How do malware start from external drives? Especially on Windows (from > Windows 7) commands like Open=Example.exe on an autorun.inf file have been defaulted disabled to not allow auto run when an USB is instantly plugged in.

So how come I see hackers achieve such abilities to spread hidden malware through USB's to the next computer?


Most of the infections come from computers where security is poorly managed so the autorun feature isn't disabled.

Moreover, USB devices are inherently insecure as their firwmare can be rewritten for malicious intent. From SRLabs BadUSB:

Reprogramming USB peripherals: To turn one device type into another, USB controller chips in peripherals need to be reprogrammed. Very widely spread USB controller chips, including those in thumb drives, have no protection from such reprogramming.

(...) Once reprogrammed, benign devices can turn malicious in many ways, including:

1) A device can emulate a keyboard and issue commands on behalf of the logged-in user, for example to exfiltrate files or install malware. Such malware, in turn, can infect the controller chips of other USB devices connected to the computer.

2) The device can also spoof a network card and change the computer’s DNS setting to redirect traffic.

3) A modified thumb drive or external hard disk can – when it detects that the computer is starting up – boot a small virus, which infects the computer’s operating system prior to boot.

Defenses? No effective defenses from USB attacks are known. Malware scanners cannot access the firmware running on USB devices. Behavioral detection is difficult since behavior of an infected device may look as though a user has simply plugged in a new device. Blocking or allowing specific USB device classes and device IDs is possible, however generic lists can easily be bypassed. Pre-boot attacks may be prevented by use of a BIOS password and booting only to the hard drive.

To make matters worse, cleanup after an incident is hard: Simply reinstalling the operating system – the standard response to otherwise ineradicable malware – does not address BadUSB infections at their root. The USB thumb drive, from which the operating system is reinstalled, may already be infected, as may the hardwired webcam or other USB components inside the computer. A BadUSB device may even have replaced the computer’s BIOS – again by emulating a keyboard and unlocking a hidden file on the USB thumb drive.

Once infected, computers and their USB peripherals can never be trusted again.


There are many vectors. In one of my favorite videos from a certain security conference, a guy attacks a laptop running Ubuntu with a regular thumb drive (i.e. no hardware hacks) just by inserting the drive to the computer. Even though there was no autorun, there was automount and indexing. The drive contained a crafted JPEG file which used a flaw in the thumbnail generator to execute arbitrary code. In that case it was killall xscreensaver which basically unlocked the computer. So it's not just autorun and not just Windows but I can imagine this could work on Windows as well provided there is a flaw in indexing or other "automagic" features.

I can't find the video now but if I do, I'll update this answer with it.

  • How is the .jpeg crafted? – user3818650 Jun 8 '15 at 12:13
  • @user3818650 - the JPEG leveraged a 0-day vulnerability that I'm sure has been fixed. You need to have a fresh 0-day vulnerability to do something like that. – Neil Smithline Jun 8 '15 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.