily

78
00:04:25.000 --> 00:04:28.720
<v Speaker 2>add new functionality by plugging in new modules. Okay, but

79
00:04:28.800 --> 00:04:32.040
<v Speaker 2>what really stands out is it's anti virtual machine.

80
00:04:31.639 --> 00:04:34.800
<v Speaker 1>Tricks anti virtual machine? What's that all about?

81
00:04:35.079 --> 00:04:41.399
<v Speaker 2>So security researchers they often use virtual machines to analyze

82
00:04:41.399 --> 00:04:45.959
<v Speaker 2>malware in a safe environment. Festi was designed to actually

83
00:04:46.000 --> 00:04:48.560
<v Speaker 2>detect if it was running inside a virtual machine.

84
00:04:48.720 --> 00:04:48.920
<v Speaker 1>Wow.

85
00:04:49.120 --> 00:04:51.879
<v Speaker 2>And if it was, it would essentially shut down to

86
00:04:51.959 --> 00:04:53.360
<v Speaker 2>avoid being analyzed.

87
00:04:53.600 --> 00:04:57.319
<v Speaker 1>So it's trying to outsmart the security researchers. Yeah, that's

88
00:04:57.319 --> 00:04:59.480
<v Speaker 1>pretty clever it is. How does it even know it's

89
00:04:59.480 --> 00:05:00.720
<v Speaker 1>in virtual machine?

90
00:05:00.920 --> 00:05:03.639
<v Speaker 2>So it looks for clues Okay. Think of it like

91
00:05:03.839 --> 00:05:07.639
<v Speaker 2>Neo from the Matrix, suddenly realizing that things aren't quite

92
00:05:07.639 --> 00:05:11.879
<v Speaker 2>as they seem. So it checks for specific software components

93
00:05:12.240 --> 00:05:16.360
<v Speaker 2>hardware characteristics that are unique to virtual machines.

94
00:05:16.639 --> 00:05:16.959
<v Speaker 1>Okay.

95
00:05:17.000 --> 00:05:21.199
<v Speaker 2>If it finds any of these telltale signs, it assumes

96
00:05:21.240 --> 00:05:24.959
<v Speaker 2>it's in a hostile environment and just ceases operations.

97
00:05:25.120 --> 00:05:29.160
<v Speaker 1>Wow. Talk about security conscious. But Festi's tricks don't stop there.

98
00:05:29.319 --> 00:05:29.879
<v Speaker 2>Oh no.

99
00:05:30.399 --> 00:05:32.759
<v Speaker 1>It also had a very clever way of hiding its

100
00:05:32.800 --> 00:05:34.920
<v Speaker 1>malicious driver on the hard drive.

101
00:05:35.279 --> 00:05:39.879
<v Speaker 2>Remember how TDL three targeted that storage driver stack to

102
00:05:40.040 --> 00:05:43.560
<v Speaker 2>intercept commands. Yeah, FESTI took it a step further by

103
00:05:43.560 --> 00:05:46.639
<v Speaker 2>actually hooking into the filesystem driver itself.

104
00:05:46.759 --> 00:05:47.319
<v Speaker 1>Oh wow.

105
00:05:47.439 --> 00:05:49.920
<v Speaker 2>This gave it even more control over what was visible

106
00:05:49.959 --> 00:05:50.639
<v Speaker 2>on the hard drive.

107
00:05:50.959 --> 00:05:54.519
<v Speaker 1>So it's manipulating the operating system's own file management system

108
00:05:54.519 --> 00:05:56.639
<v Speaker 1>to protect itself exactly. Wow.

109
00:05:56.879 --> 00:06:01.000
<v Speaker 2>And it would constantly monitor network traffic looking for signs

110
00:06:01.000 --> 00:06:05.480
<v Speaker 2>of security software. If it detected anything suspicious, it would

111
00:06:05.480 --> 00:06:06.519
<v Speaker 2>again go into hiding.

112
00:06:06.639 --> 00:06:09.439
<v Speaker 1>Oh my god. Yeah, FESTI was playing a serious game

113
00:06:09.480 --> 00:06:14.120
<v Speaker 1>of hide and seek. Absolutely, But even Festi's complexity pales

114
00:06:14.160 --> 00:06:17.680
<v Speaker 1>in comparison to bootkits kids, which operate at an even

115
00:06:17.800 --> 00:06:18.480
<v Speaker 1>deeper level.

116
00:06:18.560 --> 00:06:23.079
<v Speaker 2>Yeah. Remember root kits, they work within the operating system.

117
00:06:23.560 --> 00:06:26.439
<v Speaker 2>Boot kits infect the boot process itself.

118
00:06:26.680 --> 00:06:30.720
<v Speaker 1>Right, that's where things get really interesting. Yeah, bootkits hijacking

119
00:06:30.800 --> 00:06:36.199
<v Speaker 1>the startup process, taking control before the operating system even loads,

120
00:06:36.920 --> 00:06:39.639
<v Speaker 1>like rewriting the rule book before the game even starts.

121
00:06:40.040 --> 00:06:43.519
<v Speaker 1>But to really understand how they do this, we need

122
00:06:43.560 --> 00:06:45.800
<v Speaker 1>to delve into the boot process itself.

123
00:06:45.519 --> 00:06:48.319
<v Speaker 2>Exactly, and that means starting with the master boot Record

124
00:06:48.399 --> 00:06:51.480
<v Speaker 2>or MBR. Okay, it's the very first sector on your

125
00:06:51.519 --> 00:06:55.279
<v Speaker 2>hard drive, and it contains the code that kicks off

126
00:06:55.319 --> 00:06:58.360
<v Speaker 2>the whole process of loading the operating system.

127
00:06:58.519 --> 00:07:00.439
<v Speaker 1>So if the operating system is like the engine of

128
00:07:00.439 --> 00:07:04.399
<v Speaker 1>your computer, uh huh, the NBR is the ignition.

129
00:07:04.120 --> 00:07:08.120
<v Speaker 2>Switch a perfect analogy. It's the first piece of code that.

130
00:07:08.040 --> 00:07:11.680
<v Speaker 1>Gets executed when you turn on your computer, and boot

131
00:07:11.759 --> 00:07:16.560
<v Speaker 1>kits can actually infect the MBR. Oh wow, replacing that

132
00:07:16.680 --> 00:07:20.040
<v Speaker 1>legitimate boot code with their own malicious code.

133
00:07:20.199 --> 00:07:22.720
<v Speaker 2>So they're taking control right from the start, right from

134
00:07:22.759 --> 00:07:26.920
<v Speaker 2>the very beginning. That's some serious low level hacking, it is.

135
00:07:27.160 --> 00:07:31.160
<v Speaker 2>But wait, didn't we talk about another boot component, the VBR.

136
00:07:31.079 --> 00:07:32.120
<v Speaker 1>The Volume boot record?

137
00:07:32.160 --> 00:07:32.920
<v Speaker 2>Where does that fit in?

138
00:07:33.120 --> 00:07:36.319
<v Speaker 1>So that comes into play after the NBRK. Think of

139
00:07:36.360 --> 00:07:40.199
<v Speaker 1>it like this. The NBR points to the VBR, which

140
00:07:40.199 --> 00:07:44.279
<v Speaker 1>then points to the operating system. It's a chain of events.

141
00:07:43.920 --> 00:07:47.199
<v Speaker 2>And bootkits can target any point in that chain to

142
00:07:47.240 --> 00:07:48.720
<v Speaker 2>gain control exactly.

143
00:07:48.959 --> 00:07:51.639
<v Speaker 1>Oh wow, But there's one more crucial component we need

144
00:07:51.680 --> 00:07:56.040
<v Speaker 1>to talk about, okay, and that's the Boot Configuration Data

145
00:07:56.160 --> 00:07:56.800
<v Speaker 1>or BCD.

146
00:07:57.399 --> 00:07:57.560
<v Speaker 2>Right.

147
00:07:57.639 --> 00:08:01.319
<v Speaker 1>It's basically a settings file for the boot process. Okay,

148
00:08:01.399 --> 00:08:04.839
<v Speaker 1>and guess what, right, boot kits can manipulate that BCD

149
00:08:05.519 --> 00:08:07.920
<v Speaker 1>to disable security features or.

150
00:08:07.920 --> 00:08:12.160
<v Speaker 2>Even redirect the boot process to their own malicious code.

151
00:08:12.240 --> 00:08:14.800
<v Speaker 1>So it's like they're not just hijacking the car, they're

152
00:08:14.800 --> 00:08:17.160
<v Speaker 1>also disabling the alarm system exactly.

153
00:08:18.000 --> 00:08:21.480
<v Speaker 2>And to really understand how all of this works in practice, okay,

154
00:08:21.600 --> 00:08:24.399
<v Speaker 2>let's look at a specific example, TDL four.

155
00:08:24.600 --> 00:08:26.759
<v Speaker 1>TDL four the successor.

156
00:08:26.240 --> 00:08:29.480
<v Speaker 2>To the TDL three rootkit we discussed earlier.

157
00:08:29.879 --> 00:08:31.759
<v Speaker 1>Okay, so it sounds like they just decided to stick

158
00:08:31.800 --> 00:08:34.799
<v Speaker 1>with what works, right. So what's TDL four's tactic.

