Master Boot Record Inspection for Removable Storage Malware Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures for computers are inadequate in preventing malware infections from removable storage devices, particularly as attackers can compromise the master boot record (MBR) of these devices to install malware, which conventional anti-virus applications may fail to detect.
Innovation Solution
A method that involves reading and inspecting the MBR code of removable storage devices during normal operation to identify suspicious behavior, modifying the MBR code if necessary, and adapting the computer's behavior to prevent malware installation, including displaying warnings, changing the boot sequence, and replacing suspicious code with harmless code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-virus applications are used to scan removable storage devices, then basic malware detection is provided, but infections from compromised MBR code remain undetected
Solution Approach 1:
The system performs preliminary inspection of the MBR code on removable storage devices before the device is allowed to boot or execute. By analyzing the MBR code in advance and identifying suspicious instructions (such as hard disk read/write operations) before execution, the system prevents malware installation at the boot level, which conventional anti-virus applications miss.
Solution Approach 2:
The system introduces an intermediary security layer between the removable storage device and the computer's boot process. This intermediary mechanism intercepts and analyzes MBR code, acting as a mediator that prevents malicious code from reaching the boot process while allowing legitimate devices to proceed normally.
2Ease of operation
If users rely on conventional anti-virus applications to protect against removable storage device infections, then basic security is maintained, but users remain vulnerable to social engineering attacks
Solution Approach 1:
The system provides immediate feedback to users when suspicious MBR code is detected on a removable storage device. By displaying warning messages that inform users of potential malware threats, the system enables users to make informed decisions about whether to proceed with using the device, thereby breaking the social engineering chain of trust.
3Productivity
If the computer boots from removable storage devices without inspection, then normal boot operation is maintained, but malware can be installed via compromised MBR code
Solution Approach 1:
The system performs MBR code inspection as a preliminary action during the boot process, before executing any code from the removable storage device. This preliminary analysis identifies suspicious instructions in advance, allowing the system to prevent malware installation while maintaining normal boot operation for legitimate devices.
Solution Approach 2:
The system applies preliminary anti-action by blocking the execution of suspicious MBR code before it can infect the system. By identifying and preventing malicious code execution at the outset, the system neutralizes the threat before it can manifest, while allowing legitimate boot operations to proceed uninterrupted.
Data Source
AI summary
A method of protecting a computer against malware infection. The method includes during operation of the computer, reading master boot record code from a removable storage device into the computer and inspecting said code to identify any instructions associated with suspicious behaviour. In the event that suspicious instructions are identified, the master boot record code on the removable storage device is modified and/or the behaviour of the computer adapted in order to prevent said master boot record code installing malware into the computer. Examples of suspicious behaviour include hard disk read or write operations.