Hacker News Reader

I don't see what makes a compiler in the boot sector scarier in malware terms than any other program… would you elaborate?

Like, how does the malware benefit shipping its own source code and a tiny compiler at boot time, over just booting directly into the compiled malware?

That sort of attack has been around for a very, very long time.

> Th end solution ... destroy the box.

Or reformat the disk, or even just write over the boot sector with something else (proper boot code, zeros, or even garbage).

Some viruses intercept the interrupt handler, detect if you're trying to write to the boot sector, then either fake a write or change the sector. I believe some forms of ParityBoot (B?) did this. So you need to be sure you're booting from a clean medium, which in the case of some of these boot viruses might not be that easy since a lot of your disks and floppies might have been infected already.

Some viruses also used extra space at the end of the partition table or the end of the disk to store themselves so they wouldn't be limited to the 512 byte limit (minus the metadata in the boot sector).

spooky code running code!