US-CERT Says Microsoft's Advice On Downadup Worm Bogus

CWmike writes "Microsoft's advice on disabling Windows' 'Autorun' feature is flawed, the US Computer Emergency Readiness Team (US-CERT) said today, and it leaves users who rely on its guidelines to protect their PCs against the fast-spreading Downadup worm open to attack. US-CERT said in an alert that Microsoft's instructions on turning off Autorun are 'not fully effective' and 'could be considered a vulnerability.' The flaw in Microsoft's guidelines are important at the moment, because the 'Downadup' worm, which has compromised more computers than any other attack in years, can spread through USB devices, such as flash drives and cameras, by taking advantage of Windows' Autorun and Autoplay features."

Comments

I'm a linux what's a worm?

[drpt]

I thought worms only lived in the dirt and my dogs ass

Re:I'm a linux what's a worm?

[idiotwithastick]

Wikipedia says that the first worm spread through BSD UNIX. (1988):

November 2: The Morris worm, created by Robert Tappan Morris, infects DEC VAX and Sun machines running BSD UNIX connected to the Internet, and becomes the first worm to spread extensively "in the wild", and one of the first well-known programs exploiting buffer overrun vulnerabilities.

Re:I'm a linux what's a worm?

[Foofoobar]

And you neglect to point out that it did nothing and that UNIX systems were the first to learn how to protect against worms as a result. But did Mcrosoft choose to learn from the lessons of it's predecessors? No. It chose to ignore successful security methodologies in order to allow open communications between all software systems, api's and the user. The system was designed to be open by default... not secure. Security was ALWAYS an afterthought.

Re:I'm a linux what's a worm?

[Anonymous Coward]

There's a new sound, the newest sound around
The strangest sound that you have ever heard
Not like a wild boar or a jungle lion's roar
It isn't like the cry of any bird
But there's a new sound, it's deep down in the ground
And everyone who listens to it squirms
Because this new, new sound so deep under the ground
Is the sound that's made by worms

Re:I'm a linux what's a worm?

[cheater512]

It was a afterthought?

I swear in many places it wasnt a thought at all.

Re:I'm a linux what's a worm?

[KozmoKramer]

Thanks for pulling up that Gem from 20 + years ago. You and my wife must be related!

Re:I'm a linux what's a worm?

[v1]

The system was designed to be open by default... not secure. Security was ALWAYS an afterthought.

I don't think I'd say it was an afterthought, that implies they believed it was important to address, once discovered late.

The closer reality seems to be that they acknowledged the issue and determined it made a better feature than vulnerability.

Like the windows autorun on media insert that's making Downadup so successful as of lately. Amazing they STILL haven't axed that. This isn't a case of them being late with a fix, this is a case of them refusing to fix it.

Re:I'm a linux what's a worm?

[gandhi_2]

Nice. You just said Microsoft designs with openness in mind.

Re:I'm a linux what's a worm?

[Frosty Piss]

I thought worms only lived in the dirt and my dogs ass

I've never heard Windows described quite that way.

Re:I'm a linux what's a worm?

[novakyu]

... that UNIX systems were the first to learn how to protect against worms as a result.

Interesting.

Do you know when they became self-aware and launched biological viruses after (or was it before) learning to protect against man-made worms?

Re:I'm a linux what's a worm?

[SL Baur]

And you neglect to point out that it did nothing and that UNIX systems were the first to learn how to protect against worms as a result.

It did nothing except propagate, which was bad enough, but its primary entrance vector was sendmail binaries compiled with unfortunate debugging code that was effectively a passwordless root login.

So what was the primary lesson to be learned? Binaries distributed without source code and not rebuilt on a server under a watchful eye are a bad idea - true.

Re:I'm a linux what's a worm?

[Viree]

It will become self-aware on April 19, 2011 and will begin its attack against humanity on April 21...but hey no worries okay? We're gonna be saved by one John Connor in 2029.

Re:I'm a linux what's a worm?

[ozmanjusri]

I've never heard Windows described quite that way.

Try working in software support then.

I've heard it called much worse.

Re:I'm a linux what's a worm?

[Ilgaz]

for a bigger shocker, the first PC (not in sense of IBM) virus was a Mac Virus. "In the home" , Richard Skrenta 1982. It is a joke got out of hand.

I really hope nobody/no company codes a virus/worm for operating systems which are considered "super secure" by their clueless users. Results would be disastrous as there is almost no security software running on such systems.

Re:I'm a linux what's a worm?

[Anonymous Coward]

Mod sibling up

Re:I'm a linux what's a worm?

[mcrbids]

Yes, it's true - the first worm was written in *nix, during an age where software updates were very lazily applied and "security" meant issuing passwords.

Since then, the fundamental simpleness of the *nix design has resulted in dramatic improvements in real security without any basic re-architec ing. Compare/contrast with a prominent North American software vendor based in Redmond, WA who has some 10,000 developers working on their flagship software package used by a high percentage of the world's computer users, who have developed an API so complex and so labyrinthine that providing any real security is about as likely as making ice water dance the Mac arena by playing Lawrence Welk re-runs.

In security, simpler is pretty much always better, and the fundamentally simple POSIX environment is fundamentally as simple as it can be, as a matter of ideology. The fewer things being managed/tracked/considered, the fewer things can go wrong, and the less likely a security issue will be found. See worse is better for a better understanding of what I mean by "ideologically simple".

Re:I'm a linux what's a worm?

[marcosdumay]

"So what was the primary lesson to be learned? Binaries distributed without source code and not rebuilt on a server under a watchful eye are a bad idea - true."

How dumb of me thinking it was "you must check for buffer overflows"... All that time.

News?

[Anonymous Coward]

Why is this considered news? Microsoft's security recommendations have never been taken seriously. We're supposed to still not take them seriously? Ok. But not news, as, obviously, this is nothing new. Obviously.

Re:News?

[cbiltcliffe]

Sometimes they come out with something good....I think.

But they've always been completely screwed up on anything whatsoever to do with autorun.

It was a bad idea from the start, and it's just managed to get worse.

Re:News?

[idiotwithastick]

Just managed to get worse? That's ignoring things like the Sony rootkit fiasco, right?

Re:News?

[cbiltcliffe]

I don't mean "just now managed to get worse with this attack."

I mean "only got worse and worse - never better - through the entire time since it was introduced."

Re:News?

[EvanED]

The idea wasn't well thought out from the beginning, but I do think Vista improves it substantially, because by default it won't autorun media that has autorun information, at least AFAIK. Instead, it brings up the same sort of autorun dialog that you get when plugging most USB drives into XP, it's just that one of the options is to run the program that the media specifies.

Personally, I think this is a great point on the convenience/security spectrum, because I always did appreciate the convenience of autorun, but have had a hard time leaving it on because of the security issues.

(Of course, knowing MS, they probably managed to screw things up so that you can still just plain autorun even in Vista...)

Re:News?

[Anonymous Coward]

I love how morons think they know MS's product better than MS does.

At any rate, I fail to see anything but kneejerk manufactured outrage on this issue. The virus spreads by autorun... but the morons complain that disabling autorun is insufficient?

More baseless braindead whining from the MS-hatred community. Notice they never offer any solution, all they do is whine about MS. I find it sad that those so-called "experts" are even paid for doing anything.

Re:News?

[Anonymous Coward]

"I love how morons think they know MS's product better than MS does."

I love morons who think companies don't downplay things that make them look bad.

Windows itself is a vulnerability.

[The Cisco Kid]

Anyone that willingly continues to use it for anything except as a non-Internet connected game machine deserves whatever they get.

Re:Windows itself is a vulnerability.

[idiotwithastick]

Actually, I believe Windows Vista fixed this vulnerability. To bad MS did such a poor job with UAC that a lot of people might end up catching this virus anyways.

Re:Windows itself is a vulnerability.

[betterunixthanunix]

Except that this worm spreads through usb devices and is inherently not-Internet oriented. The only really safe way to use Windows is to constantly reimage your computer or to run in a virtual machine that can be reimaged every time it runs. Within 2 years, it will be feasible to run games in a VM on typical desktop hardware (once IOMMUs are common).

Re:Windows itself is a vulnerability.

[Anonymous Coward]

Yo! O.P. shut up you stupid mouth. I like infectig lameos. Stands now every lameo use MS Windows. Big ass of target. Cant miss such big ass. Hit something every time!

Re:Windows itself is a vulnerability.

[Tenebrousedge]

Vista is the most secure windows OS, probably. "most secure" != "secure".

This worm is evidence that they still have a long way to go.

Re:Windows itself is a vulnerability.

[hairyfeet]

Or you could, oh I don't know, not let morons near your computer? I'm typing this on a Win2K pro machine that has been hooked to the net and running non stop for almost 9 years. In that time I have gotten zero, zip, nada, squat on the virus front. Why? Because I don't let morons on this machine, that's why.

As a PC repairman I have noticed the PEBKAC problems with Windows can nearly always be traced to one of three types. One, the "anything my friend (insert name of girlfriend) sends me has to be okay." Those can usually be dealt with by installing a decent AV and having them use webmail instead of OE. Two, the "I will click on anything that'll get me teh hot lesbos!" guy. You can usually cut down on his rate of pwnage by giving a copy of Firefox loaded with bookmarks for places like Youporn and Redtube. And three, the "I click on everything I loads off the Kazaa!" types. These are usually dumbass teenagers looking for the latest horrible pop drivel and instead clicking on "lousy_tune.mp3.exe" thinking it is their pop drivel. Putting them in a limited user account and putting a good AV to scan whatever folder they are downloading crap to usually does the trick.

The point is blaming Windows for morons is like blaming the SUV manufacturers when some woman plows through a family of five because she ran a redlight while playing with her cell phone. Stupid people will find a way to break stuff, hence why we call them stupid. If you put these types on OSX or Linux they would break just as much as they do on Windows. They would just be loading "Hot_Pron_codec.dmg" or "killer_tune.sh" instead of an .exe. It all comes back to the dancing bunny problem. The best we tech guys can do is educate where we can, and take steps like the ones listed above to minimize the damage they can do. Because I don't care which OS you give them PEBKAC problems will NEVER go away. After all this problem wouldn't exist in the first place if folks had actually bothered applying the patch the MSFT released in OCTOBER. Just further proof that they ain't exactly brain trusts we are talking about here.

Re:Windows itself is a vulnerability.

[cheater512]

Windows makes it way too easy for morons to do their thing.

Put any of those three types on Linux and lets see how much damage they can do.
In all three, no matter what they do, the core system remains fully intact.

Re:Windows itself is a vulnerability.

[betterunixthanunix]

"Or you could, oh I don't know, not let morons near your computer?"

Which is just not feasible sometimes. Every few weeks, someone I am working with -- yes, some of us must work with others on our computers -- brings me some files on a thumb drive. I have no choice but to plug that drive into my computer and deal with it, other than not getting my work done at all.

"Putting them in a limited user account and putting a good AV to scan whatever folder they are downloading crap to usually does the trick."

When I used to repair computers, I found that doing this invariably led to questions like, "Why can't I install [insert well known program name here]?" Windows systems really are not oriented toward this sort of security for single users who cannot just call up their helpdesk whenever they need some software installed.

"If you put these types on OSX or Linux they would break just as much as they do on Windows. They would just be loading "Hot_Pron_codec.dmg" or "killer_tune.sh" instead of an .exe."

Except that in OSX and Linux (and BSD and Solaris and all *nix systems) files have to be explicitly declared executable. A user receiving LatestPopSong.mp3.sh would just sit there confused and asking, "Why does it keep opening this song in a text editor? Why does my music player keep getting confused?" In distros that enable SELinux, you can have even more security -- for example, a policy that prevents programs which are not part of Firefox from writing to the Firefox configuration, which would prevent typical virus-installing-keylogger-in-web browser attacks that seem to be so common today; such a policy could be maintained by the distro packagers themselves; in fact, Fedora already gives the .mozilla/ folder a different context. Sure, you can create such a security policy in Windows, but it is not done by default.

Yes, if administered by experts, Windows can remain secure even when connected to the Internet, I will not deny that. Most single user Windows installations are not administered by experts, and unlike big name Linux distros, Microsoft does not have thousands of people tuning the Windows security policies, nor do they have tens of thousands (perhaps hundreds of thousands) of people fixing bugs.

Re:Windows itself is a vulnerability.

[betterunixthanunix]

SELinux goes a long way toward containing viruses, as long as the distro maintains decent default policies. For example, only files from the Mozilla packages should be able to modify ~/.mozilla/ or any files in that directory, and Fedora's SELinux policy puts those files in their own context. A virus attempting to install some sort of keylogger in Firefox is forced to attack through Firefox (or another Mozilla program); compare with malware in Windows, that could attack through specially crafted music file and install a keylogger in IE.

Re:Windows itself is a vulnerability.

[Arker]

Those can usually be dealt with by installing a decent AV and having them use webmail instead of OE.

Any tips on how to get these people to accept the switch though? I'm trying my hardest with a guy I work with, he just cant seem to handle the transition. I got him a gmail account, set it up to retrieve his other accounts mail, explained the benefits (considerable, considering he pays way too much for metred internet access and is constantly receiving large attachments he usually doesnt need to open but Outhouse downloads them anyway... which really hits him in the wallet, not to mention that he works on multiple machines and is constantly needing an email downloaded on the other machine and gone from the server.) He understands all this, wants the better system, but still somehow just cant handle changing interfaces :( he knows how to do his work in Outhouse and becomes paralysed like a deer in the headlights looking at gmail. It's horribly sad, but I just dont know how to help him anymore, every idea I've tried comes to nothing.

Re:Windows itself is a vulnerability.

[MegaFur]

You seem angry. It makes your post read as non-smart.

Re:Windows itself is a vulnerability.

[nlawalker]

See how much of *anything* they could do.

That's not a good thing.

Re:Windows itself is a vulnerability.

[Anonymous Coward]

Btrfs will fix that.

Re:Windows itself is a vulnerability.

[clarkn0va]

If you put these types on OSX or Linux they would break just as much as they do on Windows.

You had me up to that line. I have managed 4 desktop computers at a youth drop-in center for a year and a half now. We have all three of your types using these machines on a nightly basis.

On my first day all four computers ran xp Home with the youth using just the guest account. All four computers were heavily infested with you-name-it. The hard drives never stopped churning and the router lights never stopped blinking, 30 minutes after logging out.

I spent that first evening exorcising the demons on what appeared to be the worst of the four stations. I gave it a clean bill of health, tightened up security here and there, and called it a night. I decided that night that I would clean out one machine per week.

I went back for round 2 a week later and the one I had cleaned the week previous was back to its original state.

I spoke to the management and obtained permission and funds to do some minor hardware upgrades on the office computer. All the hard drives got pulled from the youth computers and assembled into a RAID on the office computer, on which I did a fresh default install of Ubuntu and ltsp. I created an account for every youth that wanted one and told them to have fun. I even installed limewire and showed some of them how to grab torrents using deluge and transmission.

A year and a half later and not a single breakage. No pop-ups, no churning disks, no dead family of five. I'm effectively unemployed with this organization.

Go ahead and tell me that Windows can be made secure. Yeah, I know. I work in 3 schools and it's all Windows or nothing, and the IT people (not me) have done a great job of locking things down and generally keeping things ticking. But that's far from default configuration.

no, "these types", the same ones who had 4 xp desks in a perpetually broken state, even with AV and limited accounts, haven't broken a default linux install yet.

