9

If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)?

Or are there known vulnerabilities that may cause infection?

2
  • What platform are you running? What version?
    – nealmcb
    Commented Mar 18, 2011 at 1:02
  • Probably windows 7 - but if there's a solution that is specific to another windows version it's also relevant Commented Mar 18, 2011 at 15:52

5 Answers 5

16

There are several known ways that a malicious USB device can compromise your computer:

  • Autorun. The USB device can contain software that Windows will automatically run when you plug in the USB device, if you have autorun enabled.

  • Input device emulation. As @TobyS says, the malicious USB dongle might physically look like a small flash storage device (a dongle), but it can still present itself to the computer as a keyboard or a mouse or somesuch. Then the malicious USB device might start inserting malicious key strokes that subvert your computer.

  • Exploit a vulnerability. The USB device can contain data or files that exploit vulnerabilities in the code that runs on your computer. As @Jeff mentions, this might include exploiting vulnerabilities in the code that displays file icons in your file manager or exploiting vulnerabilities in your anti-virus software when it scans the drive. It might also include exploiting vulnerabilities in the OS filesystem code (I have seen bugs in that code before, which could be exploited by a malicious filesystem image) or a number of other variants. While I don't currently know of any zero-day vulnerabilities with no known fix in the latest Windows OS, there is a lot of code that runs to handle data from a USB device, and you should assume there are probably more vulnerabilities lurking, waiting to be found.

  • Social engineering. The USB device can contain files that, when you double-click on them, launch malware. The file names and icons might be arranged to look tempting, to entice users to click on them. This has been exploited before, and is very challenging to prevent.

Bottom line: disabling autorun is a good start, and stops the easiest form of attack. For a company that doesn't have especially high security needs, it's probably "good enough". (It is good enough for me in my own personal computing.) But don't think it's enough to be completely safe; autorun stops only the first of the attacks mentioned above, and other attacks remain possible, as sketched above. Because of these risks, the military completely bans all USB drives.

0
7

It may be possible for a USB device to mimic an input device such as a mouse or keyboard and interact with the operating system without any user interaction. However, I have not seen any proof of concept for this, so in all likelihood disabling autorun will provide adequate protection.

3
  • 5
    I have seen a proof on concept for this based on an Android phone.
    – WalterJ89
    Commented Mar 18, 2011 at 1:10
  • 2
    Actually, +1 on that... something in the physical form-factor of a USB key could contain anything for logic that will work via USB, including a keyboard. Just because it looks like a USB flash drive doesn't mean it has to be a USB flash drive.
    – Jeff Ferland
    Commented Mar 18, 2011 at 1:23
  • Nice one!, although in my specific case it\s not a major issue as users have limited permissions Commented Mar 18, 2011 at 15:53
5

Possible far-out compromises would include exploiting code that displays file icons in Explorer, or a vulnerability in your anti-virus software...

But as far as realistic and known exploits go, turning off autorun should be sufficient.

5
  • 1
    Hardly "far out" when it has already happened: MS10-046: "Shortcut Icon Loading Vulnerability". But yes, no known and unpatched exploits exists. Commented Mar 18, 2011 at 11:38
  • I was thinking of that particular one when I wrote this, actually. There have also been successful compromises of AV engines in the past.
    – Jeff Ferland
    Commented Mar 18, 2011 at 14:22
  • Is there a method to prevent explorer from reading icons, thumbnails, etc.? Commented Mar 18, 2011 at 15:54
  • I think that is best considered an inherent risk. It probably won't happen again, and there's not much you can reasonably do about it.
    – Jeff Ferland
    Commented Mar 18, 2011 at 18:28
  • 1
    I disagree. There are a boatload of USB device specific drivers out there. All you need to do is to fine one of them with a vulnerability and have your USB device pretend to be one of the devices with a buggy driver. If you're worried about targeted attacks, the risks are endless. Just put epoxy in the USB slots. Commented Mar 21, 2011 at 4:56
5

Stuxnet spread via usb drives using a zero-day attack (Windows systems at risk from Stuxnet attack - ZDNet). There may well be other zero-day usb attacks out there. So as always, I'd say it depends on exactly what software you're running, and on your threat model (see our faq).

1
0

Social engineering is the big risk to most companies. There was a nice demonstration of this where a security auditor was employed by a company to test their systems.

  • He brought a set of USB devices, including some with the company logo on them.
  • Put files on them that installed warms when executed etc
  • Name these files so that employees of the company where likely to run them, e.g. “cooperation rearrangement”, or “profit warning”.
  • Drops some of the USB devices in the company car park.

Needless to say it worked!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .