Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?

Question

If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)?

Or are there known vulnerabilities that may cause infection?

Answer 1

There are several known ways that a malicious USB device can compromise your computer:

• Autorun. The USB device can contain software that Windows will automatically run when you plug in the USB device, if you have autorun enabled.

• Input device emulation. As @TobyS says, the malicious USB dongle might physically look like a small flash storage device (a dongle), but it can still present itself to the computer as a keyboard or a mouse or somesuch. Then the malicious USB device might start inserting malicious key strokes that subvert your computer.

• Exploit a vulnerability. The USB device can contain data or files that exploit vulnerabilities in the code that runs on your computer. As @Jeff mentions, this might include exploiting vulnerabilities in the code that displays file icons in your file manager or exploiting vulnerabilities in your anti-virus software when it scans the drive. It might also include exploiting vulnerabilities in the OS filesystem code (I have seen bugs in that code before, which could be exploited by a malicious filesystem image) or a number of other variants. While I don't currently know of any zero-day vulnerabilities with no known fix in the latest Windows OS, there is a lot of code that runs to handle data from a USB device, and you should assume there are probably more vulnerabilities lurking, waiting to be found.

• Social engineering. The USB device can contain files that, when you double-click on them, launch malware. The file names and icons might be arranged to look tempting, to entice users to click on them. This has been exploited before, and is very challenging to prevent.

Bottom line: disabling autorun is a good start, and stops the easiest form of attack. For a company that doesn't have especially high security needs, it's probably "good enough". (It is good enough for me in my own personal computing.) But don't think it's enough to be completely safe; autorun stops only the first of the attacks mentioned above, and other attacks remain possible, as sketched above. Because of these risks, the military completely bans all USB drives.

Answer 2

It may be possible for a USB device to mimic an input device such as a mouse or keyboard and interact with the operating system without any user interaction. However, I have not seen any proof of concept for this, so in all likelihood disabling autorun will provide adequate protection.

Answer 3

Possible far-out compromises would include exploiting code that displays file icons in Explorer, or a vulnerability in your anti-virus software...

But as far as realistic and known exploits go, turning off autorun should be sufficient.

Answer 4

Stuxnet spread via usb drives using a zero-day attack (Windows systems at risk from Stuxnet attack - ZDNet). There may well be other zero-day usb attacks out there. So as always, I'd say it depends on exactly what software you're running, and on your threat model (see our faq).

Answer 5

Social engineering is the big risk to most companies. There was a nice demonstration of this where a security auditor was employed by a company to test their systems.

• He brought a set of USB devices, including some with the company logo on them.
• Put files on them that installed warms when executed etc
• Name these files so that employees of the company where likely to run them, e.g. “cooperation rearrangement”, or “profit warning”.
• Drops some of the USB devices in the company car park.

Needless to say it worked!