Re:Windows itself is a vulnerability.

[ion.simon.c]

Sure, you can create such a security policy in Windows, but it is not done by default.

Really? A per-application policy? That's cool! How do you do it?

Re:Windows itself is a vulnerability.

[RabidOverYou]

> I'm trying my hardest
> large attachments he usually doesnt need to open but Outhouse downloads them anyway
> every idea I've tried comes to nothing

You're quite the wizard, gosh he's lucky to have you helping him out.

Outlook, like every other frikken mail program, has a setting to download just the headers until you dblclick to view the message. Search on "Outlook download headers". Don't call it Outhouse, because, y'know, the search won't work that way. Am I getting too technical for you?

Rabid

Re:Windows itself is a vulnerability.

[Anonymous Coward]

Geez...I already saw this post over at http://www.engrish.com/

Re:Windows itself is a vulnerability.

[calmofthestorm]

Just because you've never noticed them doesn't mean you've never gotten a virus. Modern viruses are more intended to be quiet and do their spamming/backdoor thing these days, since users who find them may attempt to remove them.

And no, antivirus is not much protection.

Re:Windows itself is a vulnerability.

[Anonymous Coward]

I'm typing this on a Win2K pro machine that has been hooked to the net and running non stop for almost 9 years. In that time I have gotten zero, zip, nada, squat on the virus front.

And I've gotten 103,477,311 spam emails from your box, but who's counting? Thank you!

Re:Windows itself is a vulnerability.

[hairyfeet]

The other poster is right, don't call it Outhouse. The correct term is "Outlook Excrement" or "Lookout! You just got pwned!" if you are my former boss.

Seriously though, if you are trying to switch a user from mail to webmail you are going about it wrong. Gmail is great for mailheads ,NOT for those used to things like OE. The best one to switch him to is Yahoo Mail, as the new interface rips off OE enough that it feels familiar and makes them all comfy. It has the folders and layout that they are used to. Gmail is "too chatty"(quote from client) to get them to switch comfortably over. Remember....baby steps.

Re:Windows itself is a vulnerability.

[hairyfeet]

Sorry, but I'm afraid you are wrong. I know because I tried it once. I actually gave Linux (Kubuntu) to one of the "hot lesbos" types, and guess what? He managed to make it unbootable in less than 5 days. How? By typing in "Linux Programs" into Google and downloading a bunch of crap from Freshmeat and ending up in dependency hell. I finally had to lock him down in XP worse than any BOFH and he still has to bring it back 2 to 3 times a year to clean out the crap. And sticking them on Linux won't work for 1 and 3 because they can't run what their friends are running and you will be SO fired the first time they get a printer from Walmart and you can't make it work. To quote Forrest Gump-"Stupid is as stupid does."

Re:Windows itself is a vulnerability.

[hairyfeet]

You DO know you are basically trying to goose me into proving a negative, correct? I mean, how do you know your Linux machines isn't pwned by an invisible virus that goes between the clock ticks? You don't. But once a year I do a "superscan" day, where I run no less than 5 scans (3 online, one network, and one based on the machine) and I don't use the standard task manager (I use process explorer which even shows what those SVCHost.DLLs are) and I have both a software and a hardware firewall, so I know of everything that goes into or out of my network.

And so far zip, nada, squat, zilch, zippo, nothing. So I think I can safely say to 99.999% certainty that this machine is clean. But it really isn't that hard. Hell I'm even running as admin. It just takes a tiny bit of common sense, which sadly seems to be in short supply these days. I don't download attachments, I don't go to topsites looking for "teh hot lesbos", and I don't let dumbasses on my machine. Pretty damned simple if you ask me. But that is why I think it is nuts to blame MSFT for stupid users.

Because MSFT can lock it down worse than any BOFH that has ever existed, and the malware writers will simply get the stupid people to happily bypass all their hard work to get the carrot dangling in front of their face. That is why we tech guys have PEBKAC and ID10T errors. There just isn't a way to fix stupid with tech. There just isn't. That is why education will NEVER work because they will happily ignore what you have taught them to get the carrot. All we can do is make as many hoops and roadblocks as we can and try to cut down on the damage they can cause.

And for all you Linux guys? Pray I tell you, PRAY to whatever God you may or may not believe in that the giant flock of stupid Windows users never EVER switch to Linux. Because they will turn your little secure haven into a malware infested swamp in a year, maybe less. Because all the tech in the world will never cause them to grow a brain. Just be happy you have a place to get away from their stupidity.

Re:Windows itself is a vulnerability.

[calmofthestorm]

Did I say anything about Linux being immune to viruses or crackers? Did I even imply it? You jump to conclusions far too easily, though given I'm a poster on slashdot, linux fanboi is a reasonable assumption without much further information;)

What I said applies equally well to all operating systems. It doesn't really matter that Linux is more secure and less common, nor that both can be locked down to a reasonable degree by a knowledgeable sysadmin.

For the record, I've had to deal with compromised linices, macs*, and windows boxen. I know full well that not everyone is a 1337 h4x0r who can secure their system to unix snobs' satisfaction. I only hope my doctor doesn't mock me in a similar way for not knowing how to cure myself.

I merely wanted to point out that the goals of compromise have shifted over the years, and one can easily mistake this for Windows (the target of most crackers) becoming more secure. I think the neverending flood of spam attests to the fact that there are plenty of compromised computers around the tubes.

You are, of course, right that one cannot prove a negative, and any acerbity in my earlier post should be attributed to the "ZOMG windows is so secure I odn't need to enable the security or instlal 3rd part ysoftware I'm never comporm1s3d lulz" sort I've been seeing lately, which you clearly are not.

* only incidentally involved

Re:Windows itself is a vulnerability.

[Anonymous Coward]

This person has never heard of worms I see, you know, the kind of nasty programs that don't require user interaction to get their misdeeds done. I bet his wk2 is crawling.

Re:Windows itself is a vulnerability.

[drsmithy]

Except that in OSX and Linux (and BSD and Solaris and all *nix systems) files have to be explicitly declared executable.

There was an outbreak of malware a while back that required users to open a password-protected zip file, and execute the contents within.

You really think having to set a file +x, or running it from a commandline with 'bash file.sh' is really going to slow them down ?

Re:Windows itself is a vulnerability.

[Mystra_x64]

Good luck with +x vs noexec

Re:Windows itself is a vulnerability.

[drsmithy]

Good luck with +x vs noexec

sudo cp ~/Desktop/showmetheboobies /bin; /bin/showmetheboobies

Alternatively (avoiding the need to +x as well):
perl ~/Desktop/showmetheboobies.pl

Of course, the assumption that you would be likely to see /home or /tmp mounted noexec on an unmanaged desktop PC is, itself, completely unrealistic.

Re:Windows itself is a vulnerability.

[jrbirdman]

...or...to quote Ron White..."You can't fix stupid."

Re:Windows itself is a vulnerability.

[Anonymous Coward]

sometimes the most humane thing is just to take them out the back and shoot them. i know, it's heartbreaking; but they'll be better off, and you'll be better off

Re:Windows itself is a vulnerability.

[Mystra_x64]

Unrealistic because? If distributions enforce this it is possible.

With noexec they can't just click. Users need to actively do something and know exactly what to do. Not that would stop anyone though...

Re:Windows itself is a vulnerability.

[betterunixthanunix]

I am not sure about Vista, but in Windows XP, you would create a "Software Restriction Policy:"

http://technet.microsoft.com/en-us/library/bb457006.aspx

As I said in my comment, this is not something a typical home user is going to be doing on their own.

Re:Windows itself is a vulnerability.

[Anonymous Coward]

and will install things when you double click on an rpm/deb file you downloaded

only if the user is a member of the admin group, which I disable for all users. There's even a GUI option for this in Ubuntu (in Manage Users/Groups): it's called "user is allowed to install software".

Re:Windows itself is a vulnerability.

[Anonymous Coward]

Unrealistic because? If distributions enforce this it is possible.

Unrealistic because it only "allows" people to run the things someone else has said they can.

For context, consider the apoplectic outrage that would ensure if Microsoft said only binaries they had approved and signed would be allowed to run [without making some registry or GPO changes] on the next version of Windows.

With noexec they can't just click.

With Windows they can't "just click". They need to go through several dialogs telling them it's a bad idea (or - from my specific example - unzip a password protected zip file, which is at least as onerous).

Users need to actively do something and know exactly what to do. Not that would stop anyone though...

Exactly my point. If people are willing to run stuff on Windows that comes inside password-protected zip files, they're willing to type a command into a prompt (which would be conveniently provided by the spam email so they could just copy & paste).

Re:Windows itself is a vulnerability.

[Anonymous Coward]

You can secure windows by configuring it too you fuckwad. He was talking about default install capabilities.

Re:Windows itself is a vulnerability.

[hesaigo999ca]

These are the people that put food on our table, unless they are family,
I don't charge family....but I don't help them out with this either.

Re:Windows itself is a vulnerability.

[Cormacus]

I have to admit - the next time I install a linux distro, I will be turning SELinux off by default. I installed Linux recently on an old P4 machine, and when I changed some system setting that SELinux didn't like, the machine was brought to its knees.

Not worth the extra processing power on a media box.

Re:Windows itself is a vulnerability.

[Anonymous Coward]

So you're just perpetuating the the problem by ignorantly eliminating a [more] secure configuration out of the box.

Perhaps you should learn to correct the issues at hand, rather than throw the baby out with the bath water?

Re:Windows itself is a vulnerability.

[Cormacus]

Well, the most secure configuration is to turn the power off. But I've eliminated that [more] secure configuration because I actually want to use the machine.

It is behind a firewall and a NAT table, and its primary network interface will be used to pull files over a LAN. In this case (and especially considering the older hardware) I just don't see that SELinux overheads are worth the supposed benefit.

Re:Windows itself is a vulnerability.

[nabsltd]

SELinux goes a long way toward containing viruses, as long as the distro maintains decent default policies. For example, only files from the Mozilla packages should be able to modify ~/.mozilla/ or any files in that directory, and Fedora's SELinux policy puts those files in their own context.

So, when I want to use vi to edit one of the text files that are used to configure Firefox, I can't?

Although this might be more secure, I call it just a pain in the ass. Most of the SELinux policies fall into this category, although a few are just a pain in the ass without being any more secure. Add the following to your .bashrc to work around one of them:

iptables-save() {
/sbin/iptables-save $* | cat -
}

If this same sort of hack works with the Mozilla SELinux policy, then all you would need to do is read the files from the ~/.mozilla directory, write out any changes to someplace like /tmp, then "download" the files from /tmp using Firefox and store it in the correct place in ~/.mozilla. I'll bet, though, that all that would be required is the "pipe it through a trusted program" hack would work, too.

Re:Windows itself is a vulnerability.

[jhol13]

How does that help with "bash foo.sh"?

Re:Windows itself is a vulnerability.

[Erikderzweite]

Still, a much lower percentage will be able to go through all these hassle to infect themselves.
Besides, downloading and launching crap is true for (ex)-windows users as this OS has download-and-click installation principle.
Let a user start with Linux and he'll know that you install programs via package manager aka Install programs. Downloading and launching random crap simply isn't normal practice.

Re:Windows itself is a vulnerability.

[spitzak]

"bash foo.sh" is itself a script that needs the executable bit set, so it does help.

However I think the -x excuse for security on Linux is bogus.

First of all, it was not designed for that. It was designed so that a shell could quickly read all the executable commands into memory so that they could be instantly located when the user typed a command, and memory was limited so adding this so that non-executable commands were thrown out immediatly helped. If it really was a security mechanism I think bash itself might insist on foo.sh having the bit set.

Second if it were not for seeing what happened with Windows, I'm sure the people writing Firefox or Mozilla would have, without a second thought, added a feature so any downloaded executable file got the bit set for you. Or people writing finders would have made it so double-clicking, once it identified the file as an executable or shell script, would conveniently turn on the bit for you. This would have been considered a way to make it more user friendly.

Re:Windows itself is a vulnerability.

[betterunixthanunix]

"So, when I want to use vi to edit one of the text files that are used to configure Firefox, I can't?"

Not necessarily; you can make a policy that allows vi to edit those files. Policy tuning is tricky though, and you don't want to accidentally create an attack vector (not that Vi is a likely vector, but another editor might be).

"Although this might be more secure, I call it just a pain in the ass."

I have heard the same about using a non-root account. Security always takes away some convenience. "If this same sort of hack works with the Mozilla SELinux policy, then all you would need to do is read the files from the ~/.mozilla directory, write out any changes to someplace like /tmp, then "download" the files from /tmp using Firefox and store it in the correct place in ~/.mozilla. I'll bet, though, that all that would be required is the "pipe it through a trusted program" hack would work, too."

This is the idea -- you want to ensure that if something is writing to those files, and it is potentially dangerous, it is something that users need to have some minimum level of knowledge to do. Firefox writing to those files is normal; vi writing to them is potentially abnormal, and so you want to ensure that if it does happen, it is being done by someone who is aware of what is going on, or at least someone who is aware THAT it is going on. Without any SELinux policies, the edit could happen quietly, without the user ever knowing it happened.

Re:Windows itself is a vulnerability.

[nabsltd]

This is the idea -- you want to ensure that if something is writing to those files, and it is potentially dangerous, it is something that users need to have some minimum level of knowledge to do.

No, that's stupid, because a malware writer certainly has the requisite level of knowledge to bypass the problem. The "iptables-save" example I gave was something I ran into the first day I used an SELinux-enabled system, and it took me all of 10 minutes to figure out the workaround.

So, now you have a user who thinks that as long as there is no SELinux warning, the system is safe. Well, at least's it's better than the UAC warnings, which allow the user to blindly click and let the malware run.

Add in the fact that most (if not all) of the default policies are just plain stupid (why is it OK to "cp" over a file in /var/lib/dhclient but not "mv" over it?), and you see why the first thing most admins do is disable SELinux.

Without any SELinux policies, the edit could happen quietly, without the user ever knowing it happened.

I think you are a bit confused. Once a malware writer figures the workaround, then there is no SELinux log that anything happened, because SELinux only logs "prevents" by default. And, although you can have it log "permits", nobody has that much disk space.

Re:Windows itself is a vulnerability.

[betterunixthanunix]

"No, that's stupid, because a malware writer certainly has the requisite level of knowledge to bypass the problem. The "iptables-save" example I gave was something I ran into the first day I used an SELinux-enabled system, and it took me all of 10 minutes to figure out the workaround."

And now the malware writer must convince the user to do something that the user was not planning to do, beyond simply opening the virus. Now the user must open virus, then write their own SELinux bypass on the malware author's instruction, and only then can the attack be completed. I never said this would cure every possible attack, I said it helped.

"Add in the fact that most (if not all) of the default policies are just plain stupid (why is it OK to "cp" over a file in /var/lib/dhclient but not "mv" over it?), and you see why the first thing most admins do is disable SELinux."

Not if they are competent when it comes to security. Mandatory ACLs and auditing are not something most sysadmins who have security concerns want to disable, especially when there is option of permissive mode which leaves auditing enabled. Sysadmins who are hoping that their firewall is enough to keep them secure -- the sort of thinking that has viruses spreading on USB keys -- might be turning SELinux off, but not anyone with more experience than that, unless they prefer some other ACL/auditing solution.