159
00:08:35.080 --> 00:08:40.440
<v Speaker 2>So TDL four actually exploits of vulnerability, a weakness in

160
00:08:40.519 --> 00:08:44.600
<v Speaker 2>the Windows Task Scheduler service. This allows it to gain

161
00:08:44.840 --> 00:08:47.039
<v Speaker 2>administrative privileges on the system.

162
00:08:47.240 --> 00:08:49.080
<v Speaker 1>Oh so, like the keys to the kingdom.

163
00:08:49.320 --> 00:08:50.320
<v Speaker 2>Yeah, you could say that.

164
00:08:50.559 --> 00:08:50.799
<v Speaker 1>Okay.

165
00:08:50.919 --> 00:08:55.960
<v Speaker 2>Once it has those privileges, TDL four can modify the MBR,

166
00:08:56.960 --> 00:09:01.159
<v Speaker 2>replacing the legitimate boot code with its own. Yeah. So

167
00:09:01.240 --> 00:09:04.519
<v Speaker 2>this allows it to load its own malicious code during

168
00:09:04.559 --> 00:09:08.600
<v Speaker 2>that boot process, effectively taking control before the operating system

169
00:09:08.759 --> 00:09:09.919
<v Speaker 2>and has a chance to start.

170
00:09:10.159 --> 00:09:16.279
<v Speaker 1>So TDL four gets administrative privileges through a vulnerability and

171
00:09:16.320 --> 00:09:19.840
<v Speaker 1>then modifies the NBR to load its own code. Right,

172
00:09:20.000 --> 00:09:21.639
<v Speaker 1>But what does it do once it's in control?

173
00:09:21.840 --> 00:09:24.879
<v Speaker 2>Well, one of its main goals is to disable security

174
00:09:24.919 --> 00:09:28.120
<v Speaker 2>features that could detect it or remove it. Makes sense,

175
00:09:28.320 --> 00:09:32.799
<v Speaker 2>and it does this by manipulating the boot configuration data

176
00:09:32.919 --> 00:09:36.240
<v Speaker 2>or BCD that we talked about earlier. It disables things

177
00:09:36.320 --> 00:09:41.480
<v Speaker 2>like safe mode, oh wow, driver's signature enforcement, effectively crippling

178
00:09:41.600 --> 00:09:42.759
<v Speaker 2>the system's defaces.

179
00:09:43.200 --> 00:09:47.159
<v Speaker 1>So it's not just hijacking the boot process, it's sabotaging

180
00:09:47.200 --> 00:09:49.679
<v Speaker 1>the security system precisely. Oh my goodness.

181
00:09:49.720 --> 00:09:53.039
<v Speaker 2>And to make matters worse, oh no, TDL four also

182
00:09:53.159 --> 00:09:57.679
<v Speaker 2>infects the VBR, providing a backup infection mechanism.

183
00:09:57.240 --> 00:10:00.240
<v Speaker 1>So if one part of its attack is removed, it

184
00:10:00.279 --> 00:10:03.879
<v Speaker 1>has another way to maintain control exactly double trouble. Ye,

185
00:10:04.159 --> 00:10:06.799
<v Speaker 1>are all bootkits this sophisticated.

186
00:10:06.320 --> 00:10:11.279
<v Speaker 2>Not necessarily. Some take a much simplier approach, lying on

187
00:10:11.399 --> 00:10:14.279
<v Speaker 2>directly modifying the NBR or the VBR.

188
00:10:14.639 --> 00:10:16.320
<v Speaker 1>Without exploiting vulnerabilities.

189
00:10:16.360 --> 00:10:18.480
<v Speaker 2>Really, how is that even possible?

190
00:10:18.639 --> 00:10:22.559
<v Speaker 1>Well, in the early days of bootkits, some operating systems

191
00:10:23.039 --> 00:10:27.960
<v Speaker 1>didn't really have strong security measures in place to protect

192
00:10:28.000 --> 00:10:31.440
<v Speaker 1>the boot process. It was actually relatively easy to slip

193
00:10:31.440 --> 00:10:32.799
<v Speaker 1>in unnoticed.

194
00:10:32.879 --> 00:10:33.440
<v Speaker 2>Oh wow.

195
00:10:33.879 --> 00:10:38.600
<v Speaker 1>But as security has improved, bootkits have had to evolve, right,

196
00:10:38.840 --> 00:10:43.360
<v Speaker 1>and that's where we see techniques like exploiting vulnerabilities becoming

197
00:10:43.399 --> 00:10:43.919
<v Speaker 1>more common.

198
00:10:44.000 --> 00:10:46.720
<v Speaker 2>It's a constant arms race, isn't it. It is always

199
00:10:46.720 --> 00:10:51.240
<v Speaker 2>trying to stay one step ahead. But speaking of evolving tactics,

200
00:10:52.039 --> 00:10:56.879
<v Speaker 2>our sources highlight a particularly interesting variant of TDL four

201
00:10:57.159 --> 00:11:01.240
<v Speaker 2>okay called ol Moscow ol Moscow. It took a different

202
00:11:01.240 --> 00:11:03.120
<v Speaker 2>approach to NBR infection.

203
00:11:03.600 --> 00:11:07.000
<v Speaker 1>So ol Moscow is interesting because it modifies the NBR

204
00:11:07.240 --> 00:11:08.159
<v Speaker 1>partition table.

205
00:11:08.399 --> 00:11:11.039
<v Speaker 2>The partition table, Yeah, remind me what that is again.

206
00:11:11.159 --> 00:11:13.240
<v Speaker 1>To think of your hard drive like a filing cabinet

207
00:11:13.480 --> 00:11:16.360
<v Speaker 1>with multiple drawers. The partition table.

208
00:11:16.639 --> 00:11:20.639
<v Speaker 2>Is like the label that tells you what each drawer contains.

209
00:11:21.240 --> 00:11:25.200
<v Speaker 2>It defines how your hard drive is divided into partitions,

210
00:11:25.440 --> 00:11:28.360
<v Speaker 2>like your C drive, your D drive and so on.

211
00:11:28.440 --> 00:11:32.240
<v Speaker 1>Okay, so ol Moscow messes with these labels, Ah, how

212
00:11:32.279 --> 00:11:33.600
<v Speaker 1>does that help it take over?

213
00:11:34.120 --> 00:11:38.120
<v Speaker 2>So instead of modifying the NBR code itself, Oh, Moscow

214
00:11:38.200 --> 00:11:41.759
<v Speaker 2>creates a hidden partition on the hard drive, like a

215
00:11:41.799 --> 00:11:46.759
<v Speaker 2>secret drawer, and then modifies that partition table to point

216
00:11:46.840 --> 00:11:50.600
<v Speaker 2>to this hidden partition during the boot process.

217
00:11:50.759 --> 00:11:54.320
<v Speaker 1>So it's like creating a secret compartment and then tricking

218
00:11:54.360 --> 00:11:58.240
<v Speaker 1>the system into booting from that compartment. Exactly. Wow.

219
00:11:58.360 --> 00:12:02.480
<v Speaker 2>And this hidden partition, uh huh contains all Mascow's malicious

220
00:12:02.519 --> 00:12:06.240
<v Speaker 2>code okay, which then gets loaded, giving it control of

221
00:12:06.279 --> 00:12:06.759
<v Speaker 2>the system.

222
00:12:07.000 --> 00:12:10.000
<v Speaker 1>That's incredibly sneaky, it is, why go through all this trouble.

223
00:12:10.399 --> 00:12:12.799
<v Speaker 1>Why not just modify the NBR code directly?

224
00:12:12.879 --> 00:12:17.480
<v Speaker 2>It's all about evading detection. By modifying the partition table

225
00:12:18.200 --> 00:12:22.159
<v Speaker 2>instead of that MBR code, Well, Moscow is less likely

226
00:12:22.240 --> 00:12:26.399
<v Speaker 2>to be detected by security software looking for those specific

227
00:12:27.200 --> 00:12:28.639
<v Speaker 2>MBR modifications.

228
00:12:28.840 --> 00:12:30.159
<v Speaker 1>It's a stealthier approach.

229
00:12:30.279 --> 00:12:30.799
<v Speaker 2>Exactly.

230
00:12:31.000 --> 00:12:31.519
<v Speaker 1>Oh my god.

231
00:12:31.639 --> 00:12:36.679
<v Speaker 2>And this highlights an important point. Bootkits are constantly evolving,

232
00:12:37.080 --> 00:12:42.360
<v Speaker 2>becoming more sophisticated more evasive, always looking for new ways

233
00:12:42.960 --> 00:12:48.480
<v Speaker 2>to bypass security measures and gain control of the boot.

234
00:12:48.200 --> 00:12:50.840
<v Speaker 1>Process, like in Never Evening Cat and Mouse kit. It is,

235
00:12:51.240 --> 00:12:53.519
<v Speaker 1>but our sources point out that boot kits don't always

236
00:12:53.559 --> 00:12:56.919
<v Speaker 1>target the NBR. Some of them go after the VBR instead.

