49

Assuming that I'm using a trusted USB flash drive (meaning that it's not some device that looks like a USB drive and whose purpose is to damage my PC), is it possible for my PC to get infected from some malware picked up by the USB if I'm running an antivirus program that doesn't allow any autorun.inf files to run from the USB drive? I have two PCs, one running Windows 10 and the other running Windows 8.1.

58

Short answer: YES

You can be infected even with a full patched Windows system and an updated antivirus. This happened before and can happen again.

A few years ago, the Stuxnet worm was specially engineered to attack the Iranian nuclear facilities. They got hit by using infected USB drives, without autorun.inf or executing anything by hand.

Those vulnerabilities are called zero day. The attacker knows it, but the vendor and antivirus companies does not. But those vulnerabilities are very prized, and will not be used on a low-value target, because as soon as the attack is detected, it's not a zero-day anymore.

If you are not a high-value target, you usually don't have to worry about being hit by a zero-day. Usually you will get hit by an social engineering attack, and probably will step onto the trap by yourself, like opening an executable file with the icon of a pdf or a picture...

  • 13
    USB sticks dropped in the car park works for low value targets, too. – Michael Hampton Nov 26 '15 at 15:26
  • 1
    Can you include an example of the type of zero-day that could infect a computer without any software being executed? – Mike Ounsworth Nov 26 '15 at 19:01
  • 8
    Mike: Stuxnet is an example which is listed in this answer. They used a vulnerability with the rendering of shortcut icons to allow their payload to launch simply by viewing the drive's contents in Explorer. – mm201 Nov 26 '15 at 20:03
  • 6
    @mm201 Thanks. My point was that simply linking to something, or dropping a name does not help people who want to scan for quick information and does not really qualify as "included in the answer". The Help Center is clear that you should include all relevant information so that your answer is self-contained. – Mike Ounsworth Nov 26 '15 at 21:56
  • 2
    Note: This is on the same scale of probability as your chance of being infected by opening a webpage. – immibis Nov 27 '15 at 5:33
34

Yes,

  1. BadUSB turns benign (USB) devices into malicious monsters by reprogramming the controller chips. This is on a much lower level than the 'autorun' feature that you are talking about.
  2. USB Rubber Ducky is another, comparable threat.
  3. Like ThoriumBR said, any host machine can be exploited by some unknown zero-day vulnerability.

There are not many practical ways to protect against this [BadUSB] type of attack. Most of them heavily impact user-friendliness:

  • Blacklist USB devices
  • Prevent automatic installation of USB devices
  • Disable inactive USB ports
  • 1
    BadUSB can affect almost any USB flash drive, correct? But isn't Rubber Ducky a device that just looks like a USB flash drive? (meaning that it couldn't infect what I'd consider a trusted USB flash drive in the question description above) – Jorge Luque Nov 26 '15 at 14:19
  • 1
    @JorgeLuque, Rubber Ducky is actually a keyboard, that looks like a USB. BadUSB is indeed worse, as any USB can be a BadUSB. – Michael Nov 26 '15 at 14:33
  • 1
    Does running Linux help against these issues in any way? – Gui Imamura Nov 27 '15 at 15:22
  • 1
    @Clearer Your short answer is "yes", but your long answer sounded like it was "no". Anyway do these malwares always target a specific OS, or can some of them infect any machine regardless of its OS? – Gui Imamura Nov 27 '15 at 23:31
  • 1
    @GuiImamura My long answer should sound like a "no". Any particular USB device may target any particular system, whether that is based on Linux, Windows, Mac OS or any other operating system. It's all a matter of identifying some weakness and exploiting it. The short answer should have been a "no". My mistake. – Clearer Nov 29 '15 at 9:40
-10

As long as you don't manually find and run the infected file you should be okay, provided your antivirus does it's job.

As another answer mentions, it is fully possible, but very unlikely in your case, nothing more you can do as you are already taking the precautions for this particular threat.

  • 6
    Not true. Many pieces of malware can circumvent antivirus solutions, and antivirus software will not detect 0-days. There is also something more you can do - not plug in a flash drive at all or testing it on another machine first. See BadUSB for some examples. – WillS Nov 28 '15 at 6:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.