51

Assuming that I'm using a trusted USB flash drive (meaning that it's not some device that looks like a USB drive and whose purpose is to damage my PC), is it possible for my PC to get infected from some malware picked up by the USB if I'm running an antivirus program that doesn't allow any autorun.inf files to run from the USB drive? I have two PCs, one running Windows 10 and the other running Windows 8.1.

Improve this question
3

3 Answers 3

Reset to default
56

Short answer: YES

You can be infected even with a full patched Windows system and an updated antivirus. This happened before and can happen again.

A few years ago, the Stuxnet worm was specially engineered to attack the Iranian nuclear facilities. They got hit by using infected USB drives, without autorun.inf or executing anything by hand.

Those vulnerabilities are called zero day. The attacker knows it, but the vendor and antivirus companies does not. But those vulnerabilities are very prized, and will not be used on a low-value target, because as soon as the attack is detected, it's not a zero-day anymore.

If you are not a high-value target, you usually don't have to worry about being hit by a zero-day. Usually you will get hit by an social engineering attack, and probably will step onto the trap by yourself, like opening an executable file with the icon of a pdf or a picture...

Improve this answer
9
  • 13
    USB sticks dropped in the car park works for low value targets, too.
    – Michael Hampton
    Nov 26, 2015 at 15:26
  • 1
    Can you include an example of the type of zero-day that could infect a computer without any software being executed?
    – Mike Ounsworth
    Nov 26, 2015 at 19:01
  • 8
    Mike: Stuxnet is an example which is listed in this answer. They used a vulnerability with the rendering of shortcut icons to allow their payload to launch simply by viewing the drive's contents in Explorer.
    – mm201
    Nov 26, 2015 at 20:03
  • 6
    @mm201 Thanks. My point was that simply linking to something, or dropping a name does not help people who want to scan for quick information and does not really qualify as "included in the answer". The Help Center is clear that you should include all relevant information so that your answer is self-contained.
    – Mike Ounsworth
    Nov 26, 2015 at 21:56
  • 2
    Note: This is on the same scale of probability as your chance of being infected by opening a webpage.
    – user253751
    Nov 27, 2015 at 5:33
33

Yes,

  1. BadUSB turns benign (USB) devices into malicious monsters by reprogramming the controller chips. This is on a much lower level than the 'autorun' feature that you are talking about.
  2. USB Rubber Ducky is another, comparable threat.
  3. Like ThoriumBR said, any host machine can be exploited by some unknown zero-day vulnerability.

There are not many practical ways to protect against this [BadUSB] type of attack. Most of them heavily impact user-friendliness:

  • Blacklist USB devices
  • Prevent automatic installation of USB devices
  • Disable inactive USB ports
Improve this answer
8
  • 1
    BadUSB can affect almost any USB flash drive, correct? But isn't Rubber Ducky a device that just looks like a USB flash drive? (meaning that it couldn't infect what I'd consider a trusted USB flash drive in the question description above)
    – Jorge Luque
    Nov 26, 2015 at 14:19
  • 1
    @JorgeLuque, Rubber Ducky is actually a keyboard, that looks like a USB. BadUSB is indeed worse, as any USB can be a BadUSB.
    – Michael
    Nov 26, 2015 at 14:33
  • 1
    Does running Linux help against these issues in any way?
    – Gui Imamura
    Nov 27, 2015 at 15:22
  • 1
    @Clearer Your short answer is "yes", but your long answer sounded like it was "no". Anyway do these malwares always target a specific OS, or can some of them infect any machine regardless of its OS?
    – Gui Imamura
    Nov 27, 2015 at 23:31
  • 1
    @GuiImamura My long answer should sound like a "no". Any particular USB device may target any particular system, whether that is based on Linux, Windows, Mac OS or any other operating system. It's all a matter of identifying some weakness and exploiting it. The short answer should have been a "no". My mistake.
    – Clearer
    Nov 29, 2015 at 9:40
-11

As long as you don't manually find and run the infected file you should be okay, provided your antivirus does it's job.

As another answer mentions, it is fully possible, but very unlikely in your case, nothing more you can do as you are already taking the precautions for this particular threat.

Improve this answer
1
  • 6
    Not true. Many pieces of malware can circumvent antivirus solutions, and antivirus software will not detect 0-days. There is also something more you can do - not plug in a flash drive at all or testing it on another machine first. See BadUSB for some examples.
    – WillS
    Nov 28, 2015 at 6:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .