1

If I run a program on a Windows 10 machine, can the program install a virus on an attached USB drive, and can it install a virus into the firmware of the computer to be loaded before the OS/bootloader?

Windows has a function of elevating user priviledges to administrator or something, right? Like a sudo equivalent popup dialog. Or can it do those things with just login in to a user that has administrator rights?

  • Writing to a USB drive does not require admin rights. – schroeder May 10 '18 at 13:26
  • A lot of malware is designed to acquire admin access without needing the user to grant it. Is this what you are talking about? – schroeder May 10 '18 at 13:30
  • I guess so, if that's possible. Like, if I just run a program in regular user space, could that then install some boot stuff to the usb that could install itself onto other operating systems if I boot with the usb attached – simernes May 10 '18 at 13:51
  • Yes. That is certainly possible. The malware exploits a vulnerability in the OS or software which grants it access to admin functions, as well as any attached USB. Whether the malware infects other machines through the USB is a completely separate question. – schroeder May 10 '18 at 14:14
4

If I run a program on a Windows 10 machine, can the program install a virus on an attached USB drive

Yes. You don't need admin access to write to a USB drive.

can it install a virus into the firmware of the computer to be loaded before the OS/bootloader?

It shouldn't be able to. Of course privilege escalation vulnerabilities are found all the time - so if you do not have the latest security updates installed or if the exploit used is previously unknown / microsoft are still working on a fix then should the program use one of these techniques it can do it.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.