1

If I run a program on a Windows 10 machine, can the program install a virus on an attached USB drive, and can it install a virus into the firmware of the computer to be loaded before the OS/bootloader?

Windows has a function of elevating user priviledges to administrator or something, right? Like a sudo equivalent popup dialog. Or can it do those things with just login in to a user that has administrator rights?

Improve this question
4
  • Writing to a USB drive does not require admin rights.
    – schroeder ♦
    May 10, 2018 at 13:26
  • A lot of malware is designed to acquire admin access without needing the user to grant it. Is this what you are talking about?
    – schroeder ♦
    May 10, 2018 at 13:30
  • I guess so, if that's possible. Like, if I just run a program in regular user space, could that then install some boot stuff to the usb that could install itself onto other operating systems if I boot with the usb attached
    – user177810
    May 10, 2018 at 13:51
  • Yes. That is certainly possible. The malware exploits a vulnerability in the OS or software which grants it access to admin functions, as well as any attached USB. Whether the malware infects other machines through the USB is a completely separate question.
    – schroeder ♦
    May 10, 2018 at 14:14

1 Answer 1

Reset to default
4

If I run a program on a Windows 10 machine, can the program install a virus on an attached USB drive

Yes. You don't need admin access to write to a USB drive.

can it install a virus into the firmware of the computer to be loaded before the OS/bootloader?

It shouldn't be able to. Of course privilege escalation vulnerabilities are found all the time - so if you do not have the latest security updates installed or if the exploit used is previously unknown / microsoft are still working on a fix then should the program use one of these techniques it can do it.

Improve this answer

You must log in to answer this question.