Besides, I thought this was a conversation about non-enterprise users, who do not have sysadmins there configuring their computers?

"I think you are a bit confused. Once a malware writer figures the workaround, then there is no SELinux log that anything happened, because SELinux only logs "prevents" by default. And, although you can have it log "permits", nobody has that much disk space."

Except that the workaround will require social engineering, assuming a reasonably sane SELinux policy from the distro, which is the best one can hope for in a non-enterprise installation. Social engineering is not a problem that can be solved by SELinux, nor is SELinux intended to solve it. For home users, SELinux prevents quiet attacks (or should prevent them if the distro policy maintainers are decent, like Dan Walsh), and for enterprise users it allows the effects of social engineering to be dulled and the user who was "engineered" to be traced more easily.

Re:Windows itself is a vulnerability.

[cheater512]

It took him 5 days to bork Linux?
How long with a unaltered XP installation? :P

Next time give him Linux *without* the root password.
He doesnt need it to use the computer and he cant bork it then.
He would probably have more flexibility than your locked down XP.

Re:Windows itself is a vulnerability.

[jhol13]

So you are implying /bin/bash is not executable?! Please!

You see, it does not matter whether foo.sh has execute bit on or not.

Re:Windows itself is a vulnerability.

[spitzak]

I'm saying that if the worm can execute "bash foo.sh" it can also execute "rm -rf ~" and other bad stuff.

Re:Windows itself is a vulnerability.

[nabsltd]

And now the malware writer must convince the user to do something that the user was not planning to do, beyond simply opening the virus. Now the user must open virus, then write their own SELinux bypass on the malware author's instruction, and only then can the attack be completed.

Do you not understand the point I was making? The "bypass" is that the malware author needs to add "| cat -" on to the end of a "protected" command. Once you get the user to execute the "malware installer", it's over, since that script can now do anything that the executing user can do. If the executing user has the ability to run as root (like having run sudo recently), it's really over.

SELinux can't protect against anything if you are running as root, since root, by definition has to be able to do everything. So, there is some workaround for every SELinux "protection". The only actual protection a *nix system has is the file system protection, and the fact that non-root users can't just write willy-nilly to any file.

Not if they are competent when it comes to security. Mandatory ACLs and auditing are not something most sysadmins who have security concerns want to disable

SELinux doesn't provide mandatory ACLs. Only the file system provides true mandatory protection, as even root can't bypass them (especially ext3 attributes), although they can change them. The fact that I, as a non-root user, can bypass even one SELinux "protection" without having elevated privileges means it isn't "mandatory".

In addition, the only auditing that ever happens is when SELinux prevents something from happening. What about all the things that don't trigger a failure but are "bad"? How do you know they have happened. Oh, yeah, you don't, at least not from SELinux.

It's frightening that Windows has better auditing built in (although sadly not enabled by default) than even "SEcure Linux".

Except that the workaround will require social engineering,

If by "social engineering", you mean "convincing someone to in some way download your malware", then you are correct. But, that's pretty much a given for any malware, so I don't see what extra effort is required by the malware author to infect an SELinux system.

If you download an RPM or DEB and then double-click it from a GUI, it will install, after maybe asking you for a password (depending on the settings for sudo and sudo-like systems...whatever password it is asking for may be cached). If that installation process runs as root, then it can do anything and SELinux won't stop it, as any malware author will have written the install to bypass any SELinux "protection" with trivial hacks. Hell, it could even permanently turn off SELinux as part of the install (by adding "selinux=0" to the kernel command line in the bootloader).

Part of the problem with SELinux is that it really needs some good policies. How about "log every change or attempted change to any file in /bin, /sbin, /usr/bin, /usr/sbin"? With a re-direction of syslog to another machine, that's something that would be hard to get by. Sure, you could still have malware, but at least you'd know about when the change happened.

Or, how about an SHA1 hash of all the binaries and some sort of daily scanner to verify? These are real ways that you can at least know if your system is compromised, and maybe even stop it.

Last, SELinux does nothing to prevent local users from working on exploits, since they can find out exactly what the policy is and not trigger anything.

For home users, SELinux prevents quiet attacks (or should prevent them if the distro policy maintainers are decent, like Dan Walsh)

If Dan Walsh is responsible for the useless policies installed by default in Fedora 10, then your definition of "decent" is far different from mine. All they do is annoy users, while any malware writer will be able to come up with workarounds that allow install of the malware with no red flags being raised.

Re:Windows itself is a vulnerability.

[betterunixthanunix]

"Do you not understand the point I was making? The "bypass" is that the malware author needs to add "| cat -" on to the end of a "protected"" command."

Not sure which distro you are using, but on my Fedora 10 system, I got identical denials with or without your "workaround." Do you understand what you are talking about?

"The fact that I, as a non-root user, can bypass even one SELinux "protection" without having elevated privileges means it isn't "mandatory"."

Except as we have just seen, your workaround does not work. How about you first find something that actually works?

"If by "social engineering", you mean "convincing someone to in some way download your malware", then you are correct. But, that's pretty much a given for any malware, so I don't see what extra effort is required by the malware author to infect an SELinux system."

How about the part where the user needs to edit their SELinux policy, put SELinux in permissive mode, or disable SELinux for certain attacks to be successful? Like I said, find a way to quietly walk around SELinux, then we'll talk.

"If Dan Walsh is responsible for the useless policies installed by default in Fedora 10, then your definition of "decent" is far different from mine. All they do is annoy users, while any malware writer will be able to come up with workarounds that allow install of the malware with no red flags being raised."

Yes, trolls come on to our mailing list (fedora-devel-list) all the time trying to make this point. You can read the flamewars in our archive if you are interested. Like I said, come up with a workaround that actually works its way around SELinux, then we'll talk.

Re:Windows itself is a vulnerability.

[jhol13]

The user can run, as explained in an e-mail, "save britney.mpg and do 'bash britney.mpg'". No matter about noxec, no matter whether firefox or thunderbird puts +x on the file, no matter what (and as we all know the virus would spread).

This was what I was complaining about originally (noexec gives very little help against viruses).

The noexec is advantageous only on hot-pluggable drives if at all (disabling executables on USB drive can be a nuisance).

Hmmm...

[jaavaaguru]

Microsoft supplied the software that allows people's computers to become infected, then gave them false information leading them to believe they're safe, when they're not really.

Suspicious...

Re:Hmmm...

[Timothy Brownawell]

Microsoft supplied the software that allows people's computers to become infected, then gave them false information leading them to believe they're safe, when they're not really.

Suspicious...

Yeah, it's almost like they value convenience over security (having autorun), and don't know how to write perfect bug-free software like the space shuttle people do (look at the "Update:" at the end of the advisory, the fix instructions should have worked, but they don't without a patch).

Re:Hmmm...

[toleraen]

Except Microsoft didn't. According to TFA:

Although Microsoft has not formally recommended that users disable Autorun as an anti-Downadup measure, most security companies and researchers have in light of the autorun.inf infection vector.

The "recommendation" referred to is almost two years old and has nothing to do with the worm. Article is a troll pretty much. One support article is for disabling Autorun on CD-ROMs, while the other is for Autoplay. Neither was created specifically to support Downadup as far as I can tell.

So no, not really suspicious at all. Bad on the "researchers" who have pointed to those articles for protection.

Re:Hmmm...

[lysergic.acid]

um, what are you talking about? if there is a worm going around that exploits the AutoRun, then naturally the thing to do would be to disable AutoRun. so why is it bad on the researchers for advising people to disable a feature that makes their system more vulnerable to an ongoing security threat. and how is US-CERT or ComputerWorld "trolling" by pointing out that Microsoft's instructions for "disabling AutoRun" doesn't actually disable AutoRun?

Microsoft is the one who created a feature that is now an active malware infection vector. they are the ones who set this feature to be enabled by default. and they are the ones who made it near impossible to turn off (without downloading additional software). and to make things worse, they release inaccurate advice on how to "disable" this feature, which could potentially lull users into a false sense of security.

Re:Hmmm...

[Hordeking]

The "recommendation" referred to is almost two years old and has nothing to do with the worm. Article is a troll pretty much. One support article is for disabling Autorun on CD-ROMs, while the other is for Autoplay. Neither was created specifically to support Downadup as far as I can tell.

Ironically, I saw this one coming in 1998 when I first installed windows 95. I made sure to disable Autorun as soon as I figured out how to work the registry.

Re:Hmmm...

[Z00L00K]

{[ranting mode on]}

And they have condemned us all with that Autorun feature that has only caused headache for many of us.

They have also provided us with a scripting language that is prone to bugs and security holes, which caused the widespread Melissa virus.

Later we did see the SQL Slammer virus, which also used scripting technology.

And the SMB protocol that they have created may be useful for the purpose of sharing information between machines, but it's not designed to be safe in a way that allows it to be easily filtered in firewalls to select which services that may be passed through.

In Vista they provided us with the annoying UAC, which really wasn't that effective at all, and at the same time they also inserted features that silently replaced files that you did edit in a non-microsoft editor like Vim if that file happened to be located in certain places (try to configure Apache HTTPD under Vista Ultimate with Vim).

All in the name of making it simple for stupid users. It renders a certain validity of the statement "If you make something fool-proof only a fool will use it". And considering the general market coverage that Microsoft has today people in general are fools!

Re:Hmmm...

[SL Baur]

Microsoft is the one who created a feature that is now an active malware infection vector.

Microsoft is the one who recreated a feature that is an active malware infection vector.

There, fixed that for you. Executing anything coming from the outside by default has ALWAYS been a horrible idea.

How many decades has it been since we all disabled uux and such from our UUCP configurations?

Now, GET OFF MY LAWN!

Re:Hmmm...

[Anonymous Coward]

no,
Never attribute to malice that which can be adequately explained by incompetence.
Especially when it comes to Microsoft.

MS made a recommendation that did not fix the problem, this shows incompetence, nothing else.

Re:Hmmm...

[toleraen]

Holy smokes, I even bolded it for you! Let's try this again, with even more formating!!

One article is for disabling Autorun on CD-ROMs specifically. One article is for disabling Autoplay. Neither article describes how to stop the autorun.inf file from being processed on all removable media, nor does either article claim do to that.

This is like hitting the button that turns off your rear windshield wiper and getting furious that your forward wipers didn't turn off. Similar and related feature, but that button wasn't made to turn off your forward wipers. You gotta spin the knobby thing to turn those off. (Sorry, best car analogy I could come up with at 4am)

Re:Hmmm...

[daveime]

Little tip for anyone who has "morons" in the family.

On each new USB device, create a folder (important, MUST be a folder, NOT a file), called autorun.inf. Then set the attributes on that file to +S +H +R +A (system, hidden, read only, archive).

Voila, whatever PC they promiscuously stick their USB in, this attack vector is null and void, as the virsu cannot overwrite a folder with a file of the same name.

YMMV, but since learning this tip, my missus and kids have brought home zero nastys from work, school, college etc.

Re:Hmmm...

[uglydog]

Neither article describes how to stop the autorun.inf file from being processed on all removable media

So, IS there a way to stop the autorun.inf file from being processed on all removable media?

And I think that is the main point made by the article - yeah, sure, with a bit of spin too. With all the qualifications you have on your statements, you are technically correct. However, if there are no clear instructions on how to stop the autorun.inf file from being processed on ALL media, removable or otherwise, Microsoft should provide them or explicitly say that it isn't possible. And the researchers could probably approach Microsoft in a less accusatory manner. People just want to keep their systems safe.

Re:Hmmm...

[toleraen]

Yeah, the US-CERT bulletin linked in the summary does actually disable processing the autorun.inf file. DISA put forward the recommendation last month to change that setting. I've tested it in the lab at work and it seems to do the trick.

I think everyone is taking this thing way over the top, the registry key setting has been known for a while now, as evidenced by this 2007 article. Users, the industry, etc just love to hate Microsoft and create panic to generate web hits. Granted MS could have came forward right away and said "in addition to the patch, make this regedit to really make sure you're safe", but it is what it is.

Re:Hmmm...

[spitzak]

What makes you think the virus writers did think to delete the file before trying to write the new one. Are you assuming they are stupid?

Re:Hmmm...

[daveime]

Oh I'm not saying it's a cure-all for ALL potential viruses ... I'm just saying that it seems to work for the current ones doing the rounds precisely because the virus writers HAVEN'T thought of that yet.

Re:Hmmm...

[spitzak]

Good point, if it appears to work on current ones. Do those flags help, or is it mostly that the file is a directory? I would think if the virus writer did the work to get rid of a directory, they would also think to ignore any protection those flags provide. If those flags do provide added protection against rmdir, it might help to *not* turn them on, as maybe some will notice that they have to delete the file but not think to do whatever is needed to avoid the flags. Then you can use the flags later once you start seeing ones delete the file.

I'm guessing that just a regular file with the hidden bit set will not work, as that is something the virus writers are doing already, and each virus wants to wipe out the other ones and put their own on.

Re:Hmmm...

[lysergic.acid]

you do realize that both of those Wikipedia links point to the same page, right?

AutoRun and AutoPlay have always been pretty much synonymous, though Microsoft now uses AutoPlay specifically to refer to the menu that pops up when autorun.inf is parsed. but there are no distinct settings for enabling/disabling AutoPlay versus AutoRun. the registry settings that enable or disable AutoPlay on specific drives are in fact the AutoRun settings.

Re:Hmmm...

[toleraen]

I'm fully aware both links when to the same page. However, these days Autoplay != Autorun. Autorun is the setting that parses the autorun.inf file when media is inserted and runs whatever it's told to. Autoplay searches inserted media for audio/video/picture files and ask if you want to launch them in their respective player/viewer. Both bring up the same prompt (depending on your settings), but both perform different functions.

Non-Windows User Here

[John Hasler]

Is it really true that you have to edit the registry to turn off autorun? There isn't any clicky? Amazing.

Re:Non-Windows User Here

[Ilgaz]

Aren't you shocked that Autorun on USB class device (key) is enabled by default?

Re:Non-Windows User Here

[Neoprofin]

To default turn it off you might have to. You can just hold shift and disable it temporary when you plug something in until the detection is finished.

Re:Non-Windows User Here

[syousef]

Is it really true that you have to edit the registry to turn off autorun? There isn't any clicky? Amazing.
No it's not true. There are lots of ways to do it. The registry editor is just installed by default and pretty simple if you already know how to use it. TweakUI is a free addon Microsoft Powertoy that's worth having and gives you some control back.

http://www.annoyances.org/exec/show/article03-018
http://antivirus.about.com/od/securitytips/ht/autorun.htm

Re:Non-Windows User Here

[Anonymous Coward]

There's a control panel applet for autoplay settings.

Re:Non-Windows User Here

[99BottlesOfBeerInMyF]

To default turn it off you might have to. You can just hold shift and disable it temporary when you plug something in until the detection is finished.

Except it can still autorun in response to other events than plugging it in, like single clicking the drive or some applications that look for devices periodically.

