search

Cisco-Talos / MBRFilter

Cisco Talos MBR Filter Driver
https://talosintelligence.com/mbrfilter
GNU General Public License v2.0
336 stars 72 forks source link

Do not write usb flash device bootable Windows #11

Open Prodif opened 7 years ago

Prodif commented 7 years ago

Do not write usb flash device bootable Windows, utility - yumi multi boot or rufus. Eror write. Win 7 x64

mcprat commented 7 years ago

I also discovered this a while ago.

This is exactly the intended purpose of MBRFilter and this error lets you know that it is working. It should be a little more clear, but MBRFilter protects the boot sector of EVERY drive, yes, even removable drives (although I don't quite see the reason for that).

tl;dr You cannot make a USB bootable drive on a computer with MBRFilter because this requires the boot sector of the USB drive to be overwritten, and MBRFilter is stopping that by design.

vrtadmin commented 7 years ago

@mpratt good thing it does that by design, since a recent attack (Nyetya) actually had an effect on removable USB drives as well.

yyounan commented 7 years ago

You can still write to sector 0 on any drive by booting into safe mode, that will prevent MBRFilter from protecting drives. That's less convenient than the default behavior obviously, but it's a bit of a trade off there.

mcprat commented 7 years ago

@vrtadmin good to know and very good design indeed. However, I think there should still be a little warning about this as many people would not expect it to do anything other than protect the OS drive. When the error first happened to me I was searching around for about an hour before I realized it was something I did myself by adding the program.

Pretty sure Rufus and the like will not run in safe mode anyway, so you're still better off using another computer or disabling the filter for this.

Prodif commented 7 years ago

mpratt14 How to properly disable this filter?