Well the bootkit is undetectable to the compromised OS, but not to another OS booted safely from another boot device (such as a USB stick). As the author expla

Well the bootkit is undetectable to the compromised OS, but not to another OS booted safely from another boot device (such as a USB stick). As the author explains in his slides, only the first read of the MBR will return the bootkit. Subsequent reads will return the legit MBR. So a compromised OS attempting to check its own MBR will see legit data. But an OS booted from another boot device can read the MBR one time and can immediately see the MBR contains non-standard code (eg. not the standard Windows or Grub boot loader) and can conclude it is compromised.