237
00:12:57.000 --> 00:13:01.720
<v Speaker 2>You're absolutely right, and in fact out to explore two

238
00:13:01.919 --> 00:13:06.440
<v Speaker 2>fascinating bootkits that target the VBR, Rovnicks and gaps.

239
00:13:06.519 --> 00:13:10.240
<v Speaker 1>Ooh, this sounds juicy, it is. Let's dive into these

240
00:13:10.240 --> 00:13:11.759
<v Speaker 1>stealthy VBR infectors.

241
00:13:11.879 --> 00:13:13.919
<v Speaker 2>Let's do it. So we left off talking about those

242
00:13:13.960 --> 00:13:17.159
<v Speaker 2>bootkits that target the volume boot record or the VBR.

243
00:13:17.320 --> 00:13:19.279
<v Speaker 1>Right, those stealthy VBR infectors.

244
00:13:19.480 --> 00:13:22.799
<v Speaker 2>You're ready to unpack some specific examples, absolutely all right,

245
00:13:22.840 --> 00:13:25.399
<v Speaker 2>So let's start with rovnicks. Okay, Well it makes this

246
00:13:25.480 --> 00:13:26.279
<v Speaker 2>one stand out?

247
00:13:26.399 --> 00:13:27.519
<v Speaker 1>Yeah? What makes it special?

248
00:13:27.840 --> 00:13:30.320
<v Speaker 2>Well, romnicks is fascinating for a few reasons.

249
00:13:30.399 --> 00:13:31.000
<v Speaker 1>Okay.

250
00:13:31.039 --> 00:13:35.320
<v Speaker 2>It uses this technique called VBRIPL.

251
00:13:34.399 --> 00:13:39.759
<v Speaker 1>Infection VBRIPL infection. Yeah, okay, I'm intrigued, but lost. Okay,

252
00:13:39.799 --> 00:13:40.679
<v Speaker 1>break that down for me.

253
00:13:40.919 --> 00:13:44.399
<v Speaker 2>So IPL stands for initial Program Loader, okay, and it's

254
00:13:44.440 --> 00:13:48.200
<v Speaker 2>the code within the VBR that's responsible for loading the

255
00:13:48.240 --> 00:13:53.919
<v Speaker 2>operating system kernel. Right, Rovnicks infects the IPL, replacing that

256
00:13:54.120 --> 00:13:56.840
<v Speaker 2>legitimate code with its own malicious code.

257
00:13:56.879 --> 00:13:58.960
<v Speaker 1>So it's taking control right from the get go.

258
00:13:59.159 --> 00:14:00.480
<v Speaker 2>Yeah, right from the very beginning.

259
00:14:00.639 --> 00:14:01.039
<v Speaker 1>Wow.

260
00:14:01.240 --> 00:14:02.960
<v Speaker 2>But Romnicks doesn't stop there.

261
00:14:03.080 --> 00:14:03.399
<v Speaker 1>Oh no.

262
00:14:03.519 --> 00:14:05.799
<v Speaker 2>It also creates a hidden partition on the.

263
00:14:05.759 --> 00:14:07.799
<v Speaker 1>Hard drive, another secret compartment.

264
00:14:07.960 --> 00:14:11.200
<v Speaker 2>Yeah, they love their hidden spaces, they do. This hidden

265
00:14:11.240 --> 00:14:14.360
<v Speaker 2>partition is where it stores its malicious code and other data.

266
00:14:14.519 --> 00:14:14.799
<v Speaker 1>Okay.

267
00:14:15.159 --> 00:14:18.200
<v Speaker 2>Then during the boot process, it modifies the VBR to

268
00:14:18.320 --> 00:14:19.799
<v Speaker 2>point to this hidden partition.

269
00:14:20.159 --> 00:14:20.600
<v Speaker 1>Oh wow.

270
00:14:20.679 --> 00:14:24.000
<v Speaker 2>So it's like redirecting the train to a secret underground

271
00:14:24.000 --> 00:14:26.759
<v Speaker 2>station before it can reach its destination precisely.

272
00:14:26.799 --> 00:14:29.519
<v Speaker 1>And this hidden station contains a modified IPL.

273
00:14:29.639 --> 00:14:30.240
<v Speaker 2>Uh huh.

274
00:14:30.279 --> 00:14:33.519
<v Speaker 1>But this ALPL is not there to help. Oh, it's

275
00:14:33.639 --> 00:14:37.600
<v Speaker 1>carefully crafted by Rovnicks to load the boot kit's own

276
00:14:38.080 --> 00:14:39.639
<v Speaker 1>malicious kernel mode driver.

277
00:14:39.960 --> 00:14:41.960
<v Speaker 2>Hang on, a kernel mode driver. Didn't we talk about

278
00:14:41.960 --> 00:14:44.639
<v Speaker 2>those with root kits, right? What are the implications of that?

279
00:14:45.120 --> 00:14:48.720
<v Speaker 1>So they operate at the very core of the operating system, right,

280
00:14:48.879 --> 00:14:53.039
<v Speaker 1>with very high privileges. Okay, And by loading its own

281
00:14:53.240 --> 00:14:59.080
<v Speaker 1>malicious kernel mode driver, Ravnicks gains deep control over the system.

282
00:14:59.320 --> 00:15:03.360
<v Speaker 2>So it's not hijacking the boot process. It's also like

283
00:15:03.519 --> 00:15:05.639
<v Speaker 2>installing its own agent deep within.

284
00:15:05.480 --> 00:15:07.159
<v Speaker 1>The operating system. Exactly.

285
00:15:07.320 --> 00:15:08.759
<v Speaker 2>Oh my gosh, this is starting to sound like a

286
00:15:08.799 --> 00:15:09.559
<v Speaker 2>spy thriller.

287
00:15:09.720 --> 00:15:11.600
<v Speaker 1>It does, a little bit, doesn't it. It does. But

288
00:15:11.759 --> 00:15:14.080
<v Speaker 1>Romnicks's stealth techniques go even further.

289
00:15:14.279 --> 00:15:15.240
<v Speaker 2>Okay, I'm hooked.

290
00:15:15.360 --> 00:15:17.720
<v Speaker 1>What else? What other tricks does it have up its sleep?

291
00:15:17.879 --> 00:15:18.279
<v Speaker 2>Yeah?

292
00:15:18.440 --> 00:15:23.519
<v Speaker 1>One fascinating technique is its use of debugging registers.

293
00:15:23.519 --> 00:15:27.639
<v Speaker 2>Debugging registers. Yeah, those sound like something developers use to

294
00:15:27.720 --> 00:15:29.600
<v Speaker 2>find and fix bugs in software.

295
00:15:30.000 --> 00:15:33.720
<v Speaker 1>You're exactly right, But Rovnicks cleverly abuses them for its

296
00:15:33.799 --> 00:15:34.600
<v Speaker 1>own purposes.

297
00:15:34.679 --> 00:15:35.519
<v Speaker 2>So how does it do that?

298
00:15:36.440 --> 00:15:41.039
<v Speaker 1>So, debugging registers allow you to set break points in code,

299
00:15:42.000 --> 00:15:46.039
<v Speaker 1>points where execution will pause, allowing you to inspect what's happening.

300
00:15:46.080 --> 00:15:47.840
<v Speaker 2>So it's like setting a trap to catch a bug

301
00:15:47.879 --> 00:15:48.399
<v Speaker 2>in the act.

302
00:15:48.600 --> 00:15:52.559
<v Speaker 1>Exactly. Okay, And Romnicks uses debugging registers to set break

303
00:15:52.639 --> 00:15:57.639
<v Speaker 1>points in critical system functions. This allows it to intercept

304
00:15:57.759 --> 00:16:02.840
<v Speaker 1>and modify system calls. Okay, those requests programs make to

305
00:16:02.879 --> 00:16:06.320
<v Speaker 1>the operating system without actually having to change the code itself.

306
00:16:06.360 --> 00:16:08.279
<v Speaker 2>Wow, that's incredibly sneaky.

307
00:16:08.759 --> 00:16:09.159
<v Speaker 1>It is.

308
00:16:09.279 --> 00:16:12.480
<v Speaker 2>It's like setting up an invisible surveillance system to monitor

309
00:16:12.519 --> 00:16:15.080
<v Speaker 2>and manipulate traffic without anyone knowing it's there.

310
00:16:15.480 --> 00:16:18.080
<v Speaker 1>Yeah, it's all about being stealthy and avoiding detection.

311
00:16:18.639 --> 00:16:22.039
<v Speaker 2>Yeah, but why go through all that trouble. Wouldn't it

312
00:16:22.080 --> 00:16:24.799
<v Speaker 2>be easier to just modify the code directly.

313
00:16:24.919 --> 00:16:27.320
<v Speaker 1>Remember, it's all about stealth and avoiding detection.

314
00:16:27.799 --> 00:16:33.559
<v Speaker 2>So by using debugging registers, Rovnicks can manipulate system behavior

315
00:16:34.080 --> 00:16:36.879
<v Speaker 2>without leaving any traces in the code itself.

316
00:16:37.000 --> 00:16:39.559
<v Speaker 1>Oh so it makes it super hard to detect.

