2

Am I really understanding things correctly if I claim that:

  1. If a USB stick/device is inserted into a PC running Windows, currently in "lock screen" mode (that is, somebody has pressed WinKey + L), it will auto-mount it behind the scenes?
  2. If a USB stick/device is inserted into a PC running Windows, currently NOT in "lock screen" mode, it will auto-mount it by default?
  3. In both cases above, will it ever run any kind of executable found on it by default? (Like which I believe used to be the case for setup.exe on CD-ROMs back in the day.)
  4. Regardless of all of the above, will Windows ever auto-install DRIVERS found on the device itself when inserted into the PC (with or without lock screen)? Or is just the "device id" grabbed from the stick/device and then the appropriate drivers are downloaded from Microsoft's secure, curated servers based on the device id?
  5. Why exactly are "drivers" needed whatsoever? Isn't it using the USB standard? And also the "mass storage" standard? I don't understand why it would ever need special "drivers" for a standard device...?
  6. Is the idea that sticking a USB stick/device into a PC is insecure in itself complete nonsense? Is not the truth that the user would have to actively select "Yes, please install the drivers from this random unknown device" or "Yes, please run this untrusted EXE found on this stick you just inserted and which I auto-mounted for you but would never run anything on without your active consent"? I get the same feeling as when people claim to get "hacked" constantly, but then it turns out they ran some binary e-mail attachment or clicked a big red box saying: "WARNING! Do you really want to run this EXE from sketchy-hack-toolz-4-u.example?"... but nothing would surprise me at this point, frankly.

I wonder this both for the current Windows 10 and also for all previous versions of Windows.

Improve this question
1
  • 1
    a usb stick is relatively safe now. but some bad things can be camouflaged as a usb stick.
    – dandavis
    Feb 2, 2020 at 3:00

2 Answers 2

Reset to default
1
  1. If a USB stick/device is inserted into a PC running Windows, currently in "lock screen" mode (that is, somebody has pressed WinKey + L), it will auto-mount it behind the scenes?

Yes it does! I had originally said "No" but it dawned on me that I had not actually verified that so I tested it this morning. It turns out that it does indeed mount even though the screen is locked. I also tried it on a screen locked Linux machine and found that the physical device can be accessed but the partition is not actually mounted.

This is how I tested:

I took an absolutely clean (verified via Linux) thumb drive formatted in Fat32 and plugged it into a screen locked Windows 10 machine and waited several seconds before unplugging it. Then I examined the thumb drive on my Linux machine.

Windows (and Macs) default write hidden identifiers to thumb drives when plugged in if they don't already have one. Sure enough, the previously clean thumb drive now had the hidden Windows identifiers on it. This showed that Windows not only mounted it but performed both a read and write to the thumb drive.

  1. If a USB stick/device is inserted into a PC running Windows, currently NOT in "lock screen" mode, it will auto-mount it by default?

Yes! It will also enable USB devices that are not block storage devices.

  1. In both cases above, will it ever run any kind of executable found on it by default? (Like which I believe used to be the case for setup.exe on CD-ROMs back in the day.)

No, under normal configuration now days it will not auto run a file from a block storage device or a USB connected CD. However Human Interface Devices (HID) such as a keyboard are enabled.

Previous versions of Windows did auto run files from CD's but never thumb drives, however manufacturers produced U3 thumb drives that were actually two devices in one, mass storage and a faux CD device that would auto-run files, so it looked like the thumb drive was auto running.

There are USB devices that look like thumb drives but are not. The classic example is a Rubber Ducky. It looks like a thumb drive but is actually a pre-programmed keyboard that can auto type any command that you could from a keyboard, and it auto runs upon being plugged in. There are similar devices, such as a Bash Bunny, that can act as multiple devices at once, becoming both a mass storage thumb drive and a programmed keyboard, allowing it to store the results of the commands issued as a keyboard.

All of the similar devices I'm familiar with are designed to function under USB-2, which does not support DMA bus mastering. Firewire supported bus mastering which made it possible for a master device to directly access computer memory on some machines that failed to securely initialize their their DMA control maps. USB-3 supports DMA, but I have no idea if something similar to Firewire is possible.

Improve this answer
0

  1. a. autorun is disabled on modern OSes.

    b. but IDK if other software access the content, if they have vulnrs, it can be possible to exploit them. For example a a lnk to cpl exploit used by StuxNet.

  2. it is very naïve to think that drivers got from MS are secure and have no vulnrs.

  3. there is such a thing as an universal driver.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .