Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)?

Or are there known vulnerabilities that may cause infection?

share|improve this question
    
What platform are you running? What version? –  nealmcb Mar 18 '11 at 1:02
    
Probably windows 7 - but if there's a solution that is specific to another windows version it's also relevant –  Ophir Yoktan Mar 18 '11 at 15:52
add comment

4 Answers

up vote 13 down vote accepted

There are several known ways that a malicious USB device can compromise your computer:

  • Autorun. The USB device can contain software that Windows will automatically run when you plug in the USB device, if you have autorun enabled.

  • Input device emulation. As @TobyS says, the malicious USB dongle might physically look like a small flash storage device (a dongle), but it can still present itself to the computer as a keyboard or a mouse or somesuch. Then the malicious USB device might start inserting malicious key strokes that subvert your computer.

  • Exploit a vulnerability. The USB device can contain data or files that exploit vulnerabilities in the code that runs on your computer. As @Jeff mentions, this might include exploiting vulnerabilities in the code that displays file icons in your file manager or exploiting vulnerabilities in your anti-virus software when it scans the drive. It might also include exploiting vulnerabilities in the OS filesystem code (I have seen bugs in that code before, which could be exploited by a malicious filesystem image) or a number of other variants. While I don't currently know of any zero-day vulnerabilities with no known fix in the latest Windows OS, there is a lot of code that runs to handle data from a USB device, and you should assume there are probably more vulnerabilities lurking, waiting to be found.

  • Social engineering. The USB device can contain files that, when you double-click on them, launch malware. The file names and icons might be arranged to look tempting, to entice users to click on them. This has been exploited before, and is very challenging to prevent.

Bottom line: disabling autorun is a good start, and stops the easiest form of attack. For a company that doesn't have especially high security needs, it's probably "good enough". (It is good enough for me in my own personal computing.) But don't think it's enough to be completely safe; autorun stops only the first of the attacks mentioned above, and other attacks remain possible, as sketched above. Because of these risks, the military completely bans all USB drives.

share|improve this answer
    
Excellent answer!! –  nealmcb Mar 18 '11 at 17:02
add comment

It may be possible for a USB device to mimic an input device such as a mouse or keyboard and interact with the operating system without any user interaction. However, I have not seen any proof of concept for this, so in all likelihood disabling autorun will provide adequate protection.

share|improve this answer
5  
I have seen a proof on concept for this based on an Android phone. –  WalterJ89 Mar 18 '11 at 1:10
2  
Actually, +1 on that... something in the physical form-factor of a USB key could contain anything for logic that will work via USB, including a keyboard. Just because it looks like a USB flash drive doesn't mean it has to be a USB flash drive. –  Jeff Ferland Mar 18 '11 at 1:23
    
Nice one!, although in my specific case it\s not a major issue as users have limited permissions –  Ophir Yoktan Mar 18 '11 at 15:53
add comment

Possible far-out compromises would include exploiting code that displays file icons in Explorer, or a vulnerability in your anti-virus software...

But as far as realistic and known exploits go, turning off autorun should be sufficient.

share|improve this answer
1  
Hardly "far out" when it has already happened: MS10-046: "Shortcut Icon Loading Vulnerability". But yes, no known and unpatched exploits exists. –  Baffe Boyois Mar 18 '11 at 11:38
    
I was thinking of that particular one when I wrote this, actually. There have also been successful compromises of AV engines in the past. –  Jeff Ferland Mar 18 '11 at 14:22
    
Is there a method to prevent explorer from reading icons, thumbnails, etc.? –  Ophir Yoktan Mar 18 '11 at 15:54
    
I think that is best considered an inherent risk. It probably won't happen again, and there's not much you can reasonably do about it. –  Jeff Ferland Mar 18 '11 at 18:28
1  
I disagree. There are a boatload of USB device specific drivers out there. All you need to do is to fine one of them with a vulnerability and have your USB device pretend to be one of the devices with a buggy driver. If you're worried about targeted attacks, the risks are endless. Just put epoxy in the USB slots. –  Larry Osterman Mar 21 '11 at 4:56
add comment

Stuxnet spread via usb drives using a zero-day attack (Windows systems at risk from Stuxnet attack - ZDNet). There may well be other zero-day usb attacks out there. So as always, I'd say it depends on exactly what software you're running, and on your threat model (see our faq).

share|improve this answer
    
Here is how Stuxnet altered usb drives: symantec.com/connect/blogs/stuxnet-lnk-file-vulnerability –  Jim In Texas Apr 12 '12 at 3:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.