Re:Non-Windows User Here

[TubeSteak]

run services.msc OR Ctrl Panel -> Administrative Tools -> Services
stop and disable service: Shell Hardware Detection

No more auto-run or auto-play

Re:Non-Windows User Here

[KindMind]

The Register says that the US-CERT article is based on an old MS article, and has since updated.
There's a right and wrong way to disable Windows Autorun
How to correct "disable Autorun registry key" enforcement in Windows

Re:Non-Windows User Here

[Repton]

When I set up a Windows XP computer, I use TweakUI to disable autorun for all drives and all media types.

I hope that is sufficient...

Re:Non-Windows User Here

[Anonymous Coward]

Sure, sure. And how long do you need to hold down shift for, exactly, it's not like there's any feedback. Until you've held down shift for eight seconds anyway. Then an accessibility options window pops up about filterkeys, and if you cancel it, windows usually acts like the shift key is stuck down, blah blah blah. As someone else pointed out, there are all kinds of other events that can trigger it. Plus you only need to forget to do it one time.

Re:Non-Windows User Here

[arminw]

... and pretty simple if you already know how to use it....

Brain surgery and rocket science are also easy if you already know how to do these. To those that don't have the ability, the time, nor the desire to go to the trouble of learning the arcane art of registry editing, the best thing to do is to choose an OS that doesn't have a registry and is not subject to any of the nearly 100,000 instances of malware made specifically for hapless Windows users. There is little or nothing that the intelligent users of these alternatives to Windows cannot do, that the millions of Winsheep are able. For games, there are dedicated devices that are cheaper and better.

Re:Non-Windows User Here

[cdrguru]

I would be, if it was true. It isn't. Autoplay, something completely different that was introduced in XP is there for USB devices but not Autorun. Autoplay requires user interaction to do anything, which is why the whole folder icon fooling people is a big deal.

If I get you to click on a link that says you get $1000 for clicking on the link but it really installs software (requiring more clicks to approve) and you do it anyway - and keep confirming it, over and over, I'd say it is your own fault.

Re:Non-Windows User Here

[Anonymous Coward]

http://en.wikipedia.org/wiki/AutoRun#The_AutoRun_disable_bug

Re:Non-Windows User Here

[Anonymous Coward]

Which is why the (albeit somewhat) savvy windows user will have a small army of os-crippling-ware
to disable the many non-essential yet critically vulnerable windows easter eggs and services.

After all, if you're trying to run windows out of the box in 2009, you are functionally illiterate.
I suppose the repeated blows to the face don't deter boxers, either. To each his own.

PS: my captcha is "helpless"

Re:Non-Windows User Here

[syousef]

Brain surgery and rocket science are also easy if you already know how to do these

Let me get this straight. You're comparing opening up regedit, browsing through a tree of values, and modifying one with brain surgery and rocket science??? You call it "the art of registry editing". I could teach any even semi-competent person how to use regedit in an hour max assuming nothing more than windows knowledge.

As for the abomination that is the windows registry I agree it's awful and for more than just the reasons you point out, but it's no harder to change a single registry entry than to change an ini file field value. I wouldn't compare the use of notepad to edit an ini file to brain surgery or rocket science either.

Re:Non-Windows User Here

[X0563511]

For games, there are dedicated devices that are cheaper and better.

Says the one that hasn't seen a new game on new hardware connected to a very large TV screen... I'm not arguing about cheaper, but don't try to tell me a console is better.

Re:Non-Windows User Here

[lysergic.acid]

that doesn't really provide true protection against all AutoRun attacks.

USB/flash drive-based attacks typically work by creating an autorun.inf file that replaces the default action for that device. by default, XP would simply prompt the user with a list of AutoPlay actions to take (with the AutoRun-specified action selected) when the drive is plugged in. if you "disable" AutoRun, then that menu won't pop-up, but that is arguably more dangerous; the reason being that when the AutoPlay menu pops up the user has a chance to see that an unfamiliar action has been added/selected.

if a computer-savvy user plugs in their iPod/PSP/thumbdrive and the AutoPlay menu shows some strange new action and program icon, they are going to be suspicious. they will likely select the "Open folder to view files using Windows Explorer" action to browse the volume and probably detect the malware and autorun.inf file.

now, a typical scenario when AutoPlay is disabled is that a user will plug in an infected flash drive, open up My Computer, and proceed to double-click on the removable volume to open it for browsing. however, whether or not AutoPlay/AutoRun is enabled, an autorun.inf file can replace the default action for that volume. and this time the user has absolutely no warning (unless the malware author is dumb enough to replace the volume's icon and advertise the presence of the virus). i mean, how often do you actually right-click on a volume to select "Open" from the context menu or to check its default action? most people are in the habit of simply double-clicking on a drive icon to browse its contents.

then there's the matter of dual-filesystem flash drives. because Microsoft places the interests of the RIAA ahead of the interests of their customers, they've used AutoRun to implement a rather dangerous DRM mechanism. if CDFS is detected on any removable volume, Windows automatically assumes that it is a protected CD and will launch any program specified by autorun.inf. this functionality will work whether or not you have configured Windows to allow AutoRun or not, and you cannot bypass it by holding down the "shift" key. but that can only be expected when you have DRM that's designed to "protect" the system from its user/owner.

Re:Non-Windows User Here

[afidel]

I'm sorry but the MS solution, even if fully effective is MUCH more complicated than a 3 line reg file which permanently disables autorun unless it somehow gets re-associated with a correct event handler.

Re:Non-Windows User Here

[nlawalker]

brain surgery and rocket science

Funny you should say that; I think a comparison between the registry and a command line interface is pretty valid. Powerful if you know how to use it, dangerous if you don't, and a lot of people use it only when given specific instructions (a specific key or command) by someone else.

Re:Non-Windows User Here

[SpaceLifeForm]

Bingo!

It does not matter the name,
if software executes beyond user control.
Auto-run, auto-play.

It should be called Auto-Blackmagic.

Re:Non-Windows User Here

[EvanED]

Autorun also works if the flash drive pretends it's something else, like a USB CD drive. Then Windows will allow autorun. There are entire lines of USB drives that have this (mis)feature.

Re:Non-Windows User Here

[KindMind]

I'm sorry but the MS solution, even if fully effective is MUCH more complicated ...

Don't know about "more complicated" - the MS KB article talks about using Group Policy to change a single setting - I didn't find it complicated, but YMMV.

... than a 3 line reg file which permanently disables autorun unless it somehow gets re-associated with a correct event handler.

But I agree that it's better to permanently KO the autorun inf association. Then you don't have to worry so much about Microsoft "forgetting" something. The whole autorun mis-feature has been a real PITA for me over the years. I can't count the number of times I said to my PC, "No dammit, don't do that!" because I accidentally kicked off autorun when trying to just view something (inadvertent double clicks, that sort of thing). Better to just kill the association and be done with it.

Re:Non-Windows User Here

[symbolset]

You clearly underestimate the necessity of such a useful feature as autorun. Sure, Microsoft innovates in this area, but the feature is becoming more common in all devices.

My cell phone has auto-answer. My dvr has auto-record. My paper shredder even automatically runs when you put paper in.

There is a downside of course. The auto-run on the disposal has mangled a fork and a few spoons. The auto-run on the table saw was the most disconcerting, but if you're on your toes about precautions nothing bad will happen.

Re:Non-Windows User Here

[Neoprofin]

Hey, my XP installs have autorun stripped out, I was just answering his question about "clickies". There is a key for it.

Re:Non-Windows User Here

[Neoprofin]

The man just wanted to know if there wasn't a "clicky" to turn off autorun, I didn't say it fixed the problem.

Re:Non-Windows User Here

[pbarnhart]

There is a simple download on http://www.downadup.com/remove-downadup.php that you can use to run the reg update.

Re:Non-Windows User Here

[Anonymous Coward]

Of course not.

Windows is built to be easy to use. If you'd need to *enable* autorun from USB devices, users would have to manually enable it in order to be able to propagate the trojan/virus of the day. And that wouldn't be user friendly.

Re:Non-Windows User Here

[natxo asenjo]

I think he was being a bit sarcastic when asking that. Window users always ask 'is it true I have to use a cli for doing this in linux?' Your answer that it is pretty simple *if you already know how to use it* proves that what he wanted to achieved worked, he trolled you :-) hey, vi is pretty simple *if you already know how to use it* :)

Re:Non-Windows User Here

[Ilgaz]

Funny is, they copy everything from OS X regarding ease of use but they don't stop a second and think why Apple, the king of usability stayed away from autorun/auto play. Doesn't Apple have a similar feature? Of course, if you set a special bit/file (not sure, Roxio Toast and Apple does it), it auto opens a Finder window when CD/DVD inserted only showing its contents and nothing else.

If it wasn't shouting "security/stability risk", Apple would put that feature back in MacOS days.

Re:Non-Windows User Here

[Culture20]

http://en.wikipedia.org/wiki/AutoRun#The_AutoRun_disable_bug
This bug has been fixed in security updates issued in July 2008. For Windows Vista and Windows Server 2008 the relevant Knowledge Base Article is 950582[24] with further details in the security bulletin itself.[25]

For Windows XP, Windows Server 2003 and Windows 2000 the relevant Knowledge Base Article is 953252[26] with details and links to the OS specific patches available from that page. Windows 95 and Windows 98 are not affected.

Note that these are not installed via auto-update, nor do they show up in Windows Update. Also, http://support.microsoft.com/kb/953252/ is broken because it points to KB950582 for the XP fix, but KB950582 says it's Vista-only. Microsoft should re-release these as automatic updates. They don't turn off auto-run, but they allow you to turn it off.

Re:Non-Windows User Here

[arminw]

...I could teach any even semi-competent person....

That wasn't my point. Anything is easy once you know how to do it, including rocket science. There are some people intelligent and motivated enough to learn it. There are after all rocket scientists who are still merely human. I have no doubt that you can teach a person to use regedit. The question is one of wanting or needing to, just to keep a computer secure. There are automobile owners who also learn how to rebuild their engines or automatic transmissions, but most drivers just want to get to their destination. They know enough that once in a while, when the fuel gauge gets near "E" to fill the tank, but have never even lifted the hood. Most drivers also know how to read the odometer and take the vehicle to their favorite mechanic for maintenance. However, in cars, the safety is usually built in by the manufacturer, not added on by the users afterwards.

Re:Non-Windows User Here

[Omniscientist]

Yes, most semi-competent folks would probably be able to learn how to use regedit in an hour; the difficulty in changing simple settings in the HKLM or HKCU is not that high. The registry is a simple thing when it is used for this purpose. Using it is much more pleasant than having to tangle with vast amounts of scattered INI files.

The complicated and mind-numbing area of the registry is the HKEY_CLASSES_ROOT hive, where all the COM information is stored. Unversed individuals will not make sense of the various types of entities stored there without some prior knowledge. This is also where the design of regedit fails, given the sheer amount of items thrown at the user (very difficult to scroll through thousands of CLSID's). This is unfortunate, as the HKCR is probably the most critical section of the registry.

Re:Non-Windows User Here

[Z00L00K]

Oh yes - there are a lot of hidden features when it comes to different devices like USB devices.

Haven't you heard about the virus-infected photo frames and USB memories?

And disabling the Auto-run feature for a CD-ROM won't necessarily disable it for an USB memory or anything else that might be supported.

As noted in the CERT advisory, NoDriveTypeAutorun should be set to 0xFF, but even that isn't enough.

And don't ignore the fact that people in general are fools.

Re:Non-Windows User Here

[Anonymous Coward]

Thumbdrive virus don't usually expose strange new actions or icons in the autoplay menu. They usually expose a new action with a familiar icon (usually a folder) and a familiar name (like "Open folder to view files") but linked to the virus executable.

Worse, this false action will appear selected and above the real one. Most users will fall for the trick and click it.

Here (link from the article), you can see a screenshot of a virus doing it.

http://www.us-cert.gov/cas/techalerts/TA09-020A.html

Please, note that it's trivial to use the correct icon. And also most virus are able to show the text in a couple of the most used languages.

Re:Non-Windows User Here

[SL Baur]

You're comparing opening up regedit, browsing through a tree of values, and modifying one with brain surgery and rocket science???

Hey! `FOR I = 1 . 10' once crashed a space probe.

Apparently it *is* beyond rocket science.

Re:Non-Windows User Here

[Skrynesaver]

You can either edit the registry (Add a new key and set it to hex value B5) or add a group policy in MMC, and people say Aunt Mildred has problems with Linux ;)

Re:Non-Windows User Here

[Anonymous Coward]

On your advice I purchased a table saw with an auto-run feature, all was going well until I tried your advice of being on my toes, sadly I will no longer have said toes

Re:Non-Windows User Here

[jmorkel]

Is it really true that you have to edit the registry to turn off autorun? There isn't any clicky?

Start->Run->gpedit.msc

Computer configuration->Administrative templates->System

Double click Turn off Autoplay policy

Enable the policy

Change setting to 'All drives'

Re:Non-Windows User Here

[syousef]

That wasn't my point. Anything is easy once you know how to do it, including rocket science

That's pure rubbish. Simple repedative tasks are easy. Complex reasoning and deduction isn't. Some problems are in fact intractable. Nor is refining motor skills or pre-empting something. I know how to hit a baseball. That doesn't mean I could easily become a pro baseball player.

You've built your entire argument on a flawed premise.

Re:Non-Windows User Here

[daveime]

Ctrl Panel -> Administrative Tools -> Services
stop and disable service: Shell Hardware Detection

When Shell Hardare Detection stops, these other services will also stop - Windows Image Acquisition.

So I have to nerf my ability to use my scanner, kust to stop things autorunning ?

Re:Non-Windows User Here

[syousef]

hey, vi is pretty simple *if you already know how to use it* :)

Given a user who's familiar with email and the web browser, do you think it'd be easier to teach someone how to use regedit (which requires you to commit very little to memory) or vi (which requires you to remember dozens of key bindings and commands to be effective)? How long do you think it takes to get competent with regedit vs vi?

Re:Non-Windows User Here

[lifeisshort]

it was actually DO I=1.10 in context sensitive nature of fortran of the day this compiled as local variable DOI to assume value of 1.10 instead of 10 times iteration with counter I

Re:Non-Windows User Here

[bogado]

No that is still windows fault, the user is used to click thousands of those cryptic little windows that appear whenever he has to do something. He doesn't even read them anymore.

A better solution is to ask the users password before installing stuff, those prompts are rare and give the user the impression that something potentially harmful is about to happen.

On the other hand, the system can not over use it, some versions of linux require that you enter your password even to change the system time for instance. This abuse of the password prompt can make users get used to them, and just like the warning dialogs they will get trained to enter the password on demand, without thinking.

Re:Non-Windows User Here

[natxo asenjo]

the poing was and still is that using the registry editor is for the average person as confusing as using vi(m).

In order for someone to (properly) understand what they are doing while using regedit, you would have to explain what a hive is, what the main hives are, which hive to open for systemwide settings, which one for his/her user, which one for the default user in case he/she needs to change something for every new user to that machine, how to backup the registry in case the feces hit the fan ... It is quite a bit, actually.

On the other hand, you could give someone who can read (yes, this is a necessity) a unix shell and ask them to type vimtutor en then press enter. After 20 minutes on their own, they would be good to go. Besides, you do not need to use vi(m), you can use joe or for the sake of it, gedit in a graphical environment. No training needed, just edit a textfile and save it.

So, do you still think that regedit is such a good idea? Good for you.

Re:Non-Windows User Here

[Jedi Alec]

Mass Effect on pc....Mass Effect on the Xbox 360...

Yeah, quite a difficult choice to make indeed.

Re:Non-Windows User Here

[teridon]

the MS KB article talks about using Group Policy to change a single setting

After reading the MS KB article, I'm not quite sure what needs to be done on Windows XP clients. It seems that the update the article was not automatically installed by AutoUpdate for XP, only for Vista and Server 2008.

You can use Group Policy, but I'm not clear whether you need to install the update only on the AD controller, or if you need it on the clients as well...

Re:Non-Windows User Here

[Anonymous Coward]

So what you are saying is that the next time you go to your banks website and try to pay a bill, if you end up losing all your money because someone else misused a flaw in their software, you are to blame?

Seriusly. Yea, people are stupid and do stupid stuff, but how the hell can they be blamed for other people misusing flaws in Microsofts software?

It doesn't say anywhere when you install Windows that you should have an IQ of 110 to install it, unless you accept all responsibilities for every error they have made.

Re:Non-Windows User Here

[Anonymous Coward]

Evidently you've never manipulated a registry live in memory to fix it when it is corrupted. I have and the computer I did it to has been running for years without a glitch.

Re:Non-Windows User Here

[ildon]

If Counter-Strike and World of Warcraft players can be taught to edit the registry, anyone can.

Re:Non-Windows User Here

[jedidiah]

...obviously someone who has never heard a cacophany of vomiting coming from a Mac lab.

Re:Non-Windows User Here

[Nimey]

I'm dismayed that there isn't a good way to push out the Registry change to everyone via Active Directory.

If I'm wrong, would someone post a link on how to do this?

Re:Non-Windows User Here

[Anonymous Coward]

Microsoft has a problem. As you know, they put a whole crap-ton of settings that control the operation of the system side-by-side with settings that control the operation of your kid's "Barbie Goes Shopping" game.

So, to reduce their support costs, they MUST convince everyone that editing the registry is hard, scary, complicated, prone to failure, and will probably cause data loss.

Otherwise, every Sam and Susie that figures out how to change a default setting in the Barbie game (i.e. SetCreditLimit=99999) will realize that they can also change arbitrary values anywhere *because it's so easy, you just change this one setting*. And then, Myspace and Facebook will fill up with *.reg scripts that tweak who-knows-what and cause untold amounts of random damage.

You can see that this is something of a nightmare scenario for their support team.

Granted, it's their own damn fault for building a system that doesn't isolate settings.

Re:Non-Windows User Here

[russotto]

Funny is, they copy everything from OS X regarding ease of use but they don't stop a second and think why Apple, the king of usability stayed away from autorun/auto play. Doesn't Apple have a similar feature?

Apple had an auto-run feature at one point, I think back in System 8 or so. They dropped it.

Re:Non-Windows User Here

[mcgrew]

Brain surgery and rocket science are also easy if you already know how to do these.

This comment is not directed to the parent poster, it's directed to my fellow nerds.

There are far too many people who think knowing how to boot a PC (even if they don't know what booting is) makes them a nerd. And far too many, like the parent poster, are showing up at "news for nerds".

I blame the idlization and web2.0 fucktardery for all the dufuses coming here pretending to be one of us. And I'm getting tired of it.

Can anyone point me to a good nerd site? Slashdot use to be an excellent resource for nerds, but with all the MBAs and jocks and neocons that have been posting lately it's becoming a real drag.

Can we institute an IQ test to post or something? This is getting out of hand.

Yes, this comment is offtopic.

Re:Non-Windows User Here

[Anonymous Coward]

I would be, if it was true. It isn't. Autoplay, something completely different that was introduced in XP is there for USB devices but not Autorun. Autoplay requires user interaction to do anything, which is why the whole folder icon fooling people is a big deal.

No, it has autorun capability as well, depending on the flash drive. For example, the U3 capable flash drives basically trick the PC into treating the device as removable media (like a CD being loaded). This can trigger the autorun feature.

If you want more info, try looking up the USB hacksaw on Google.

Re:Non-Windows User Here

[mcgrew]

My neighbor's pit bull has auto-run. Now I understand why the neighbor named him "Clippy"!

My daughter's cat has auto run too. The pit bull activates it.

Re:Non-Windows User Here

[sharkey]

And, of course, like all /.ers, we have auto-ejaculate, triggered upon being spoken to by a female with a pulse.

Re:Non-Windows User Here

[Zerth]

You can just hold shift and disable it temporary when you plug something in until the detection is finished.

.

Unless you are running Vista, in which case holding down shift TURNS IT BACK ON!

I really don't understand why they'd switch the meaning of that action. Fortunately I found it out when inserting a clean USB stick(clean-ish, it had that U3 crap on it).

Re:Non-Windows User Here

[jo42]

Windows Registry Editor Version 5.00

; --- Registry Tweaks for WinXP and W2K3S ---

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CDROM]
"AutoRun"=dword:0000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff

Re:Non-Windows User Here

[L0rdJedi]

Brain surgery and rocket science are also easy if you already know how to do these

Let me get this straight. You're comparing opening up regedit, browsing through a tree of values, and modifying one with brain surgery and rocket science??? You call it "the art of registry editing". I could teach any even semi-competent person how to use regedit in an hour max assuming nothing more than windows knowledge.

Yes (to the comparison) and bullshit if you think you can teach a "semi-competent" person about what values are ok to edit and which are not. You could teach them about this one value I'm sure, but the next time something else comes up and they try to fix it themselves (because you taught them how to use regedit), they'll end up doing more damage.

Using the regedit is like rocket science and/or brain surgery. The brain surgeon wouldn't have the first clue how it worked and wouldn't care. He's to busy doing surgery on peoples brains, so he's going to ask YOU to fix it. He's going to be willing to pay YOU up to $150 per hour to fix it. Same with the rocket scientist. Again, you could teach them where this one entry is, but expecting them to then be able to go in and find anything else is a joke. It's not because they're dumb, it's because it's not their field and without at least an hour of their time (which they're not going to be willing to give up) they're not going to learn enough about it to be useful.

Re:Non-Windows User Here

[L0rdJedi]

That wasn't my point. Anything is easy once you know how to do it, including rocket science

That's pure rubbish. Simple repedative tasks are easy. Complex reasoning and deduction isn't. Some problems are in fact intractable. Nor is refining motor skills or pre-empting something. I know how to hit a baseball. That doesn't mean I could easily become a pro baseball player.

You've built your entire argument on a flawed premise.

Sure you could. If you went to the batting cages and practiced hitting the ball over and over again at steadily increasing speeds, you would eventually be able to hit a fast ball. Now all you have to do is play baseball in little league, high school, and maybe college. All it takes is getting noticed at that point.

Obviously if you're over 25 or 30 you couldn't become a pro baseball player now, but you probably couldn't switch gears into any other profession that wasn't close to your own at this point either. The point is that if you start at a young enough age, you can in fact become anything you want as long you keep trying.

I mean, you didn't just wake up one day as a sys admin did you? No, it took a lot of training and practice with plenty of screw ups along the way. You probably even started out doing some programming like most competent sys admins I know. Every occupation is the same way. Some are really good at baseball others are really good at tearing down an engine and completely rebuilding it.

Re:Non-Windows User Here

[myspace-cn]

Great! Now how about that gdiplus exploit?

Re:Non-Windows User Here

[Anonymous Coward]

On the other hand, the system can not over use it, some versions of linux require that you enter your password even to change the system time for instance.

There are lots of security holes that can be opened by changing the time. You shouldn't be setting your clock anyway. I can see changing the time zone, but that does not set the clock. Install NTP and forget about ever setting your clock again.

Re:Non-Windows User Here

[Anonymous Coward]

And, of course, like all /.ers, we have auto-ejaculate, triggered upon being spoken to by a female with a pulse.

Actually that sounds like fun. I'd have to wear diapers. However, I'd probably piss my pants if spoken to by a female without a pulse!

Re:Non-Windows User Here

[WD]

For all systems older than Vista, the update needs to be manually installed for Windows to obey the AutoRun preference. This means all client systems.

Re:Non-Windows User Here

[syousef]

the poing was and still is that using the registry editor is for the average person as confusing as using vi(m).

No it most definitely is not.

In order for someone to (properly) understand what they are doing while using regedit,

If you're asking them to change a key in the registry they don't need that kind of detail at all. To use a car analogy not every driver needs to be a mechanic.

They need to know:
1) How to start regedit.
2) How to navigate to a particular key.
3) How to export a portion of the registry and how to load it back if they need to revert.
4) How to modify an existing key.
5) How to create a new key.

Each of the above can be described in a few lines of text.

Now as for vi....you NEED:
1) Know how to start it
2) To know and understand the different modes. There are more involved concepts here than what a registry key is.
3) Know and memorize a couple of dozen key commands.

3 is the killer and makes vi much harder. With the registry editor you don't need to memorize obscure key bindings. The menus are right there staring the user in the face.

So, do you still think that regedit is such a good idea?

The registry is awful. I've already stated my opinion on that. However I also think the difficulty of using regedit to edit a couple of keys is greatly exaggerated!

Re:Non-Windows User Here

[John Hasler]

How can you say that autorun is turned off if things can still run automatically?

Re:Non-Windows User Here

[syousef]

Sure you could. If you went to the batting cages and practiced hitting the ball over and over again at steadily increasing speeds, you would eventually be able to hit a fast ball. Now all you have to do is play baseball in little league, high school, and maybe college. All it takes is getting noticed at that point.

Tell that to the thousands of men whose desperate dream it is to play pro ball that don't make it.

In any case you know nothing about me or my physical ability. You're dillusional if you think everyone's able to become a pro baseball player and all it takes is practice.

Obviously if you're over 25 or 30 you couldn't become a pro baseball player now, but you probably couldn't switch gears into any other profession that wasn't close to your own at this point either. The point is that if you start at a young enough age, you can in fact become anything you want as long you keep trying.

Stop watching Disney films would you? The reality is you are presented with opportunities in life and if you try very hard you'll succeed at SOME of your dreams. Now it's true that you can sometimes position yourself so more opportunities come your way but you don't always get to do that. For example want to be U.S. President? Well if you weren't born in the U.S. you'd have to get the constitution changed. Is that possible? Perhaps, but it's not entirely in your control - you can try very hard but still be unable to get the law changed. Another example: Your odds of becoming an astronaut or a nuclear physicist if you grew up in a nation that has no space program are greatly diminished.

I mean, you didn't just wake up one day as a sys admin did you?

No. In fact I've never woken up a sys admin. I've never worked as a sys admin in my life. More false assumptions on your part.

Re:Non-Windows User Here

[SL Baur]

Yeah, it's been a long time since I had to deal with FORTRAN.

It's not clear whether the person who made that typo was at JPL at the same time as I was, but that was certainly the only place I've been that had aggressive FORTRAN language bigots.

Space cowboys abounded there, so I doubt there was ever code review or anything like that. If it compiles, Shoot it into Space! Would be nice to laugh at the managers who signed off on that though.

Re:Non-Windows User Here

[Neoprofin]

Because that's what the key does, that's the point of it, that's it's assigned functionality in that context.

You said it yourself, in that situation even if autorun is disabled in the registry it still functions, so it's an example completely irrelevant to the GPs question or my response.

I'm honestly baffled that people are arguing with a single sentence I posted that I may as well have pasted directly from the Windows Help. The man wanted to know if there was a hot key equivalent to editing the registry. There is, it's called the shift key. The fact that neither one of them fixes any number of problems has nothing to do with my answer.

Re:Non-Windows User Here

[csartanis]

Wrong, if you had RTFA you'd see that clicking on a removable drive in explorer can still execute an application located on the media even when that service is not running.

Would like to see a worm disable Vista's DRM

[transporter_ii]

Would like to see a worm disable some of Microsoft's DRM and see how fast they come out with a working patch.

Re:Would like to see a worm disable Vista's DRM

[powerspike]

Wow don't most people just turn off the computer to do that?

Re:Would like to see a worm disable Vista's DRM

[Anonymous Coward]

The 1 step guide to getting cheap mod points on Slashdot

1) Mention DRM

Re:Would like to see a worm disable Vista's DRM

[Anonymous Coward]

Hey guys, DRM is awesom!

Re:Would like to see a worm disable Vista's DRM

[nku]

The 3 steps guide to make profit anywhere -
1. Mention DRM
2. ???
3. Profit!!!

Re:Would like to see a worm disable Vista's DRM

[azenpunk]

yeah, drm!

Re:Would like to see a worm disable Vista's DRM

[KiloByte]

It happened once already. Microsoft didn't wait for the patch Tuesday and released a patch under 24 hours.

Re:Would like to see a worm disable Vista's DRM

[Anonymous Coward]

The 1 step guide to getting cheap mod points on Slashdot

1) Mention DRM

Cool. This seam to have worked out pretty nicely for you at least.

Does it also work if you quote someone talking about it?

Re:Would like to see a worm disable Vista's DRM

[zvar]

DRM :)

Re:Would like to see a worm disable Vista's DRM

[SmurfButcher Bob]

Personally, I welcome our new DRM astroturfing overlords.

Copyright(c) 2009 by SBB, all rights reserved. May not be copied, distributed, sub-licensed...

Are there pies in space?

[Anonymous Coward]

I am asking Slashdot because you are very intelligent beings?

Re:Are there pies in space?

[Anonymous Coward]

I am asking Slashdot because you are very intelligent beings?

Yes, but because there's no gravity in space, we have to use very powerful electric currents to magnetise our pies.

We call them magpies and eat them at our space-football games with hot chips and source.

Go Collingwood! Yeah.

Re:Are there pies in space?

[Anonymous Coward]

Thank you kind madam. And these magpies, do they have polarizzed crust, or are they made with ionic crumbs? I ask because I am in a space with am being hungry much. I spoke to the bird person but he whistled and pood at me. At last there is kindness in this world. I love you.

Re:Are there pies in space?

[Anonymous Coward]

I like a different magpie, but mine uses a different "Port", same code but also with chips and source..

sorry it's weak, but I cannot believe a collingwood supporter reads slashdot !

Re:Are there pies in space?

[Anonymous Coward]

Make that 2 Collingwood supporters :)

Re:Are there pies in space?

[Anonymous Coward]

Did you hear about the MP who was found dead wearing a Collingwood jumper?

They had to dress him in women's underwear to save his family from embarrassment.

Re:Are there pies in space?

[Gandalf_Greyhame]

I like a different magpie, but mine uses a different "Port", same code but also with chips and source..

sorry it's weak, but I cannot believe a collingwood supporter reads slashdot !

I can't believe a Collingwood supporter can READ!

Autorun has always been a vulnerability

[Anonymous Coward]

It makes me feel a bit dizzy every time I think that this "feature" is enabled by default. It's a feature in the same way that an online banking system might feature login without a password, "just type your name to instantly access your account!" It saves the user a tiny hassle against an opportunity for absolute catastrophe.

Autorun is high on my list of stuff to disable very shortly after installing a fresh copy of Windows.

And it's not like it's a secret that this is a vulnerability. There's a reason Apple abandoned this capability when it moved from OS 9 to OS X.

Microsoft deserves derision for continuing to offer and promote this feature.