317
00:16:39.240 --> 00:16:43.039
<v Speaker 2>Very difficult for security software to detect its presence.

318
00:16:42.759 --> 00:16:43.879
<v Speaker 1>Like a ghost in the machine.

319
00:16:44.039 --> 00:16:45.879
<v Speaker 2>A very apt description.

320
00:16:45.639 --> 00:16:48.480
<v Speaker 1>Pulling the strings but leaving no fingerprints.

321
00:16:47.840 --> 00:16:49.799
<v Speaker 2>And to further enhance its stealth.

322
00:16:50.720 --> 00:16:51.519
<v Speaker 1>Okay, there's more.

323
00:16:51.840 --> 00:16:54.440
<v Speaker 2>Rovnicks uses another technique we've encountered before.

324
00:16:54.679 --> 00:16:55.360
<v Speaker 1>Oh what is it?

325
00:16:55.480 --> 00:16:57.399
<v Speaker 2>Filesystem driver hooking.

326
00:16:57.840 --> 00:16:59.440
<v Speaker 1>Did we see that with FESTI as well?

327
00:16:59.559 --> 00:17:02.759
<v Speaker 2>Yes, right, it's a common tactic for both root kits

328
00:17:02.759 --> 00:17:05.920
<v Speaker 2>and bootkits. Right. By hooking into that file system driver,

329
00:17:06.480 --> 00:17:09.839
<v Speaker 2>robnicks can intercept and modify any requests to read or

330
00:17:09.880 --> 00:17:14.240
<v Speaker 2>write files. This ensures that it's hidden partition remains hidden.

331
00:17:14.599 --> 00:17:16.960
<v Speaker 1>It's like having a secret agent working in the library,

332
00:17:17.599 --> 00:17:21.119
<v Speaker 1>making sure no one accidentally stumbles upon the restricted section exactly.

333
00:17:21.160 --> 00:17:23.160
<v Speaker 1>And as if that wasn't enough, Oh there's more.

334
00:17:23.920 --> 00:17:28.920
<v Speaker 2>Rovnicks encrypts it's hidden partition, adding yet another layer of protection.

335
00:17:29.400 --> 00:17:32.079
<v Speaker 1>So even if you managed to find that hidden partition,

336
00:17:33.240 --> 00:17:35.079
<v Speaker 1>you can't access the data without.

337
00:17:34.839 --> 00:17:39.920
<v Speaker 2>The key precisely. Wow, it uses strong encryption algorithms to

338
00:17:40.000 --> 00:17:41.079
<v Speaker 2>protect its secrets.

339
00:17:41.160 --> 00:17:45.039
<v Speaker 1>But even with all these sophisticated techniques, yeah, Romnicks doesn't

340
00:17:45.039 --> 00:17:46.559
<v Speaker 1>always operate in isolation.

341
00:17:47.119 --> 00:17:49.680
<v Speaker 2>Sometimes it uses a dropper to gain a foothold on

342
00:17:49.720 --> 00:17:53.160
<v Speaker 2>the system. A dropper, Yeah, Alling'sabelle. We've talked about droppers before.

343
00:17:53.440 --> 00:17:57.400
<v Speaker 2>They're essentially programs that are designed to deliver malware onto

344
00:17:57.480 --> 00:18:00.480
<v Speaker 2>a system, right, Okay, So in the case Ofrovnicks, the

345
00:18:00.519 --> 00:18:03.480
<v Speaker 2>dropper is used to deliver the bootkit onto the hard drive.

346
00:18:03.640 --> 00:18:06.279
<v Speaker 1>So the dropper is like the delivery truck that brings

347
00:18:06.279 --> 00:18:07.200
<v Speaker 1>the bootkit to your.

348
00:18:07.119 --> 00:18:09.759
<v Speaker 2>Doorstep another perfect analogy.

349
00:18:09.319 --> 00:18:11.519
<v Speaker 1>But it's the bootkit itself that breaks in and takes

350
00:18:11.519 --> 00:18:12.799
<v Speaker 1>over exactly.

351
00:18:12.960 --> 00:18:17.640
<v Speaker 2>The dropper might arrive disguised as a legitimate program or file,

352
00:18:18.160 --> 00:18:22.440
<v Speaker 2>but once it's executed, it releases the Robnick's bootkit onto

353
00:18:22.440 --> 00:18:23.039
<v Speaker 2>the system.

354
00:18:23.440 --> 00:18:26.839
<v Speaker 1>So we have the dropper, installing the bootkit, the bootkit,

355
00:18:27.519 --> 00:18:32.039
<v Speaker 1>infecting the VBR, and then loading its malicious kernel mode driver.

356
00:18:32.400 --> 00:18:32.640
<v Speaker 2>Right.

357
00:18:32.759 --> 00:18:33.759
<v Speaker 1>That's a lot of steps.

358
00:18:34.079 --> 00:18:36.960
<v Speaker 2>It is a complex chain of events, it is. And

359
00:18:37.000 --> 00:18:40.559
<v Speaker 2>to make things even more complicated, No, some variants of

360
00:18:40.640 --> 00:18:42.920
<v Speaker 2>robnicks actually incorporate other malware.

361
00:18:43.160 --> 00:18:46.960
<v Speaker 1>Oh wow, like the carbon banking trojan, the banking trojan. Yeah,

362
00:18:47.000 --> 00:18:50.680
<v Speaker 1>so this bookkit isn't just about stealth and control. It's

363
00:18:50.720 --> 00:18:52.960
<v Speaker 1>also about stealing money unfortunately.

364
00:18:53.039 --> 00:18:56.039
<v Speaker 2>Yes, Oh my gosh, some variants of robnicks have been

365
00:18:56.119 --> 00:18:59.759
<v Speaker 2>used to deploy these banking trojans, right, which are designed

366
00:18:59.759 --> 00:19:02.240
<v Speaker 2>to steal sensitive financial information.

367
00:19:02.519 --> 00:19:05.559
<v Speaker 1>Wow, this is getting scary. It's like a criminal gang

368
00:19:05.920 --> 00:19:09.559
<v Speaker 1>breaking into your house, installing hidden cameras and microphones, and

369
00:19:09.559 --> 00:19:11.480
<v Speaker 1>then robbing your bank account while you're sleeping.

370
00:19:11.759 --> 00:19:14.480
<v Speaker 2>Yeah. It's a very accurate comparison, it is, and it

371
00:19:14.519 --> 00:19:16.400
<v Speaker 2>really underscores the danger of boot kits.

372
00:19:16.559 --> 00:19:16.880
<v Speaker 1>Yeah.

373
00:19:16.920 --> 00:19:21.319
<v Speaker 2>They're not just theoretical threats. They are real world malware

374
00:19:22.000 --> 00:19:24.160
<v Speaker 2>that can have devastating consequences.

375
00:19:24.279 --> 00:19:26.359
<v Speaker 1>Okay, I think I've had enough for robnicks for now.

376
00:19:26.680 --> 00:19:30.480
<v Speaker 1>My head is spinning. Okay, let's move on to gaps. Okay, gaps,

377
00:19:30.920 --> 00:19:33.960
<v Speaker 1>how does this one stack up against Robnicks in terms

378
00:19:33.960 --> 00:19:35.359
<v Speaker 1>of complexity and stealth?

379
00:19:35.720 --> 00:19:38.640
<v Speaker 2>Believe it or not, GAPS is even more complex than Robnicks.

380
00:19:38.640 --> 00:19:40.559
<v Speaker 1>Oh wow, really it uses a.

381
00:19:40.559 --> 00:19:44.240
<v Speaker 2>Whole arsenal of advanced techniques. Okay, like what, including shell

382
00:19:44.279 --> 00:19:48.440
<v Speaker 2>code injection, return oriented programming, and even its own custom

383
00:19:48.559 --> 00:19:50.319
<v Speaker 2>TCPIP network stack.

384
00:19:50.559 --> 00:19:54.200
<v Speaker 1>WHOA hold on, Yeah, that's a lot to process it is. Okay,

385
00:19:54.319 --> 00:19:55.839
<v Speaker 1>let's start with shell code injection.

386
00:19:55.920 --> 00:19:56.279
<v Speaker 2>All right?

387
00:19:56.400 --> 00:19:57.160
<v Speaker 1>What is that?

388
00:19:57.279 --> 00:20:00.279
<v Speaker 2>So? Shell code is a small piece of code that's

389
00:20:00.319 --> 00:20:03.440
<v Speaker 2>typically used to exploit a vulnerability and gain control of

390
00:20:03.480 --> 00:20:03.960
<v Speaker 2>a system.

391
00:20:04.279 --> 00:20:04.599
<v Speaker 1>Okay.

392
00:20:04.680 --> 00:20:08.279
<v Speaker 2>Shell code injection is the process of injecting this malicious

393
00:20:08.279 --> 00:20:12.799
<v Speaker 2>code into the memory of a running process, essentially hijacking

394
00:20:12.839 --> 00:20:14.920
<v Speaker 2>the process for its own evil purposes.

395
00:20:15.319 --> 00:20:17.920
<v Speaker 1>So it's like injecting a virus into a healthy cell

396
00:20:17.920 --> 00:20:19.200
<v Speaker 1>and turning it into a zombie.

