MBRFilter: Ransomware threats have increased exponentially and malware developers have started to use the MBR (Master Boot Record) in their attacks. In short? It locks the entire computer, not just a few tabs with important files.
Cisco Systems' Talos team has released a free, open-source tool that protects computers' MBR sector from modification by bootkits, ransomware, and other malicious attacks.
The Master Boot Record (MBR) is the first sector (512 bytes) on your hard drive that stores the bootloader, a piece of code responsible for starting the operating system. Technically, the Bootloader is the first code executed by the system BIOS and tells your computer what to do when it starts up.
Advanced malware, such as rootkits and bootkits, exploit this process to infect computers by modifying the MBR.
A malicious bootloader, or bootkit, has the ability to install ransomware or other malware into the Windows kernel, which is nearly impossible to detect, and thus gain unlimited and unauthorized access to your entire computer.
So, the best way to protect your computer from such bootkits is to restrict your MBR from being overwritten by unauthorized software.
Cisco's security team, Talos team, took care of doing this with the following free software.
You can find it here.
The MBRFilter tool is nothing more than a signed system driver that puts the MBR in a “read-only” state and prevents any malware from modifying the MBR partition data.