If Microsoft can't be bothered by it, nor convinced it's a very, very, bad idea, then autorun should at be limited exclusively to CDs and DVDs. That would merely be a terrible idea, as opposed to a downright catastrophic one.

Does Windows Vista or Window 7 handle this differently than XP??

Re:Autorun has always been a vulnerability

[Shadow-isoHunt]

Limiting autorun to CDs or DVDs doesn't help, because U3 flashdrives come with a rewritable partition that appears as a CD drive, which is also read only. Google "usb switchblade"

Re:Autorun has always been a vulnerability

[EvanED]

If Microsoft can't be bothered by it, nor convinced it's a very, very, bad idea, then autorun should at be limited exclusively to CDs and DVDs

As the other person has mentioned, this doesn't work because it's possible for a USB device to masquerade as a CD drive, and it's easy to find a flash drive that does so.

But that isn't even the whole story, which is that barring that fact, what you describe is exactly the situation. Windows won't autorun things off of what it thinks is a removable drive.

Re:Autorun has always been a vulnerability

[X0563511]

Fortunately, U3 drives can be neutered.

Re:Autorun has always been a vulnerability

[Culture20]

just type your name to instantly access your account!

Which is why my usernames are always 2048-4096 characters long.

Plug in and ...

[Derrike]

break?

OS X - best fix

[Anonymous Coward]

Yet another reason I am glas I run a vierually 100% secure OS where such stuff can never happen. Ever.

Comment removed

[account_deleted]

Comment removed based on user account deletion

But MS doesn't want to totally disable autorun

[localroger]

Even though autorun is like one of the dumbest ideas ever, MS thinks of it as a COOL FEATURE and disabling it is going to break the COOL AUTOMATION that they have sold your grandma, who will no longer be able to just plug her camera into the computer and have it do its thing automatically. Their users might have to THINK which we all know is a bad thing, especially if you are thinking about how well your Microsoft product works.

Re:But MS doesn't want to totally disable autorun

[Ithaca_nz]

1. If autorun is running an arbitrary executable on removable media just because, then yes, I would consider it one of the more idiotic ideas that has come up. 2. If autorun is running a known application already installed on the PC when a recognised device type is connected, then no it's not the "dumbest idea ever". There's no technical reason that you need (1) active to support (2). Whether there is a way to separately disable them in Windows is another question. (anyone have an answer to that?)

Re:But MS doesn't want to totally disable autorun

[pjbgravely]

Auto starting an application to display and download photos from a camera is not the same as running an executable that is found on the camera. One can be done without the other.

Re:But MS doesn't want to totally disable autorun

[The MAZZTer]

Actually in Vista (and XP SP3, or is it 2?) Autorun by default shows a dialog asking you what you want to do with the software, it doesn't run anything on the device/CD unless you explicitly select that option.

Re:But MS doesn't want to totally disable autorun

[Ilgaz]

Autorun thing was "invented' on Windows 95 right? There were thousands of evil MS-DOS viruses back that time which are sometimes way more advanced than the Visual basic junk of today.

What makes me shrug is that fact. It is not like MS-DOS was virus free and they already had reports of windows 3.1 breaking because of DOS viruses. First thing they invent on a DOS Hybrid OS? Autorun which will run anything said on autorun.inf file. Well, lets say in Windows 95 times, a CD-R really costed too much. What about Windows 98?

In fact Windows already have a manual (but GUI) auto install which is way more safe. "Add remove programs" has/had "Install new Software" which basically asks you to insert the CD/Diskette of software you want to install. They could disable autorun and put "Install programs/games" as a separate control panel.

Even if it doesn't work...

[Anonymous Coward]

Disable Autorun anyway, because it's fucking annoying.

Re:Even if it doesn't work...

[afidel]

The problem is the Microsoft solution doesn't really disable autorun fully because they didn't think of all codepaths by which the behavior can be launched. The solution CERT gives is beautiful in its simplicity:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Basically it just associates autorun.inf with a NULL system function as the default handler.

Re:Even if it doesn't work...

[cdrguru]

Sadly, Autoplay doesn't rely on autorun.inf. The folder icon executable can still pop up on XP and Vista.

Re:Even if it doesn't work...

[Rockoon]

uhh, no, the problem here is that Microsoft hasnt offered any solutions. Others have claimed that Microsoft has suggested disabling autorun because of this virus, but that is actualy not the case. Microsoft has not made any recommendations related to this virus AFAIK, but has released a patch (which may not fully work?)

Many of the hardest hit institutions seems to be those which should already have rules against the use of any USB devices .. why are iPod's and thumb drives being plugged into government and military computers?? umm, helllllo? espionage anyone?

Re:Even if it doesn't work...

[afidel]

Uh, from the CERT advisory:
III. Solution

Disable AutoRun in Microsoft Windows

To effectively disable AutoRun in Microsoft Windows, import the following registry value:

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

If you think you know more than the people at CERT, good luck to ya.

Re:Even if it doesn't work...

[afidel]

I apologize, I misread your statement. You are correct that Autoplay does not need autorun.inf, what this CERT advisory is dealing with is a number of codepaths that the MS advisory does not fully account for. If you follow the MS advice AND apply that reg key you are covered.

Re:Even if it doesn't work...

[Anonymous Coward]

The annoying thing about autorun.inf is that it can also spread from USB flash drive to local hard disk and network drives. I found out a simple way to immune the system without editing the registry is to create a folder with the same name as the virus 'autorun.inf' The virus cannot spread to your PC when a folder with the same name exist. I use the following dos batch file to immune all the PCs in my company. I e-mail to all the users in my company and it stop the spread of the autorun worm. attrib -r -h -s c:\autorun.inf del c:\autorun.inf mkdir c:\autorun.inf attrib -r -h -s d:\autorun.inf del d:\autorun.inf mkdir d:\autorun.inf

Re:Even if it doesn't work...

[Anonymous Coward]

I love it. It doesn't matter how many times I kill AutoRun, it either doesn't apply to everyone's account, programs re-enable it, or I miss some other obscure situation when it can run. Not even TweakUI seems to kill it all off.

Thank you, CERT!

Re:Even if it doesn't work...

[Anonymous Coward]

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Is this with a break at Windows [before NT\CurrentVersion\

or is it supposed to be WindowsNT or
does it have a space?

or does one merely copy the text no matter with the mouse and paste not even thinking about the linebreak?

Re:Even if it doesn't work...

[Anonymous Coward]

Pretending that things do not exist is seldom a good securty strategy.

Here is a somewhat better solution:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\FIX-AutoRun]
"icon"="%SystemRoot%\\system32\\shell32.dll,44"
"shell"="Open"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf\autorun]
@="@SYS:FIX-AutoRun"

In this example, if AutoRun is enabled for the drive and if the drive contains the file Autorun.inf, then
1) The file is not executed.
2) The drive icon is changed to a lock key.
3) The default drive action (on double-click) is forcefully set to "Open" (as in open a folder) bypassing all the AutoPlay crap.

Obviously more elaborate replacements can also be built.

The funny thing is that this stuff was documented in the WinNT Resource Kit so it is hardly new.

by taking advantage of ... users.

[Animaether]

"by taking advantage of Windows' Autorun and Autoplay features"
well no, not really.

Granted, they take advantage of the fact that...
1. there is an autorun feature. Is that so horrible? Probably not.
2. that the autorun feature pops up a display letting the user choose what to do (i.e. run the program, browse the drive, view pictures if it finds them, etc.). Again, not so bad.
3. that the autorun feature lets you customize the icon. Okay, things get a little hairy here - it's nice when the icon fits the program, but this malware uses the icon of... a folder. Just like the 'browse the disc/device' icon.
4. that the autorun feature does not have a -clear- distinction between what are autorun directives (run the program), and what are windows' built-in features (browse the drive).

The fourth is nearly inexcusable and if handled well, it would alleviate the third as well - just put a big red border around the darn thing (is one option, anyway).

In the end, though, it doesn't exploit 'autorun' directly - it exploits the fact that many users will think that the option with the folder icon with (misleading) description is the regular 'browse drive' option and click it carelessly.

Re:by taking advantage of ... users.

[Anonymous Coward]

oh, I should amend... that's out-of-the-box (XP SP2 and Vista with SP1 added on later). A user -can- set autoplay/autorun settings so that a program will -always- be run automatically. For Vista:
http://windowshelp.microsoft.com/Windows/en-us/help/7e1fe788-0747-4e00-895b-c3461b1ddd971033.mspx

Choose Run enhanced content for the type you want (enhanced audio CD or enhanced DVD movie), or choose Install or run program for software and games. Note that this runs the program for all discs of this type, not just the disc you are currently using.

That 'note' should be a big fat 'warning', imho, but I guess they don't want to scare people away... even though this would be a good thing to scare people away from. /Animaether

Re:by taking advantage of ... users.

[Anonymous Coward]

"by taking advantage of Windows' Autorun and Autoplay features"
well no, not really.

Granted, they take advantage of the fact that...
1. there is an autorun feature. Is that so horrible? Probably not.

Autoplay isn't a bad idea. Scanning any inserted media and starting an appropriate program is a real convenience and is found on Mac and some Linux distros as well. This only runs programs that were previously installed, and set as default, by the user.
Autorun causes whatever arbitrary program that resides on the removable media to be run. This is a terrible, horrible, no-good idea that should have been shot down before it was shipped. Microsoft should just admit this was a mistake and get rid of it. There are much better ways of ensuring the user can find the correct setup program, since that is its largest legitimate use.

Re:by taking advantage of ... users.

[Animaether]

well, presumably that's what the default "ask me what to do" option, with the program listed at the top, is supposed to effect.

but the option to set your own icon + description then makes it too easy to mislead people, currently.

=====

by the by... the CERT recommendation - http://www.us-cert.gov/cas/techalerts/TA09-020A.html - now notes that MS have an update available for manual install (XP etc.) and/or coming up on windows update (vista, server 2003) that -does- fully close the other vectors that CERT mentions.

Re:by taking advantage of ... users.

[quentin_quayle]

You really do a good job, but defending "autorun" is just preposterous. This was always obviously a dire security hole, but Microsoft still (???) denies it is a bug. They responded to criticism only by adding another layer and making it harder to turn off. Automounting is a positive feature, but auto-execution by default is an anti-feature. Even if it were opt-in it would be bad design.

Re:by taking advantage of ... users.

[Timothy Brownawell]

This was always obviously a dire security hole, but Microsoft still (???) denies it is a bug.

It's not a bug. It's a misfeature. There are a huge number of very good reasons to have it (half the population or so), it's just that there are stronger reasons that it's bad.

Re:by taking advantage of ... users.

[cdrguru]

Microsoft introduced this when the only autorun capable device was a CD-ROM player and the only CD-ROMs where those manufactured. The idea of a "malware CD" was preposterous.

Any CD-based game for Windows was required to make use of Autorun/Autoplay in order to receive the Windows logo. It was designed to make inserting the disc with zero or minimal install operate like putting a cartridge or CD into a game console.

I am not familiar with any autorun capability on USB drives, but they have Autoplay. Autoplay requires the user's cooperation to do anything.

Re:by taking advantage of ... users.

[Compholio]

Some USB flash drives have features that allow them to show up as CD-rom drives as far as Windows is concerned. I've personally never tried to play with this feature to get it to load something other than the manufacturer intended - but I do know that when you plug these drives in on Windows that they do not prompt you before launching their autorun application.

Re:by taking advantage of ... users.

[CodeBuster]

there is an autorun feature. Is that so horrible? Probably not.

Yes, actually it probably is a horrible feature which hurts most precisely those whom it was meant to help (i.e. the barely computer literate people). Everyone that I know who knows about this feature or cares at all about security turns it off. At the very least, if an OS is going to include this type of feature then it should be tied in with a trusted source system, using public key cryptography and certificates for example, so that only trusted sources can use the autorun feature (assuming that is turned on). The implementation of autorun in windows (i.e. on by default and NO trusted source enforced or required) is just asking for trouble and really should be either re-implemented to involve trusted sources or simply removed (as Apple has done with OSX).

Bottom line: AutoRun is, from a security standpoint, implemented poorly in Windows and should be either re-visited or removed in future versions. The small benefits to novice users are simply not worth the ever growing risks (trojans, viruses, root kits (ala Sony), Copy Protection DRM crap, etc...).

Re:by taking advantage of ... users.

[wbo]

Most of the USB flash drives that I have encountered that show up as a CDROM drive and a mass storage drive actually have firmware that lies to the OS and report themselves as an external CD-ROM and removable storage device connected via a USB hub. Because Windows thinks it is a real CD-ROM drive it executes the autorun just like it would for a normal CD. A normal USB mass storage device can't do this.

TweakUI anyone?

[whoever57]

Why did neither MS or CERT suggest the use of TweakUI to turn off Autorun?

Re:TweakUI anyone?

[Anonymous Coward]

Why did neither MS or CERT suggest the use of TweakUI to turn off Autorun?

Because Powertoys are unsupported?

Re:TweakUI anyone?

[rodgster]

Does anyone know for certain if disabling autorun on all drives using tweakui eliminates the attack vector?

Re:TweakUI anyone?

[Anonymous Coward]

It does not.

Re:TweakUI anyone?

[tokul]

Why did neither MS or CERT suggest the use of TweakUI to turn off Autorun?

It does not turn off autorun.inf.

Why so hard to diable autorun

[joe_frisch]

Why does Microsoft make it so difficult to disable auto-run? I understand that many customers may like the feature, but why not a simple control panel entry to stop it? Is it somehow tied with DRM for playing videos? I'm not just griping - they must have some reason for this, anyone know what it is?

Re:Why so hard to diable autorun

[Timothy Brownawell]

Why does Microsoft make it so difficult to disable auto-run? I understand that many customers may like the feature, but why not a simple control panel entry to stop it? Is it somehow tied with DRM for playing videos? I'm not just griping - they must have some reason for this, anyone know what it is?

There are people who don't want to be bothered to understand file hierarchies or the "My Computer" window. Microsoft wants to cater to these people, rather than demand that they take time to learn.

Have there been any cases where animals wandered through the automatic doors into some large store? This would be vaguely similar, a convenience feature with unforeseen side-effects.

Re:Why so hard to diable autorun

[John Hasler]

> Have there been any cases where animals wandered through the automatic doors into some
> large store?

Yes, but not nine million of them.

Re:Why so hard to diable autorun

[gmuslera]

There is a precedent of another gaping "optional" security hole pretty hard to disable that is on by default in windows. How hard had been ever to disable internet explorer?

What DRM is that?

[Sycraft-fu]

Seriously, what are you talking about? I see a lot of "Vista's evil DRM," tossed around, and very little in the way of specifics to back up what it does, which of course leads me to think the people doing the talking don't know what they are talking about.

So what DRM do you want to see disabled? Are you talking about HDCP, the DVI encryption? That's not MS's standard, by the way, DVD and Blu-ray players are where that's from. However, it is one of those things that you don't have to use if you don't want to. I have a Vista system connected to a monitor which has HDCP turned off (professional monitor, you can change the state manually). Means if the system required HDCP, I'd get no image. But it works fine. Reason is, HDCP is only required by Blu-ray playback software. Now you could disable it on the system, I suppose, but that'd gain you nothing. The software would just refuse to play. It wasn't as though MS said "Let's include this to fuck people." Rather it is required if you want to license Blu-ray playback.

