What are the security implications of autorun and external drives?

Question

I have some questions about the security implications of accessing internal and external storage since I cant find any more information on it from what I've read. I have read about a variety of exploits (for example buffer overflows) and technologies designed to defend against them (DEP, ASLR, etc) but understand that no system is perfect.

What precautions can we take upon accessing external drive (manly to access media data) where we cant be sure about the safety of all datas contained?

From what I've read some good advice is to turn off autorun and have antivirus software activated. Does that mean it will then be safe to access any media file there? Or is there more to it? Would manually scanning the file before accessing it impact anything?

Secondly about internal drive; does Windows security and antivirus and other security software act differently when scanning an internal drive in comparison to an external drive?

For example, the feature to turn off autorun for an external drive - for internal drives does this mean everything could autorun unknowingly, hidden, etc?

The intention behind my question is to get input of more measures I can take to be safer. Is simply having an activated antivirus program, firewall, etc, enough or what further steps can I take to decrease my vulnerability?

Answer 1

From what I've read some good advice is to turn off autorun and have antivirus software activated.

The reason you'd disable autorun is to prevent the OS from following the contents of the autorun.inf file on the root of the external media to perform whatever action it is configured to do. Usually this is used for automatically launching software when media is inserted or connected, for example the software setup application when you insert the installation media for a piece of software. Ideally you would always have autorun completely disabled for all drives.

Does that mean it will then be safe to access any media file there?

Nothing is ever completely "safe". There is nothing stopping you from running a file containing a virus or other nasty that your antivirus doesn't recognize and therefore doesn't stop. That said, the majority of media files are not natively executable, there are some exceptions like the Active Streaming Format (ASF) which execute content via a compatible media player but in general this isn't an attack vector.

Would manually scanning the file before accessing it impact anything?

No - any modern antivirus solution will have what is called an on access scanner. What this means is essentially every time you open a file, it is scanned before it is executed (or passed off to the associated application to open).

Secondly about the internal drive, does Windows security and antivirus and other security software act more loose on internal drive than external drive?

In general, no - there is no difference. The long answer is that this is entirely down to the feature set of your Anti Virus software and how you have your Anti Virus software configured, in some AV software you can configure exceptions, adding files or folders or drives to your exceptions list would prevent them from being scanned.

Is simply having an activated antivirus program, firewall, etc, enough? what further steps can I take to decrease my vulnerability?

Regardless of the software you have installed "protecting" you, none of it makes up for user... naivety... Your concept of "enough" shows complacency, which is literally half of the problem.

The most important security measure you can deploy is common sense.

After common sense, keeping your applications up to date to ensure they're not the attack vector that gets exploited.