Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Why is it possible to overwrite the boot sector so trivially in Windows? I just had a little coding accident involving writing to a raw physical disk, and I messed up the arithmetic and ended up zeroing the boot sector (rookie failure, I admit). Easily fixed though. But shouldn't an OS give some kind of warning when some random program attempts to write on the boot sector (which is arguably the most important section of the hard drive's data, since without it, the hard drive isn't recognized)?

My antivirus didn't even pick up my program, I shudder at the thought of a virus just coming along and innocently overwriting my boot sector. I mean surely this kind of stuff qualifies as "potentially damaging", right?

It's not a big deal but I was surprised to see it was even possible. Are there any ways to have Windows restrict access to the boot sector so that I (or another more nefarious program) cannot screw it up again?

share|improve this question
    
Was it running as administrator? Cause I'd be even more worried if it could do that without elevation. –  Bob Apr 20 '12 at 12:20
    
Yes, it was running with adminstrator privileges (thank god). –  Thomas Apr 20 '12 at 12:22
4  
Well, why shouldn't it be possible? Because people who develop low level software and run it with elevated privileges without proper safeguards get burnt? No different from rm -rf on Linux or a number of other dangerous commands. –  Daniel Beck Apr 20 '12 at 12:46
1  
@DanielBeck Except, since Vista, important system files only give write access to TrustedInstaller by default. Sure, it's possible to take ownership, but the standard Administrator account can't modify them, unlike Linux's root. In fact, system, the equivalent to root in terms of permissions, doesn't have write access. If it is possible to modify system files/binaries with normal elevation (of course, needing to read the NTFS file system somehow), then that could be seen as a security flaw... –  Bob Apr 20 '12 at 15:04
    
Malware does write to the boot sector now, and is very popular way to make the infection persistent even after successful removal from the OS, it re-installs itself on every boot by running code stored in the boot sector long before windows loads, some advanced malware actually stores additional code in the second K of the hard drive which is currently unused by anything else, and not well known by most. How it does this without being flagged in windows is always changing. –  Moab Apr 20 '12 at 16:01

1 Answer 1

up vote 6 down vote accepted

Why was this possible?

  • The Software was running with administrator privileges

Why didn't the AV pick up my program?

  • Your AV probably doesn't support behavior-based detection.
  • Your AV assumed it's not a computer virus because those want to spread themselves and not instantaneously kill Windows. This would be negligent because:
  • Malware does write to the boot sector now, and is very popular way to make the infection persistent even after successful removal from the OS, it re-installs itself on every boot by running code stored in the boot sector long before windows loads, some advanced malware actually stores additional code in the second K of the hard drive which is currently unused by anything else, and not well known by most. How it does this without being flagged in windows is always changing. – Moab

Shouldn't an OS give some kind of warning when some random program attempts to write on the boot sector?

  • Yes it should. With a big UAC-style popup window.
  • Since Vista, important system files only give write access to TrustedInstaller by default. Sure, it's possible to take ownership, but the standard Administrator account can't modify them, unlike Linux's root. In fact, system, the equivalent to root in terms of permissions, doesn't have write access. If it is possible to modify system files/binaries with normal elevation (of course, needing to read the NTFS file system somehow), then that could be seen as a security flaw... – Bob
share|improve this answer
1  
Add to that, various BIOS versions have allowed for boot sector protection, but it requires you make that buying decision, and then to actually turn it on. –  Fiasco Labs Apr 21 '12 at 15:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.