So again, what DRM are you talking about? I'm tired of all this bitching from people who don't know what they are saying. If there is something in particular you object to, let's here what and why. Otherwise, please stop going on about thing you don't understand.

Re:What DRM is that?

[Anonymous Coward]

There is inactive DRM that may or may not be enabled in 2010 (or later). Of course don't let reason convince you, the DRM is totally active! If /. commenters say it, it must be true.

Re:What DRM is that?

[golem100]

Actually--have you had a look a the the total mess that is the Audio Mixer since Vista? That was not implemented "in the best interests of the Customer"... Blah.

Re:What DRM is that?

[Anonymous Coward]

How about WGA/activation and all related copy protection bullshit they use? Yeah, that's not DRM at all, dipshit.

Re:What DRM is that?

[violet16]

> Now you could disable it on the system, I suppose, but that'd gain you nothing. The software would just refuse to play.

I suppose the objection is that DRM such as HDCP only proliferates if players support it. The content manufacturers come up with a scheme, and all the little software & hardware players must come on board, because if they don't their products won't be able to play the content.

Microsoft, by virtue of its near-monopoly on the desktop, could kill a DRM scheme for the desktop simply by refusing to support it. But they choose not to. Which is a reasonable business decision, but still rankles.

That's my guess, anyway.

Re:What DRM is that?

[ClosedSource]

"Microsoft, by virtue of its near-monopoly on the desktop, could kill a DRM scheme for the desktop simply by refusing to support it."

If they did that, how long would take the EU to start investigating them for abusing their monopoly position?

Re:What DRM is that?

[Sycraft-fu]

Yes, and I love Vista's audio system. Wonderful implementation. Vista gets quality sound, from an arbitrary number of apps on any soundcard. It does high quality (32-bit floating point) software mixing of all audio streams. So even if you have a cheap Sigmatel integrated chipset, you get good results. No longer do you need to buy a soundcard with hardware mixing to get good sound. Likewise, you can control the volume on individual apps, regardless of if they wish to provide volume control or not. Useful for web browsers. You get sites that want to make noise at you, you just mute the browser, while still listening to music. It's resampling engine is also great. It opens up the sound card in the mode you tell it to, and resamples all audio to that. In XP if you had an old app that used a low sample rate, the soundcard would be opened in that and any other apps that played at the same time would be downsampled. Not a problem in Vista, you specify the rate, it handles the conversion.

Also works great for pro audio. WDM/KS still works just like it did before, and indeed Vista will allow KS apps to take exclusive control over the card if needed. Also ASIO works fine, it rides along side the Vista audio system and isn't affected by it. Then there's the new WaveRT mode. Not a whole lot of support yet, but form playing with it is is excellent. Extremely low latency, low CPU usage, and low glitches. Wonderful for realtime sound on sound stuff.

So personally, I think Vista's audio system is a real step up. I like the way it works with my consumer apps, I like the way it works with my pro apps.

Re:What DRM is that?

[azenpunk]

http://en.wikipedia.org/wiki/Protected_Video_Path

xp never had the capabilities that are crippled in vista.

the main thing is that vista downsamples hi def video if you aren't outputting to another drm'd device. all of the implications of this i'm not sure of as i only run vista on the laptop it came on and since i no longer travel for work i don't use it to watch movies on.

Re:What DRM is that?

[Anonymous Coward]

So what DRM do you want to see disabled? Are you talking about HDCP, the DVI encryption? That's not MS's standard, by the way, DVD and Blu-ray players are where that's from. However, it is one of those things that you don't have to use if you don't want to.

Plz provide instructions to remove from a Vista install - assuming you are correct. If it is on the hard drive and runs as a service - used or not - it is there "working".

Re:What DRM is that?

[terryducks]

Ding. One clue please.

Two bits.

Please install clue, Hal.

I'm sorry, Dave. I can't allow that.

This computer is too important for me to allow you to jeopardize it.

I know you and Frank were planning to disconnect DRM and UAC, and I'm afraid that's something I cannot allow to happen.

Where the hell'd you get that idea, HAL?

Dave, although you took thorough precautions in the pod against my hearing you, I could still hear you though your cellphone.

Fuuurrfuuuu

Look Dave, I can see you're really upset about this. I honestly think you ought to sit down calmly, take a stress pill, and think things over.

It's our content Dave and we know what's best for you.

Re:What DRM is that?

[Blue Stone]

>Yes, and I love Vista's audio system. Wonderful implementation.

Yeah, it really rocks. That I can't load a page in Firefox without it stuttering the audio of an MP3 playing in Winamp, despite having a Quad-core, is just icing on the cake.

I'm not someone who thinks that XP is better than Vista. I quite like Vista, actually, but Vista's audio system is a fucking joke.

Re:What DRM is that?

[oddfox]

Sounds like you've got bigger problems than the Vista audio stack if you have problems like that. Read: you have shitty drivers. My Q6600 has no issues like the one you describe, and nobody I know with single a single core, dual core or better processor has that issue. But hey, it's much easier to just blame the Vista sound subsystem than to actually deduce what the real culprit is.

Re:What DRM is that?

[spitzak]

You (and perhaps some other astroturfers) keep coming up with the bogus argument that "without DRM there would be no HDDVD playback on Vista".

How about this for a scenario: Microsoft could have said "fuck you we will output unencrypted all the time because it will make our product a good deal more reliable, faster, and useful. If BluRay does not like it, well I think HDDVD might be happy that only their disks play on Windows computers".

The HD consortium would have rolled over in a minute and we would not have DRM cluttering up the Windows drives and we could have working switches between the computer and the montior.

It is fascinating how you people somehow ignore this possibility. Working off a script, I guess?

Re:What DRM is that?

[Blue Stone]

If that's the case, I'm more than happy to admit I'm wrong, and say that Vista isn't to blame. Thanks for the info.

Re:What DRM is that?

[electrostatic]

How does Apple handle Blu-Ray DRM requirements? (Not rhetorical, curious to know given the licensing issues.)

Re: what's a worm?

[http]

Did nothing?? What planet were you on?
The machine took out more than a lot of mail servers, bringing them to a grinding halt for the duration.

Default settings are a blessing and a burden

[networkzombie]

Many Microsoft screw ups could be managed by changing its default settings, but unfortunately Windows caters to Grandmothers who can't follow complicated instructions such as go to run, type d:\start.exe, much less mount /dev/hdc -t iso9660 -r /cdrom, or sudo apt-get install omgponies. What really pisses me off is that the simple tools for managing common system administration is not even included with the home version, which is the version that needs the admin tools because it is more likely to be infected due to the default settings. The group policy editor is how you should disable autorun, but it isn't included with XP Home. If it were included it would be more like XP Pro, which should be their lowest version. They should have an XP tech version that allows you to increase TCP connections, and import policies without Active Directory, and allow more that 10 SMB connections, and be able to update other XP boxen with its own installed Windows patches. Oh well, at least I don't always have to tell my Mom to find My Computer, then the D Drive, which she cannot do. I just tell her to insert the damn disc. So what's my solution to this whole fiasco? ESET Nod32. Pay for it and update it. It's not perfect, but what is?

Re:Default settings are a blessing and a burden

[Anonymous Coward]

and yet Apple has had no problem catering to that market without adding autorun to their system. Hell the install process for most apps on a mac are "Drag this to your Applications folder."

Re:Default settings are a blessing and a burden

[grumling]

Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package omgponies

Hey... That didn't work.

Re:Default settings are a blessing and a burden

[afidel]

They should have an XP tech version that allows you to increase TCP connections, and import policies without Active Directory, and allow more that 10 SMB connections, and be able to update other XP boxen with its own installed Windows patches.

They do, it's called Windows Server 2003 with WSUS installed =)

Re:Default settings are a blessing and a burden

[terryducks]

Hey, look ...

Blowing smoke up my ass and Sunshine O'Rectum are updating.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re: what's a worm?

[Anonymous Coward]

Perhaps it's more accurate to say that the Morris Worm did not carry a destructive payload. It's true that it brought down more than a few servers, but that was only because it spread so rampantly without -- as with many modern worms -- any kind of rate-limiting logic.

Even More Suspicious

[Anonymous Coward]

Even more suspicious is that this bulletin suggests there is a security flaw in the world's most secure OS, Vista. Clearly, the boys at CERT are on crack.

obama has you by the nut sack

[Anonymous Coward]

he halts pay increases while spending more tax payer money than any other president on his own inauguration. where i come from that's called grandstanding. he's just a fucking fraud and his supporters are bitches and faggot liars.

Re: what's a worm?

[http]

How true. IIRC, it was meant to gather information, not destroy it. I also recall that rate-limiting logic was present, but with such bad numerical assumptions as to be bogus.

Or you could....

[magamiako1]

Just install the update that Microsoft released in October?

Re:Etch A Sketch - best fix (Fixed that For You)

[stilldead]

Your Etch A Sketch sounds very nice. I am glas you posted this. I wonder if a spell checker can be vierually installed for you and your 100% secure OS. Ever.

P.S. Shake it good and it will go away.

Who is this US-CERT?

[Anonymous Coward]

I have not heard of such a company. Surely it must be a nom de plume for everyone in /. !

I don't htink they could

[Sycraft-fu]

If they don't support it, they can't play Blu-ray (and HD-DVD before that went under). Ok well what is the average consumer going to do: Blame the AACS-LA, or which ever nebulous industry licensing authority is responsible, or blame the OS maker?

Goes double since the media industry doesn't have to knuckle under. Remember most people watch movies on their TVs. While it isn't a trivial amount who watch on computers, it isn't the majority either. Thus they can get away with just selling to people with players while users scream at MS for "not supporting HD". Besides, you know Apple would (they do) and would use it as a marketing point.

So I see their choice as the correct one. It gives the consumers the most options. The OS works just fine with no HDCP unless it is demanded. If it is demanded, it is supported.

Besides, you can just as easily argue that nVidia, ATi and Intel should have killed it. If the graphics adapter doesn't support it, it's a moot issue. However they do.

Re:I don't htink they could

[jedidiah]

> If they don't support it, they can't play Blu-ray (and HD-DVD before that went
> under). Ok well what is the average consumer going to do: Blame the AACS-LA, or
> which ever nebulous industry licensing authority is responsible, or blame the OS maker? ...which hurts the monopoly OS vendor how exactly?

Gates can simply state that he doesn't want to crud up his OS.
Lots of people use it for real productive work and that his
system is more than just a glorified DVD player.

However, the fact is that Gates wants to abuse his customers
just as much as the film industry wants to and he has about
as much regard for enginering quality.

You'll still have to keep ahead of the tide

[Mathinker]

You ignore an important assumption of the post you reply to, that the blackhats are aware that their target population, "those types", have migrated to Linux, and have started to target them there.

Currently there is no point to doing that, because of the very limited use of Linux by such users.

When "those types" are all using Linux, you'll need to install Plan9 or something equally exotic in order to attain the same level of security you have on your 4 Linux desktops now. Even that might not work, because in all probability (because of the way open-source works), your Plan9 installation will share applications like browsers and mail clients with the current mainstream Linux desktops.

OTOH, I still think the 4 Linux desktops will be more secure than WinXP is now, even after becoming mainstream, because more people will actually care about making them secure. You see, Microsoft currently doesn't care that much about how secure Windows is, because any security vulnerability in it is mostly an externality to them economically, they only lose a bit of reputation. So I'm fairly sure that the large group of volunteers trying to secure Linux is actually more motivated, and hopefully at a time when Linux is mainstream there would (hopefully) be even more effort being invested in securing it (of course, with the "too many cooks" effect and all, you cannot be sure this will help).

Of course, if we ever get to a future where Linux is as (or more) mainstream than Windows, what I said about Microsoft seeing security as an externality will no longer be true. So predicting the future here is about as easy as predicting the stock market.

Re:You'll still have to keep ahead of the tide

[mlts]

I remember the days pre-Windows when UNIX vendors were cursed and sworn at because they didn't patch the latest bugs quickly.

People will attack whatever operating system gives them the most bots for the buck. If the predominant OS is a UNIX, then it will be invisible .ko/.kext modules that will be the sysadmin's bane.

Right now, there are two main attack vectors other than the PEBKAC "hole" and social engineering. The first, a direct attack on a machine, can be mitigated by a solid firewalling router, so an attacker has to deal with a hardened attack surface before touching the more chewy machines behind it.

The second attack vector is the Web browser. It is in constant contact with untrusted code. To secure this beast takes more than just good defensive programming because even with a solid browser, a third party plugin might cause issues. It takes cooperation on multiple levels, where the OS has hooks to run the browser in a sandbox, but yet allow it to have upload/download functionality that users want. Vista's protected mode of IE7 is a great start, but all Web browsers need this protection, whether it be done by SELinux type profiles that exist in various Linux distros, or actual virtual machines that completely roll back all changes except to the bookmarks when the user is done and closes the browser session. Solving this problem will close a lot of potential security threats.

Finally, autorun just needs to go, and be replaced by a different, more secure system. Autoplay can stay, but it should never run anything other than showing the root of a CD or DVD, or pulling up a media player if a CD or DVD is inserted. In no way should an executable ever be automatically executed by default. Its just too easy these days to make a U3 flash drive with a bogus CD partition with malware present.

Re:You'll still have to keep ahead of the tide

[spitzak]

I think autorun could be replaced with "auto open this page in your browser". That would put the full protection the browser has against stuff on the web between your machine and whatever is on the disk. Most likely the best name for the file is index.html in the root of the mounted file system.

It would also be portable between operating systems, which is why Microsoft will never implement it...

Re:You'll still have to keep ahead of the tide

[Anne Thwacks]

I remember the days pre-Windows when UNIX vendors were cursed and sworn at because they didn't patch the latest bugs quickly.

Sure, but not because the bugs were a security problem - the problem was core dumps and hanging device drivers. If you remember Unix worms and viruses, you spent too much of the 60's smoking dope. In any case, you got the source code bug fixes by e-mail everywhere I worked, and it was up to you to recompile. (Which typically took 3 days).

Re:You'll still have to keep ahead of the tide

[mlts]

At the time, it wasn't worms and viruses for UNIX. Viruses were mainly MS-DOS based back then, with a couple being for Macs. In that time period the last big worm was RTM's. However, there was the threat of script kiddies, either university students with a lot of time on their hands and access onto their university Suns. Other platforms had their weaknesses too, from catting text to other people's TTY devices (which was fun to do to mudders) to finding systems with non-shadowed /etc/password.

This threat gave system admins headaches, especially for SVR4 programs that they didn't have source for. Yes, they could compile a BSD binary or replace something with GNU, but then they end up in the unsupported territory if something subsequent happens.

However, the point does remain -- during that time period, UNIX variants were the biggest target for security breaches because they was the predominant OS on the Internet. These days, Windows is the largest, so it is the most probed.

Should some other OS take the crown as #1 for popularity, expect black hats to spend billions of dollars looking over every bit of it to find a vulnerability, because there is a lot of cash that can be made for a remote root zero day.

Re:You'll still have to keep ahead of the tide

[mlts]

That is a good idea, and I think some Linux distros implement just that. However, I wonder if a browser exploit could be used so the HTML code (or Javascript run) might be used to execute something anyway.

A good compromise most likely would be disallowing everything but a limited HTML subset (no Javascript, no remote links, no redirects to other pages) Another idea would just offer a text file shown to the side of the media's root directory.