397
00:20:19.319 --> 00:20:19.839
<v Speaker 2>You got it?

398
00:20:20.039 --> 00:20:22.559
<v Speaker 1>Forcing it to do the virus is bidding exactly. Okay.

399
00:20:22.759 --> 00:20:26.359
<v Speaker 2>GAPS uses shell code injection to inject its malicious code

400
00:20:26.359 --> 00:20:29.960
<v Speaker 2>into a crucial system process called explorer dot ex.

401
00:20:30.559 --> 00:20:32.839
<v Speaker 1>Explorer dot ex what's that?

402
00:20:33.200 --> 00:20:37.759
<v Speaker 2>This process manages the Windows graphical user interface. Okay, things

403
00:20:37.799 --> 00:20:42.039
<v Speaker 2>like your desktop taskbar and file explorer.

404
00:20:41.480 --> 00:20:45.119
<v Speaker 1>So by injecting its code into explore dot ex uh huh,

405
00:20:45.279 --> 00:20:48.759
<v Speaker 1>GAPS gains control of the entire user interface pretty much.

406
00:20:48.839 --> 00:20:49.680
<v Speaker 1>That's terrifying.

407
00:20:49.880 --> 00:20:52.319
<v Speaker 2>It is a powerful position to be in, it is,

408
00:20:52.480 --> 00:20:55.880
<v Speaker 2>and to actually execute its shell code. GAPS uses a

409
00:20:55.920 --> 00:20:59.839
<v Speaker 2>technique called return oriented programming or ROP ROP.

410
00:21:00.200 --> 00:21:02.240
<v Speaker 1>That sounds familiar. Yeah, did we talk about this with

411
00:21:02.279 --> 00:21:03.039
<v Speaker 1>TDL three.

412
00:21:03.240 --> 00:21:06.599
<v Speaker 2>You're thinking of system call hooking, Oh, right, which is

413
00:21:06.599 --> 00:21:09.599
<v Speaker 2>a different technique. ROP is a more advanced way of

414
00:21:09.599 --> 00:21:10.680
<v Speaker 2>exploiting a system.

415
00:21:10.880 --> 00:21:11.119
<v Speaker 1>Right.

416
00:21:11.200 --> 00:21:15.279
<v Speaker 2>It involves chaining together short snippets of existing code okay,

417
00:21:15.480 --> 00:21:19.359
<v Speaker 2>called gadgets to execute its own arbitrary code.

418
00:21:19.400 --> 00:21:22.920
<v Speaker 1>So it's like building of Frankenstein's Monster out of bits

419
00:21:23.000 --> 00:21:24.720
<v Speaker 1>and pieces of pre existing code.

420
00:21:24.799 --> 00:21:25.960
<v Speaker 2>That's a perfect analogy.

421
00:21:26.039 --> 00:21:26.319
<v Speaker 1>Okay.

422
00:21:26.480 --> 00:21:29.880
<v Speaker 2>GAPS uses ROP to execute its shell code within the

423
00:21:29.920 --> 00:21:34.559
<v Speaker 2>context of explore dot exc Okay. This effectively camouflages its

424
00:21:34.599 --> 00:21:38.519
<v Speaker 2>malicious activity right from security software looking for suspicious processes.

425
00:21:39.000 --> 00:21:43.000
<v Speaker 1>Okay, so we have shell code injection and ROP. Now

426
00:21:43.039 --> 00:21:46.519
<v Speaker 1>what about this custom TCPIP network stack.

427
00:21:46.880 --> 00:21:49.279
<v Speaker 2>Yeah, that one's seriously complicated.

428
00:21:49.359 --> 00:21:50.359
<v Speaker 1>It sounds complicated.

429
00:21:50.400 --> 00:21:54.319
<v Speaker 2>The TCPIP network stack is the software that's responsible for

430
00:21:54.440 --> 00:21:58.640
<v Speaker 2>all network communication on your computer. GAPS creates its own

431
00:21:58.880 --> 00:22:01.119
<v Speaker 2>oh wow, custom tip stack.

432
00:22:01.480 --> 00:22:04.640
<v Speaker 1>So it's like building a secret underground tunnel to bypass

433
00:22:04.680 --> 00:22:07.920
<v Speaker 1>the main highway exactly. Why go through all this effort

434
00:22:08.119 --> 00:22:08.559
<v Speaker 1>so it.

435
00:22:08.480 --> 00:22:14.039
<v Speaker 2>Can communicate with its command and control SERVERSKAY, receiving instructions,

436
00:22:14.079 --> 00:22:20.119
<v Speaker 2>sending stolen data without being detected by traditional network security tools.

437
00:22:20.200 --> 00:22:23.000
<v Speaker 1>So it's like having a secret communication channel that's completely

438
00:22:23.000 --> 00:22:24.720
<v Speaker 1>invisible to the authorities exactly.

439
00:22:24.759 --> 00:22:28.240
<v Speaker 2>And this makes GAPS incredibly difficult to detect and remove.

440
00:22:28.400 --> 00:22:31.000
<v Speaker 1>Wow. So GAPS officially wins the award for the most

441
00:22:31.079 --> 00:22:33.839
<v Speaker 1>terrifying bootkit we've discussed so far. Yeah, I think so.

442
00:22:34.160 --> 00:22:36.559
<v Speaker 1>But there's another application of bootkit techniques we need to

443
00:22:36.559 --> 00:22:38.359
<v Speaker 1>talk about, and that's ransomware. Right.

444
00:22:38.440 --> 00:22:42.599
<v Speaker 2>Ransomware it's become increasingly common, it has in recent years,

445
00:22:43.119 --> 00:22:47.160
<v Speaker 2>and bootkits have played a significant role in its evolution.

446
00:22:47.359 --> 00:22:49.519
<v Speaker 1>So how do bootkits and ransomware intersect?

447
00:22:49.720 --> 00:22:54.279
<v Speaker 2>Well. Early ransomware typically encrypted user files on the hard

448
00:22:54.359 --> 00:22:58.039
<v Speaker 2>drive and then demanded a ransom right pay.

449
00:22:57.960 --> 00:23:01.440
<v Speaker 1>Up or lose your files forever. Act I remember hearing

450
00:23:01.480 --> 00:23:01.839
<v Speaker 1>about that.

451
00:23:02.160 --> 00:23:06.599
<v Speaker 2>But security software got better at detecting and removing ransomware,

452
00:23:07.160 --> 00:23:10.839
<v Speaker 2>so the attackers had to find new ways to evade

453
00:23:10.880 --> 00:23:13.319
<v Speaker 2>detection increase their chances of getting.

454
00:23:13.039 --> 00:23:15.400
<v Speaker 1>Paid, and that's where bootkits came in precisely.

455
00:23:15.839 --> 00:23:20.359
<v Speaker 2>Bootkits provided a new way for ransomware to operate, right, So,

456
00:23:20.799 --> 00:23:25.920
<v Speaker 2>instead of just encrypting user files, some ransomware started using

457
00:23:26.079 --> 00:23:30.720
<v Speaker 2>bootkit techniques to actually encrypt the master boot record, oh wow,

458
00:23:30.799 --> 00:23:32.160
<v Speaker 2>or even the entire hard drive.

459
00:23:32.319 --> 00:23:34.759
<v Speaker 1>Encrypting the entire hard drive. That's a whole new level,

460
00:23:34.839 --> 00:23:36.400
<v Speaker 1>it is. What's the advantage of that.

461
00:23:36.720 --> 00:23:41.039
<v Speaker 2>It's all about maximizing disruption, okay, and increasing pressure on

462
00:23:41.160 --> 00:23:45.759
<v Speaker 2>the victim. By encrypting the boot process itself. Huh, they

463
00:23:45.799 --> 00:23:50.160
<v Speaker 2>could completely lock users out of their systems wow, making

464
00:23:50.240 --> 00:23:53.440
<v Speaker 2>them unusable until that ransom was paid.

465
00:23:53.519 --> 00:23:55.720
<v Speaker 1>So it's like changing the locks on your house and

466
00:23:55.799 --> 00:23:57.839
<v Speaker 1>then demanding money to give you the keys back.

467
00:23:57.960 --> 00:23:59.039
<v Speaker 2>A perfect analogy.

468
00:23:59.200 --> 00:23:59.599
<v Speaker 1>Okay.

469
00:24:00.079 --> 00:24:04.200
<v Speaker 2>Tactic proved very successful for ransomware developers, right because.

470
00:24:04.000 --> 00:24:06.799
<v Speaker 1>It makes it so much harder to recover it does. Okay,

471
00:24:06.799 --> 00:24:11.680
<v Speaker 1>I see how bootkits have really amplified the threat of ransomware,

472
00:24:12.240 --> 00:24:16.160
<v Speaker 1>gone from just encrypting files to holding entire computer systems.

473
00:24:15.759 --> 00:24:20.200
<v Speaker 2>Hostage exactly, And to illustrate this evolution, let's look at

474
00:24:20.200 --> 00:24:24.319
<v Speaker 2>some specific examples of ransomware that have used bootkit techniques.

475
00:24:24.440 --> 00:24:27.640
<v Speaker 1>Okay, we'll start with Petya. Petya, that name rings a bell.

476
00:24:27.920 --> 00:24:28.319
<v Speaker 2>It does.

477
00:24:28.440 --> 00:24:30.559
<v Speaker 1>Didn't it cause some major problems a few years ago?

478
00:24:30.720 --> 00:24:34.440
<v Speaker 2>It did. Petya appeared back in twenty sixteen, okay, and

479
00:24:34.519 --> 00:24:37.839
<v Speaker 2>quickly gained notoriety for its destructive capabilities.

480
00:24:37.960 --> 00:24:38.720
<v Speaker 1>Yeah, I remember that.

481
00:24:38.880 --> 00:24:43.480
<v Speaker 2>Unlike traditional ransomware that focused on user files, right, Petya

482
00:24:43.839 --> 00:24:46.480
<v Speaker 2>targeted the Master file Table.

483
00:24:46.480 --> 00:24:49.480
<v Speaker 1>Or MFT, the Master style table. What's that? So?

484
00:24:49.559 --> 00:24:53.480
<v Speaker 2>The MFT is essentially a database that contains information about

485
00:24:53.480 --> 00:24:57.839
<v Speaker 2>all the files on your hard drive, their names, sizes, locations.

486
00:24:57.960 --> 00:24:59.839
<v Speaker 1>Okay, And more so, if the hard drive is like

487
00:24:59.839 --> 00:25:04.440
<v Speaker 1>a library, the MFT is the card catalog.

488
00:25:04.640 --> 00:25:05.920
<v Speaker 2>That's a great way to think about it.

489
00:25:06.000 --> 00:25:06.400
<v Speaker 1>Okay.

490
00:25:06.440 --> 00:25:10.920
<v Speaker 2>And Petya encrypts that catalog, the MFT. Okay, And this

491
00:25:10.960 --> 00:25:13.680
<v Speaker 2>prevents the operating system from accessing any.

492
00:25:13.480 --> 00:25:15.319
<v Speaker 1>Files on the hard drive, oh my god.

493
00:25:15.200 --> 00:25:17.400
<v Speaker 2>Effectively making the system unbootable.

494
00:25:17.839 --> 00:25:20.319
<v Speaker 1>So it's not just holding your data hostage, it's locking

495
00:25:20.319 --> 00:25:22.759
<v Speaker 1>you out of your entire house exactly why.

496
00:25:23.119 --> 00:25:27.400
<v Speaker 2>And to make matters worse, there's more. Petya uses a

497
00:25:27.559 --> 00:25:33.319
<v Speaker 2>very strong encryption algorithm and employs some clever techniques to evade.

498
00:25:32.839 --> 00:25:35.319
<v Speaker 1>Detection, so it's really hard to get around.

499
00:25:35.440 --> 00:25:36.720
<v Speaker 2>It's a tough nut to crack.

500
00:25:37.400 --> 00:25:41.119
<v Speaker 1>Okay, So Petya encrypts the MFT, yeah, making the system unbootable.

501
00:25:41.359 --> 00:25:43.880
<v Speaker 1>But how does it actually gain control of the system.

502
00:25:44.000 --> 00:25:46.160
<v Speaker 1>To do this? Does it use a bootkit?

503
00:25:46.680 --> 00:25:50.440
<v Speaker 2>You guessed it. Petia uses a bootkit to infect the

504
00:25:50.559 --> 00:25:54.880
<v Speaker 2>master boot record, replacing that legitimate boot code with its

505
00:25:54.960 --> 00:25:56.119
<v Speaker 2>own malicious code.

506
00:25:56.200 --> 00:26:00.599
<v Speaker 1>Right, So it's a double whammy, a bootkit and ransomwarecisely.

507
00:26:00.759 --> 00:26:03.839
<v Speaker 2>Wow, and this combination proved incredibly effective.

508
00:26:04.000 --> 00:26:04.720
<v Speaker 1>Yeah, it did.

509
00:26:05.000 --> 00:26:09.680
<v Speaker 2>Pettia caused major disruptions to businesses and organizations around the world,

510
00:26:10.119 --> 00:26:14.359
<v Speaker 2>really highlighting that growing thread of ransomware that leverages these

511
00:26:14.400 --> 00:26:15.559
<v Speaker 2>bootkit techniques.

512
00:26:15.839 --> 00:26:19.559
<v Speaker 1>Petti is a really scary example of how destructive ransomware

513
00:26:19.640 --> 00:26:24.279
<v Speaker 1>can be. Our sources also mentioned another ransomware strain, Satana

514
00:26:24.319 --> 00:26:27.559
<v Speaker 1>Satana that also uses bootkit techniques. Right, well, can you

515
00:26:27.559 --> 00:26:28.359
<v Speaker 1>tell me about that one.

516
00:26:28.519 --> 00:26:33.039
<v Speaker 2>Satana is interesting because it combines NBR infection with file.

517
00:26:32.880 --> 00:26:36.400
<v Speaker 1>Encryption, so it's like a hybrid approach. Infects the boot

518
00:26:36.440 --> 00:26:40.799
<v Speaker 1>process like Petya, but also encrypts user files like traditional

519
00:26:40.880 --> 00:26:41.920
<v Speaker 1>ransomware exactly.

520
00:26:41.960 --> 00:26:47.960
<v Speaker 2>So Satana first infects the NBR, replacing the legitimate boot

521
00:26:48.000 --> 00:26:50.119
<v Speaker 2>code with its own malicious code.

522
00:26:50.200 --> 00:26:51.559
<v Speaker 1>Okay, this gives it.

523
00:26:51.480 --> 00:26:54.960
<v Speaker 2>Control during that boot process, allowing it to display a

524
00:26:55.079 --> 00:26:56.680
<v Speaker 2>ransom message to the user.

525
00:26:56.960 --> 00:26:59.839
<v Speaker 1>So it's like Petya in that it takes over the boot,

526
00:27:01.000 --> 00:27:05.160
<v Speaker 1>but instead of encrypting the MFT, it goes after user

527
00:27:05.200 --> 00:27:06.000
<v Speaker 1>files directly.

528
00:27:06.200 --> 00:27:10.599
<v Speaker 2>Exactly. But there's a catch, a catch. Security researchers actually

529
00:27:10.640 --> 00:27:15.599
<v Speaker 2>discovered that Satana's malicious bootloader code had some flaws.

530
00:27:15.720 --> 00:27:16.640
<v Speaker 1>Oh so they're not perfect.

531
00:27:16.720 --> 00:27:20.000
<v Speaker 2>They're not. And these flaws in some cases actually made

532
00:27:20.000 --> 00:27:23.119
<v Speaker 2>it possible to recover the system without paying the ransom.

533
00:27:23.359 --> 00:27:25.839
<v Speaker 1>So Satana wasn't as full proof as Petya.

534
00:27:26.160 --> 00:27:26.640
<v Speaker 2>It wasn't.

535
00:27:26.680 --> 00:27:28.119
<v Speaker 1>Even the bad guys make mistakes.

536
00:27:28.119 --> 00:27:31.519
<v Speaker 2>They do, and sometimes these mistakes can provide valuable insights

537
00:27:31.519 --> 00:27:36.240
<v Speaker 2>for security researchers, allowing them to develop countermeasures and recovery tools.

538
00:27:36.319 --> 00:27:39.480
<v Speaker 1>It's good to hear, it is. But even with Satana's flaws,

539
00:27:39.839 --> 00:27:43.880
<v Speaker 1>it's clear that ransomware that uses these bootkit techniques is

540
00:27:43.880 --> 00:27:44.839
<v Speaker 1>a serious.

541
00:27:44.480 --> 00:27:46.119
<v Speaker 2>Threat, a very serious threat.

542
00:27:46.200 --> 00:27:48.160
<v Speaker 1>So is there anything we can do to protect ourselves.

543
00:27:48.640 --> 00:27:50.640
<v Speaker 2>That's a great question, and it leads us to the

544
00:27:50.640 --> 00:27:53.680
<v Speaker 2>next part of our deep dive. Okay, modern defenses against

545
00:27:53.759 --> 00:27:57.000
<v Speaker 2>bootkits and rootkits. We'll be exploring some of the latest

546
00:27:57.039 --> 00:28:00.200
<v Speaker 2>security technologies that are designed to protect us from these

547
00:28:00.240 --> 00:28:01.079
<v Speaker 2>advanced threats.

548
00:28:01.200 --> 00:28:03.039
<v Speaker 1>Okay, I'm ready to shift gears and learn how we

549
00:28:03.079 --> 00:28:05.599
<v Speaker 1>can fight back against these digital bad guys.

550
00:28:06.039 --> 00:28:10.480
<v Speaker 2>All right, So we've explored those sneaky rootkits and bootkits.

551
00:28:10.000 --> 00:28:11.680
<v Speaker 1>Right, hijacking your system at.

552
00:28:11.559 --> 00:28:14.000
<v Speaker 2>Its core, and we even saw how ransomware has gotten

553
00:28:14.000 --> 00:28:14.839
<v Speaker 2>in on the action.

