Hibernation File Attack http://web17.webbpro.de/index.php?page=hibernation-file-attack

The idea behind the hibernation file attack is to inject code into the hibernation file when the system is hibernated. The unsigned code will be written into hibernation file directly before Windows starts - and when Windows processes a system resume, the modified kernel will be loaded. The injection is done via an own modified Master Boot Record. The MBR is executed before winresume.exe and is able to modify the hibernation file (hiberfil.sys) via its own file system drivers (FAT and NTFS). The MBR will be written to disk by a normal application using raw sector access.

Peter Kleissner, Software Engineer (AUSTRIA)
http://web17.webbpro.de/index.php?page=peter-kleissner

The presentation was rejected by the Black Hat Review Board, any information here is provided as-is. The presentation WAS NOT presented at Black Hat and any material here appear as given to Black Hat Europe 2009 CFP.

Download the Hibernation File Attack Presentation
http://web17.webbpro.de/downloads/Hibernation%20File%20Attack/Presentation.pdf

- Main Presentation
- Hibernation File Format
- virus-description language
- References
- Internal Test Tools
- Infector
- Black Hat Europe 2009 Call For Papers

The main source code, the Master Boot Record and all its modules, is not available for download now. It will be made available with my "Stoned" project. If you have any interest in it feel free to contact me. The reason for not publishing it is that the Source Code can load ANY MALICIOUS UNSIGNED CODE into kernel, even in Vista, and Windows 7.

If you have any question regarding the Hibernation File Attack, please contact me using the secured contact form.

Last modified: 28 February 2009