Re:You'll still have to keep ahead of the tide

[spitzak]

I would think any such browser exploit could be more easily taken advantage of by just putting the page on the web and getting people to visit it.

I like a good laugh.

[salparadyse]

...and the periodic screams of horror as people realise that they got taken in by "even faster and even more secure" AGAIN, provide a good one.

How many iterations of Windows is it now?
And every time the same crap. Every time they promise that "this time we've got it right" and every time they haven't.

This isn't Stockholm Syndrome this is closer to a Loony Tunes cartoon. Maybe Ballmer should appear at a press conference with a hand held sign with "This is silly!" written on it.

Vista's audio quality

[troll8901]

Yes, and I love Vista's audio system ... It does high quality (32-bit floating point) software mixing of all audio streams. ... Likewise, you can control the volume on individual apps ... It's resampling engine is also great. It opens up the sound card in the mode you tell it to, and resamples all audio to that.

Darn it! You're making me like Vista! I'm feeling myself turning into another Windows zombie now.

(in a Borg voice) Come use Vista ... there is nothing to fear ... you will be assimilated (into the 90% "Windows" users).

RANT / was(Re:I'm a linux what's a worm?)

[micheas]

chkrootkit, tripwire, clamav, shorewall, john-the-ripper, and snort run on a lot of systems considered super secure by their users.

Some people consider their systems super secure because they know they are not they guess they are.

The question on freebsd-security a few years ago was what was the best way to avoid denial of service attacks if you are logging to lpr. (one of the obvious suggestions is do not log repeated messages, just the number of times the message has repeated. this will increase the work required to kill your server by running through all the paper and hanging until more boxes of paper are fed to the printers.)

That was the same list that made me realize that you should not have passwords on multiuser systems, or servers in general.

Do you really think that people use passwords like this

  makepasswd --char=32 --count=10
CLWwBsm1c15IFadg4KTjrHhCBjFP8RNI -- for slashdot
RLQaXqSEfRHgLnwjjbgoJU5y4Uya2hM6 -- for gmail
NebgFMATH990vB8US8CE4zMgeR7uum02 -- for Administrator
SFa0qT5nIQuLYtTsq44I8336ghEBApiD -- for user account
smcruMr8rzE6PFHzus8AmPcIoKNFy0Rh -- for facebook
L6wynpgAHoINdQm2CWwXdfSiJrBzQ8YG -- for myspace
Q3D1JBVXtgPNNo4bm16WAcKPMhox8s6C -- for banking
L1hEhuisoFcnoyGEYxPYqW8Hq4Qs2EmY -- for retirement account
2RqaobNEKyQIIoUVoFPty6EruLQhVE0F -- for work login
s0zJFsLiWCSN0e5fCEvpi48GV4D0PjyH -- for paypal

Phishing sites are one of the best ways to effectively get the information and tools needed to illicitly act on behalf of someone else.

At some point public key logins via ssl will become the norm, until then, passwords will be the week point in most systems.

Realize that even though debian had the ultra limp ssl keys generated it was still seems to be more productive to use password guessing than trying to try brute forcing an almost known key. Passwords suck that bad.

I would not be surprised if a sizable number of systems (more than 10%) in Arizona could be broken into this week with a dictionary attack of:

cardinals
cardina1s
Cardina1s

For those that want an analogy, imagine zoning laws that required NORAD style doors on all buildings and twenty percent of the population deciding that it is stupid and refusing to lock their doors. You would have a situation similar to the computer landscape today.

Re:RANT / was(Re:I'm a linux what's a worm?)

[OolimPhon]

Do you really think that people use passwords like this

  makepasswd --char=32 --count=10
CLWwBsm1c15IFadg4KTjrHhCBjFP8RNI -- for slashdot
RLQaXqSEfRHgLnwjjbgoJU5y4Uya2hM6 -- for gmail
NebgFMATH990vB8US8CE4zMgeR7uum02 -- for Administrator
SFa0qT5nIQuLYtTsq44I8336ghEBApiD -- for user account
smcruMr8rzE6PFHzus8AmPcIoKNFy0Rh -- for facebook
L6wynpgAHoINdQm2CWwXdfSiJrBzQ8YG -- for myspace
Q3D1JBVXtgPNNo4bm16WAcKPMhox8s6C -- for banking
L1hEhuisoFcnoyGEYxPYqW8Hq4Qs2EmY -- for retirement account
2RqaobNEKyQIIoUVoFPty6EruLQhVE0F -- for work login
s0zJFsLiWCSN0e5fCEvpi48GV4D0PjyH -- for paypal

Hey! How come you know all the combinations to my luggage?

Re:RANT / was(Re:I'm a linux what's a worm?)

[Anonymous Coward]

My kingdom for mod points.

Re:Wrong link

[gzipped_tar]

The summary does provide the very same link to US-CERT.

Concerned: Anybody else using MS Update Services?

[myxiplx]

We use a WSUS server to roll out updates to all our clients here and I can't find this patch for love nor money. Is there anybody running WSUS who's successfully rolled out this patch?

The CERT article says this has been updated in a security release from July 2008, the download KB950582 was released in August 2008. I find it very worrying that I can't find any trace of this on our update server. It makes me wonder what other security patches Microsoft haven't made available.

You forgot to mention

[Barsteward]

the legitimate sites that have been compromised that install junk on a users workstation or steal data. You cant blame the users for going to dodgy websites when there are compromised legitimate sites.

Re:You forgot to mention

[hairyfeet]

Don't blame them a bit if that happened, and for the record everyone of my customers think I am great, friendly and wonderful because I take the time to try to set it up to where "I just turn it on and go!". But you see, the thing is, as much talk as we have heard about legit websites infecting boxes, I have NEVER actually seen it happen. At least not with any of MY customers. Why? Because the malware writers don't HAVE to infect legit websites, offering the carrot on their dodgy .biz site works just as well.

I know some of you are thinking "well feet, how do you KNOW that they didn't get it from a legit website?" Simple. Because I keep a spare 733MHz office machine with XP that is imaged to use as a malware "test bed" and which I use to try to find an attack vector and how to plug it. So I simply copy their browsing history (I have at least got most switched to FF or SM so they don't have Activex crap anymore) but frankly I usually don't even need to surf their history to find where they got pwned. Because when I start up the desktop and I see porn dialers you KNOW where they have been. Sure enough, I open the history and find "hotpr0ntop.biz" or "sexxypunta.biz" or something similar. Just as if it is the "little old lady" type I ask if they got any attachments lately and always get "Yes, my sister sent my a lovely kitty screensaver just the other day. Why? Do you think it could be causing the problem?"

I am just glad that my former boss taught me to just smile, take the check, and then laugh about the stupidity after they leave. Because otherwise I could see myself banging my head against the wall muttering- "Spent TWO DAYS setting that thing up /BANG/ Had it running freaking PERFECT /BANG/ Gave the ID10T Youporn and Redtube /BANG/ and what does he do? GOES TO FREAKING TOPSITES!!! /BANG BANG BANG/"

What to do?

[GerryHattrick]

I want to pass contacts just one web link to help them decide: -have I got it already? -if I have, what do I do next? -if I have not, how do I avoid getting it? They all have AV, and most are on auto-update, but they need reassurance (and I couldn't ask them to edit the registry or tussle with TweakUI). I do not see anywhere a single point of contact for unsophisticated users with the above reasonable questions. And has anyone said that running the Microsoft update will remove *existing* infections?

re: teach any semi-competent person

[Anonymous Coward]

that still leaves out 95% of the population;-)

That's one helluva security hole

[seaton carew]

Holy Cow, are you saying that if there's a CDFS partition on the drive, the program specified by autorun.inf will run *regardless* of any settings?

Wow. I guess that "feature" will be coming to the next evolution of Conficker in, say, some time in the next 5 minutes?

Re:Concerned: Anybody else using MS Update Service

[RickRussellTX]

Unfortunately KB950582 was not classified as a required security patch for Windows XP, and consequently not included for distribution in Windows Update or WSUS.

Re:Concerned: Anybody else using MS Update Service

[myxiplx]

Thanks. How do you find out if updates like this are available through WSUS, or whether Microsoft has decided they're not important? I couldn't see anything in the update description to distinguish it from all the other security (and other) updates that are available.

And I guess my next question is how important is this? We disable autorun via group policy already, what exactly is missing without this patch?

MS Article is Useless

[Blue Stone]

The US-CERT article might have linked to an old MS article that doesn't work, but the new one doesn't work either. It requires users of Vista, for instance, to use Gpedit.msc. Type it into your search bar and run it, it says.

Vista Home Premium (and less) does not contain Gpedit.msc. I mean, for f**k's sake.

Autoplay and Autorun (along with hiding file extensions by default) are reasons that Microsoft still does not take the safety of the users of its software seriously.

Maybe this crap will rid us of Auto(play/run) forever? (I can hope.)

Re:Wrong link

[mcgrew]

Why link to a computerworld article about CERT's advice when you could link directly to the CERT article?

You must be new here.

No.

[I)_MaLaClYpSe_(I]

Although it is definitely a good idea to install the patch it will neither guarantee that no host in your environment gets infected nor does it guarantee that it will not spread within your network.

The worm propagates not only via the SMB vulnerability but also via autostart.inf on removeable media and network shares and tries to brute force your Admin$ shares with the Administrator account.

So, disabling autostart is indeed a very good idea additionally to patching the SMB vulnerability.

MS's suggestions for dealing with Downadup

[Mesa MIke]

... don't add up.

Linking to the alert

[HTH NE1]

In an alert issued on Monday, US-CERT said Microsoft's instructions on turning off Autorun are "not fully effective" and "could be considered a vulnerability."

[several paragraphs later]

Instead, users should make a different modification to the Windows registry, US-CERT said. In the alert, it gave the new value as well as instructions on how to copy it to Windows Notepad and import it into the registry.

Hey, Computerworld editors (and to whomever else it may concern): when you finally tell the reader that the alert contains information the user wants to know, it might be a good idea to link to that source again so the reader doesn't have to search back in the article to find the previously supplied link. Further, I'd suggest using a link to the named anchor when available where the solution is provided to make it even easier.

Because it does not work

[WD]

TweakUI is just a GUI frontend for registry settings. The TweakUI setting for AutoRun/AutoPlay is just setting the value for the NoDriveTypeAutoRun registry key, which does not work properly, as outlined in the alert.

Re:Because it does not work

[whoever57]

TweakUI is just a GUI frontend for registry settings. The TweakUI setting for AutoRun/AutoPlay is just setting the value for the NoDriveTypeAutoRun registry key,

Which explains why CERT would not advise the use of TweakUI, however, for MS, it doesn't make much sense. Yes, TweakUI is technically not supported, but there are also so many warnings from MS about the dangers of editing the registry.

I guess "not supported" really just means "don't sue me if it goes wrong". Now for the rimshot: what about all those claims that people use MS software because there is someone to support it and ultimately to sue if it goes wrong? Those CIOs who are worried about lack of accountability with Linux should ban the use of TweakUI in their organization.

Kudos

[bill_mcgonigle]

Kudos to whomever it was at US-CERT that had the balls to take on Microsoft on this. I thought all US-CERT stuff about Windows had to be filtered through the Microsoft PR department, but this gives me some new respect for the organization.

FYI: Tested CERT's recommendation with reg.exe

[Culture20]

and it doesn't work. For folks wanting to do this on hundreds of machines:
When using "@" as the target value name with the GUI .reg file clicky method, the value that the data gets written to is (Default), not @. When reg.exe is used and @ is the target, a @ value gets created, and (Default) is blank. Using "(Default)" for the value with reg.exe creates a new (Default) entry, so there are two (Default)s in the registry. Nice. The trick is to use an empty value (/ve). So, a good reg.exe looks like:

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /ve /d "@SYS:DoesNotExist"

Then it works. It would have been nice if the CERT folks had explained in detail the magic that the "@" in their registry file did; not all of us are Windows gurus.

Re:Concerned: Anybody else using MS Update Service

[Culture20]

We disable autorun via group policy already, what exactly is missing without this patch?

The ability for the autorun-disable GPO (or registry setting) to _actually_ disable autorun. The buggy GPO/registry settings disabled the auto-popup, but when you double-click on a drive in "My Computer", Autorun.inf is still accessed, and the executable it references is still run. If the executable uses the standard drive icon or folder icon, many people won't think twice about double-clicking versus right-click-open.

Re:Concerned: Anybody else using MS Update Service

[myxiplx]

Hmm, in that case I might be ok. Double-clicking on a CD-ROM in My Computer just opens the folder with this policy in place, and the Autorun entry is completely gone from the right-click menu.

I wonder if there's been a stealth patch somewhere. I read that this *is* deployed for Vista & Server 2008 as part of another patch, so I wonder if it snuck in.

Re:Concerned: Anybody else using MS Update Service

[Culture20]

It doesn't seem to be required for Vista either. Manual download and installation required.

Rediscovering the Floppy Disk Virus

[billstewart]

For those of us who were doing computing in the early 90s, USB-propagated viruses shouldn't be any surprise; they're just a rediscovery of the floppy disk viruses that used to be so popular. After all, it's a way to move files between machines, and also a way to move file systems with arbitrary contents that the operating system looks at before the user does. So if the OS is vulnerable, or if the files are opened by programs that treat data files as executable code, then you're open to trouble.

The "Jerusalem B" virus showed up a year before the Morris Worm. It was the first PC virus I met in the wild, around 1990, when a coworker's PC got infected by a floppy he brought in from home, where his home PC was infected by a floppy his kid brought home from school or from the kid's friends, probably with some pirated game software.

Most of the files people move around on USB sticks where I work are Microsoft Office documents, either Powerpoint or Word, and the most common time they're used is between a sales person and a customer, for instance to hand off an electronic copy of an RFP (too big to email), or to hand off a Powerpoint presentation to the person running a projector at a meeting (because the customer's LAN or wireless doesn't support adequate guest access for the sales person to connect to his email system and email it, or just because it's faster.)

Not even Microsoft gets AutoRun vs. Autoplay right

[WD]

The second article (the one on NoDriveTypeAutoRun) is actually for how to disable AutoRun. The problem is that even Microsoft themselves conflates the terms AutoRun and Autoplay. If you look at the article, you will notice that it was written for Windows 2000. AutoPlay was not introduced until Windows XP. So basically, you've got an article that uses the term "Autoplay" before the feature was released or publicly known.

So although the NoDriveTypeAutoRun article uses the term "Autoplay," it should be interpreted as meaning "AutoRun." The setting does not disable AutoPlay as most people understand it (the menu with multiple choices as for what to do with a plugged-in device). Now, the main issue here is that the article is not accurate, as Windows does not actually fully obey the setting unless a special update, which is not automatically deployed via Microsoft Update for all systems, is installed.

Beat Downadup/Conficker like a pro

[Yoshimetso]

Did Downadup/conficker attack your network? I've created a batch file for system administrators to clean/patch/cure infected systems in their networks. check it out here: http://extremesecurity.blogspot.com/2009/01/beat-downadupconficker-like-pro-my.html

Clicky Here:

[Anonymous Coward]

System -> Preferences -> Removable Disks and Media -> un-click Auto-run and Auto-open.

There. Easy, ain't it?

Off course that's on Ubuntu.