554
00:28:15.079 --> 00:28:17.039
<v Speaker 1>Yeah, encrypting entire hard drives.

555
00:28:17.599 --> 00:28:19.519
<v Speaker 2>But now for the good news, Okay, how are we

556
00:28:19.640 --> 00:28:20.359
<v Speaker 2>fighting back?

557
00:28:20.680 --> 00:28:24.000
<v Speaker 1>Right? What are the defenses against these increasingly sophisticated attacks.

558
00:28:24.359 --> 00:28:27.680
<v Speaker 2>Well, the good news is security researchers and developers are

559
00:28:27.799 --> 00:28:29.920
<v Speaker 2>always working on new ways to protect us.

560
00:28:30.079 --> 00:28:30.759
<v Speaker 1>That's good to hear.

561
00:28:31.079 --> 00:28:34.000
<v Speaker 2>One of the biggest game changers in recent years has

562
00:28:34.079 --> 00:28:36.519
<v Speaker 2>been UI Phi Secure Boot.

563
00:28:36.960 --> 00:28:39.640
<v Speaker 1>Ui Phi Secure Boot. That does sound familiar, it does,

564
00:28:39.759 --> 00:28:41.319
<v Speaker 1>didn't We touch on that when we were talking about

565
00:28:41.319 --> 00:28:42.640
<v Speaker 1>the boot process itself.

566
00:28:42.799 --> 00:28:47.200
<v Speaker 2>We did remember Ui Fi that modern replacement for the

567
00:28:47.240 --> 00:28:48.240
<v Speaker 2>traditional bios.

568
00:28:48.519 --> 00:28:48.720
<v Speaker 1>Right.

569
00:28:48.920 --> 00:28:52.640
<v Speaker 2>Secure boot is a security feature that's built into ufs okay,

570
00:28:52.839 --> 00:28:55.759
<v Speaker 2>and it's designed to protect the boot process from malware,

571
00:28:55.920 --> 00:28:58.200
<v Speaker 2>including those pesky bootkits.

572
00:28:58.279 --> 00:29:00.400
<v Speaker 1>So it's like having a security guard at the entrance

573
00:29:00.440 --> 00:29:04.039
<v Speaker 1>to your computer checking everyone's credentials. But how does secure

574
00:29:04.079 --> 00:29:05.039
<v Speaker 1>boot actually work.

575
00:29:05.240 --> 00:29:08.680
<v Speaker 2>It's a lot more sophisticated than a simple password. Secure

576
00:29:08.680 --> 00:29:12.640
<v Speaker 2>boot uses something called digital signatures okay to verify the

577
00:29:12.680 --> 00:29:17.400
<v Speaker 2>authenticity of every single piece of software that loads during

578
00:29:17.440 --> 00:29:18.319
<v Speaker 2>the boot process.

579
00:29:18.440 --> 00:29:21.759
<v Speaker 1>So each piece of software has its own unique digital signature.

580
00:29:22.160 --> 00:29:24.400
<v Speaker 2>You can think of it like a unique digital fingerprint,

581
00:29:24.599 --> 00:29:27.400
<v Speaker 2>ok that identifies each piece of software.

582
00:29:27.519 --> 00:29:30.599
<v Speaker 1>Okay. So secure boot checks these fingerprints to make sure

583
00:29:30.599 --> 00:29:33.359
<v Speaker 1>they're legit. Exactly what happens if it finds a piece

584
00:29:33.359 --> 00:29:36.599
<v Speaker 1>of software without a valid fingerprint.

585
00:29:36.839 --> 00:29:41.200
<v Speaker 2>If secure boot encounter software with an invalid or missing signature,

586
00:29:41.920 --> 00:29:45.960
<v Speaker 2>it blocks it from running, preventing the system from booting up.

587
00:29:46.079 --> 00:29:49.759
<v Speaker 1>So it stops bootkits and other malware from hijacking that

588
00:29:49.799 --> 00:29:53.119
<v Speaker 1>boot process exactly. That's pretty clever. It is like a

589
00:29:53.160 --> 00:29:55.279
<v Speaker 1>bouncer at a club checking IDs to make sure no

590
00:29:55.319 --> 00:29:58.079
<v Speaker 1>one's sneaking in with a fake right. But if secure

591
00:29:58.079 --> 00:30:00.920
<v Speaker 1>boot is so effective, why are bootcait It's still the problem.

592
00:30:01.160 --> 00:30:04.319
<v Speaker 2>Well, that's a good question, and it highlights an important point. Okay,

593
00:30:04.480 --> 00:30:07.519
<v Speaker 2>no security system is perfect, right. Secure boot is a

594
00:30:07.519 --> 00:30:10.680
<v Speaker 2>big step forward. Uh huh, but there are still ways

595
00:30:10.720 --> 00:30:14.480
<v Speaker 2>for attackers to bypass it. Oh, Like, what remember those

596
00:30:14.519 --> 00:30:16.119
<v Speaker 2>firmware rootkits we talked.

597
00:30:15.880 --> 00:30:20.000
<v Speaker 1>About, the ones that infect the system firmware itself, exact,

598
00:30:20.200 --> 00:30:22.039
<v Speaker 1>the code that controls the hardware. Right.

599
00:30:22.680 --> 00:30:26.680
<v Speaker 2>Formware root kits are especially dangerous because they operate at

600
00:30:26.720 --> 00:30:28.599
<v Speaker 2>an even lower level than boot kits.

601
00:30:28.799 --> 00:30:28.960
<v Speaker 1>Right.

602
00:30:29.039 --> 00:30:33.880
<v Speaker 2>They can potentially bypass secure boot by modifying the system

603
00:30:33.880 --> 00:30:38.160
<v Speaker 2>firmware to disable it or even add their own malicious signatures.

604
00:30:38.400 --> 00:30:40.839
<v Speaker 1>Wow. So it's like bribing the bouncer to let them

605
00:30:40.839 --> 00:30:41.440
<v Speaker 1>into the club.

606
00:30:41.599 --> 00:30:42.880
<v Speaker 2>A very apt analogy.

607
00:30:43.039 --> 00:30:46.599
<v Speaker 1>Wow. Okay, so secure boot's great, yeah, but not fool proof.

608
00:30:46.759 --> 00:30:47.160
<v Speaker 2>It's not.

609
00:30:47.920 --> 00:30:50.720
<v Speaker 1>What are some of the other defenses that are being developed, right?

610
00:30:50.759 --> 00:30:51.720
<v Speaker 2>What's on the horizon?

611
00:30:51.920 --> 00:30:52.440
<v Speaker 1>Yeah?

612
00:30:52.480 --> 00:30:56.519
<v Speaker 2>Well, one really promising area of development is hardware assisted security.

613
00:30:56.640 --> 00:30:58.559
<v Speaker 1>Hardware assisted security, we're.

614
00:30:58.400 --> 00:31:03.519
<v Speaker 2>Seeing a shift words building security features directly into the

615
00:31:03.559 --> 00:31:04.440
<v Speaker 2>hardware itself.

616
00:31:04.880 --> 00:31:08.359
<v Speaker 1>So we're talking about actual physical chips and components basically that.

617
00:31:08.319 --> 00:31:10.319
<v Speaker 2>Are designed with security in mind.

618
00:31:10.480 --> 00:31:11.279
<v Speaker 1>What does that look like?

619
00:31:11.480 --> 00:31:13.440
<v Speaker 2>One example is Intel Bootguard.

620
00:31:13.559 --> 00:31:14.720
<v Speaker 1>Intel boot Guard.

621
00:31:14.559 --> 00:31:18.440
<v Speaker 2>It's a hardware based security feature that's integrated into some

622
00:31:18.799 --> 00:31:19.920
<v Speaker 2>Intel processors.

623
00:31:20.119 --> 00:31:20.759
<v Speaker 1>How did that work.

624
00:31:20.960 --> 00:31:24.119
<v Speaker 2>It's designed to verify the integrity of the system firmware

625
00:31:24.799 --> 00:31:27.880
<v Speaker 2>before it's even loaded. Oh wow, which makes it much

626
00:31:27.920 --> 00:31:32.200
<v Speaker 2>harder for those firmware root kits to gain a foothold.

627
00:31:32.319 --> 00:31:34.720
<v Speaker 1>So it's like having a security checkpoint before you even

628
00:31:34.759 --> 00:31:37.279
<v Speaker 1>reach the club entrance exactly, okay.

629
00:31:37.400 --> 00:31:43.880
<v Speaker 2>Intel Bootguard uses cryptographic techniques to measure and verify that

630
00:31:43.960 --> 00:31:47.000
<v Speaker 2>system firmware okay, making sure it hasn't been tampered with.

631
00:31:47.319 --> 00:31:51.039
<v Speaker 2>If it detects any signs of modification, it blocks the

632
00:31:51.119 --> 00:31:52.200
<v Speaker 2>system from booting.

633
00:31:52.519 --> 00:31:55.880
<v Speaker 1>Wow. It's like having a tamper proof seal on the

634
00:31:55.920 --> 00:31:58.880
<v Speaker 1>system firmware, yeah, guaranteeing its authenticity.

635
00:31:58.920 --> 00:31:59.319
<v Speaker 2>You got it.

