Updated: Microsoft Security Advisory (967940)

Update to the AutoPlay functionality in Windows

The MS KB article 971029 MS listed this as an optional update on Windows Update.

Many have missed this, folks may consider applying this.

MS have promised to move this update from Optional to Important within a short time.

The update packages are there for you to choose and install or you may choose to use Windows Update.

 

Re: Update to the AutoPlay functionality in Windows

Thank for highlighting the update. From security point, I consider it both useful and important

 

Re: Update to the AutoPlay functionality in Windows

It looks to apply to Vista, XP, Server '03 & '08.

 

Does this refer to the U3 type of flash drive?

thanks,

rich

 

I think so. Those will not be blocked, I guess, even if their firmware contains something autostart function

 

Thanks, Cudni.

I assumed so, therefore, I don't see the purpose of this update, since it doesn't block one of the most successful attack vectors, an infected Flash drive.

It can't, of course, because (I assume) Windows wouldn't be able to distinguish between a true CD-ROM and CD-ROM emulation, and Microsoft doesn't want to break Autorun with AutoPlay for CD-ROM/DVD-ROM.

At least that is how it appears to me.

Am I correct?

thanks,

rich

 

Those replying to my merged post with Ron's will get an invalid link
https://www.wilderssecurity.com/showthread.php?t=292961&goto=newpost

 

well if firmware is infected then the supplier has a lot to answer meanwhile other things are blocked

 

This is true, but the threat is not from the supplier, but from possible infection later. From an old Hijack forum:

infections on pendrive
http://www.computing.net/answers/security/infections-on-pendrive/19560.html

Every so often Autoplay/Autorun is revisited in the security media. I and a few others were discussing this last week, and we always re-evaluate our own policies/procedures for users, to see if anything needs to be changed.

Mine have been the same for many years, as the threats have not changed:

1) Avoid connecting your USB external drives to another computer -- no potential USB virus can infect.

2) Avoid Flash drives with CD-ROM emulation. Therefore, if you must connect the flash drive to another computer in order to transfer files, it cannot initiate an autorun.inf exploit, should it become infected by a USB virus from the other computer.

3) If you do permit someone else to connect a CD-ROM, or a Flash drive to your for the purpose of transferring files, autorun can be temporarily supressed by holding down the SHIFT key:

Enabling and Disabling AutoRun
http://msdn.microsoft.com/en-us/library/cc144204(v=vs.85).aspx

(this also applies to USB media)

Then, open Windows Explorer (not My Computer) to the drive to view the contents.

4) Have protection in place against unauthorized executables, in case of any mishaps.

Some years ago, it was suggested that CDs made by another person could be infected. I made a test showing how 4) above would protect in case the user trustingly inserted a CD made by someone else and passed around:

Code:

[autorun]
open=disksetup

(BTW - this would have alerted to the potential Sony Rootkit. The user may have decided afterwards to permit the installation of the software, but at least the autorun part would have been thwarted)

Again, I don't see how this particular update is very comforting, since a potential attack vector remains unsecured.

----
rich

 

The way I understand firmware, although still code, is that it should be much harder to infiltrate in order to subvert. And supplier that allows such kind of hacks would not stay a supplier for long.

 

You will have to explain what you mean by infiltrate firmware.

Anyone can infect a Flash drive by just copying an autorun.inf file + malware executable to the drive. If the drive is CD-ROM emulation, then just connecting it to a computer runs the exploit (unless the user has other protective measures in place.)

That is how I understood the infections I referenced in the earlier post.

Am I missing something else?

thanks,

rich

 

patch should block autorun.inf, whoever or however it is added, but it will not block whatever custom programs is in the firmware on that usb

 

OK, thanks.

rich