636
00:31:59.680 --> 00:32:03.680
<v Speaker 1>Are there any other examples of this hardware assisted security.

637
00:32:03.400 --> 00:32:06.960
<v Speaker 2>They're Another great example is RM Trusted.

638
00:32:06.480 --> 00:32:08.640
<v Speaker 1>Boot RM Trusted Booting, where.

639
00:32:09.160 --> 00:32:13.640
<v Speaker 2>The company that designs the architecture for many mobile devices

640
00:32:14.160 --> 00:32:17.039
<v Speaker 2>has developed its own approach to secure booting.

641
00:32:17.400 --> 00:32:19.480
<v Speaker 1>What makes Arm's approach different.

642
00:32:19.599 --> 00:32:24.400
<v Speaker 2>So ARM Trusted Boot leverages something called trust Zone, which

643
00:32:24.440 --> 00:32:28.559
<v Speaker 2>is a hardware based security feature that creates a secure

644
00:32:28.759 --> 00:32:32.119
<v Speaker 2>execution environment within the processor.

645
00:32:31.640 --> 00:32:34.880
<v Speaker 1>Itself a secure execution environment. So it's like having a

646
00:32:34.960 --> 00:32:38.079
<v Speaker 1>vault inside your house where you keep your most valuable possessions,

647
00:32:38.079 --> 00:32:40.119
<v Speaker 1>a very good analogy, say, from intruders.

648
00:32:40.200 --> 00:32:44.359
<v Speaker 2>So trust Zone allows sensitive operations like the boot process

649
00:32:44.920 --> 00:32:49.480
<v Speaker 2>to run in a protected environment, completely isolated from the

650
00:32:49.519 --> 00:32:51.039
<v Speaker 2>main operating system.

651
00:32:51.480 --> 00:32:53.640
<v Speaker 1>And any potential malware lurking there.

652
00:32:53.839 --> 00:32:57.319
<v Speaker 2>So it's like having a separate secure operating system exactly

653
00:32:57.400 --> 00:32:59.880
<v Speaker 2>that's specifically responsible for booting the device.

654
00:33:00.119 --> 00:33:00.559
<v Speaker 1>You got it?

655
00:33:00.759 --> 00:33:01.119
<v Speaker 2>Okay.

656
00:33:01.319 --> 00:33:04.640
<v Speaker 1>An ARM Trusted boot uses trust Zone to verify the

657
00:33:04.640 --> 00:33:08.519
<v Speaker 1>integrity of the bootloader and other critical components during that

658
00:33:08.559 --> 00:33:12.039
<v Speaker 1>boot process. Okay. This ensures that only trusted software is

659
00:33:12.079 --> 00:33:12.759
<v Speaker 1>allowed to run.

660
00:33:13.720 --> 00:33:18.319
<v Speaker 2>So we have Intel Bootguard uh huh and ARM Trusted

661
00:33:18.359 --> 00:33:22.400
<v Speaker 2>boot yep, both using hardware assisted security to protect the

662
00:33:22.400 --> 00:33:23.200
<v Speaker 2>boot process.

663
00:33:23.519 --> 00:33:23.960
<v Speaker 1>They are.

664
00:33:24.319 --> 00:33:26.720
<v Speaker 2>That's pretty amazing. It sounds like the good guys are

665
00:33:26.720 --> 00:33:29.200
<v Speaker 2>making some serious progress and combating these threats.

666
00:33:29.480 --> 00:33:32.359
<v Speaker 1>They are. And as users, the most important thing we

667
00:33:32.400 --> 00:33:35.440
<v Speaker 1>can do is stay informed right about these threats, yeah,

668
00:33:35.480 --> 00:33:37.039
<v Speaker 1>and take steps to protect ourselves.

669
00:33:37.079 --> 00:33:39.079
<v Speaker 2>Okay, so what can our listeners do? What are some

670
00:33:39.240 --> 00:33:42.519
<v Speaker 2>practical takeaways they can implement to enhance their security.

671
00:33:42.799 --> 00:33:46.480
<v Speaker 1>First, and foremost, Okay, keep your system updated right, update updates.

672
00:33:46.480 --> 00:33:49.359
<v Speaker 1>Software updates often include security patches.

673
00:33:49.240 --> 00:33:52.799
<v Speaker 2>That address known vulnerabilities, right, so make sure you're running

674
00:33:52.839 --> 00:33:55.440
<v Speaker 2>the latest versions of your operating system and all of

675
00:33:55.480 --> 00:33:56.200
<v Speaker 2>your software.

676
00:33:56.559 --> 00:33:57.480
<v Speaker 1>Okay. What else?

677
00:33:58.000 --> 00:34:00.839
<v Speaker 2>Be very careful about what you down load and install.

678
00:34:01.119 --> 00:34:01.480
<v Speaker 1>Okay.

679
00:34:01.599 --> 00:34:05.759
<v Speaker 2>Malware often disguises itself as legitimate software, right, So always

680
00:34:05.839 --> 00:34:08.199
<v Speaker 2>download from trusted sources.

681
00:34:08.079 --> 00:34:12.119
<v Speaker 1>So no clicking on suspicious links or downloading pirated software exactly.

682
00:34:12.639 --> 00:34:16.639
<v Speaker 2>And lastly, consider using security software that includes features like

683
00:34:16.719 --> 00:34:18.559
<v Speaker 2>bootkit detection and removal.

684
00:34:18.800 --> 00:34:19.119
<v Speaker 1>Okay.

685
00:34:19.159 --> 00:34:23.079
<v Speaker 2>There are many excellent security suites available that can provide

686
00:34:23.119 --> 00:34:24.559
<v Speaker 2>an extra layer of protection.

687
00:34:24.760 --> 00:34:28.960
<v Speaker 1>So update your system, be conscious about downloads, and use

688
00:34:29.000 --> 00:34:32.039
<v Speaker 1>good security software. You got it. Solid advice, it is.

689
00:34:32.119 --> 00:34:34.360
<v Speaker 1>It's like having a strong defense in both the physical

690
00:34:34.400 --> 00:34:35.239
<v Speaker 1>and digital world.

691
00:34:35.400 --> 00:34:38.800
<v Speaker 2>Absolutely, and remember knowledge is power, right. The more you

692
00:34:38.920 --> 00:34:42.119
<v Speaker 2>understand about these threats, yeah, the better equipped you'll be

693
00:34:42.239 --> 00:34:43.239
<v Speaker 2>to protect yourself.

694
00:34:43.519 --> 00:34:47.599
<v Speaker 1>Well said. So what's the big takeaway from our deep

695
00:34:47.639 --> 00:34:48.199
<v Speaker 1>dive today?

696
00:34:48.440 --> 00:34:52.440
<v Speaker 2>Yeah, we explored the dark underbelly of root kits and bootkits.

697
00:34:52.760 --> 00:34:56.400
<v Speaker 1>Uh huh, those stealthy programs that can really hijack your

698
00:34:56.400 --> 00:34:57.760
<v Speaker 1>system at its core.

699
00:34:58.000 --> 00:35:02.000
<v Speaker 2>And we saw how ransomware has evolved to leverage these techniques.

700
00:35:01.559 --> 00:35:03.880
<v Speaker 1>By holding entire computer systems hostage.

701
00:35:03.960 --> 00:35:06.639
<v Speaker 2>But we also saw that the good guys aren't giving up. Yeah,

702
00:35:06.679 --> 00:35:10.039
<v Speaker 2>there are powerful defenses out there, from secure boot to

703
00:35:10.079 --> 00:35:13.280
<v Speaker 2>hardware assistant security that are making a real difference.

704
00:35:13.320 --> 00:35:14.360
<v Speaker 1>It is an arms race.

705
00:35:14.639 --> 00:35:18.320
<v Speaker 2>It is constant, constant cat and mouse game. It is

706
00:35:18.480 --> 00:35:22.599
<v Speaker 2>The key takeaway, I think is to be vigilant, stay informed,

707
00:35:22.639 --> 00:35:27.039
<v Speaker 2>stay protected, and never underestimate the creativity and determination of

708
00:35:27.079 --> 00:35:30.880
<v Speaker 2>both the attackers and the defenders in this constantly evolving

709
00:35:30.960 --> 00:35:32.480
<v Speaker 2>landscape of cybersecurity.

710
00:35:32.840 --> 00:35:35.960
<v Speaker 1>Well said one final thought for our listeners. Okay, we've

711
00:35:36.000 --> 00:35:40.760
<v Speaker 1>seen how attackers can manipulate legitimate system features, things you

712
00:35:40.840 --> 00:35:44.199
<v Speaker 1>might not even think twice about, for malicious purposes. Yeah,

713
00:35:44.199 --> 00:35:48.440
<v Speaker 1>it's scary what other seemingly innocent technologies might be hiding

714
00:35:48.559 --> 00:35:52.440
<v Speaker 1>a dark side. Keep that question in mind as you

715
00:35:52.519 --> 00:35:54.920
<v Speaker 1>explore the digital world. That's a good one.

716
00:35:55.039 --> 00:35:57.800
<v Speaker 2>Until next time, Stay safe, stay curious, and keep learning.