Slashdot Mirror
Microsoft To Disable Autorun
jchrisos writes "Microsoft is planning to disable autorun in the next Release Candidate of Windows 7 and future updates to Windows XP and Vista. In order to maintain a 'balance between security and usability,' non-writable media will maintain its current behavior however. In any case, if it means no more autorun on flash drives, removable hard drives and network shares, that is definitely a step in the right direction. Will be interesting to see what malware creators do to get around this ..."
Why wasn't this the default to begin with? There's no good reason to automatically run anything on media like hard disks or flash drives. It's an obvious virus vector.
It's been a long time.
Since non-writable media such as CD-ROMs generally aren't avenues for malicious software propagation
Because no that's infected ever burns a CD, nope, never.
It is about bloody time too.
It only took Microsoft 14 years to fix this massive security hole.
If I were God, wouldn't I protect my churches from acts of me?
I don't think so. Just tell the user to double click the setup.exe icon if it doesn't run automatically. Gotta turn off autorun in the user's brain.
Todos mis movimientos están friamente calculados
Not sure exactly what's doing it, but in my Ubuntu and gNewSense installs:
If I insert a CD with autorun files on it or it has an autorun folder, I am prompted that this disc has software on it designed to run automatically, and I am asked what I would like to do about it.
Seemed to be pretty sensible really. I mean *I* inserted the CD, so I expect something to happen.
Didn't Sony install rootkits as part of CD insertion/autoRun? CD-ROMs are a vector for malware.
Also, I remember some website getting sued because they mentioned how to disable autorun, effectively disabling their anti-copy rubbish. So will Microsoft be sued for removing this?
I don't see the problem so many people are having. In XP+ when you put in a CD/flash/w/e you get a windows menu popup saying do you want to open in the browser or play in your media player or w/e. This seems perfectly reasonable. No code is being executed off the disk so no security hole. If you want the CD to run a splash or w/e it is one click. If you want to browse it one click. And it can be set to remember your answer for different devices. I completely fail to see the problem with that.
If this does mean that they are breaking U3 drives I'm happy for the change mind you.
another good idea is reduce the number of "run on startup" lists to one. theres a billion options for running your stuff on startup. should be just one place.
while im ranting, i hate that i've got two processes in task manager called rundll32.exe that i havent a clue what they do
In which case the malware is already running on the machine. Considering the point of adding your malware to autorun was to get it running on the machine, I'm not sure this is a significant security risk.
And they're not removing the feature. They're just making sure the default is "off". It's the sensible thing to do.
If you're secure enough about what's on the disks/pendrives/cameras/network shares you mount to use it then by all means turn it back on. But that ought not be the default because not everybody is at that level.
I'm not one to praise Microsoft usually, but this is a move in the right direction.
Help stamp out iliturcy.
In your scenario, you are plugging a physical device of your own design into the target machine, either personally or by distributing it to unsuspecting users.
The real attack scenario of interest is malware that propagates by adding itself (and autorun settings to launch itself) to USB storage devices provided by the unsuspecting user. You don't get to choose the physical device, only write to its filesystem.
Wake me when they disable "autorun" for E-Mails.
Seriously, when's the last time you heard about 100,000 PCs getting infected by malware on a USB stick?
It's certainly a good step, but the problem it solves pales compared to pretty much everything else that windos has burdened itself with over the past decade or so.
Assorted stuff I do sometimes: Lemuria.org
Yeah I will never buy another Sandisk USB drive because they do this crazy thing of also having a small ROM in there that appears as a second drive that has an autroun that installs Sandisk 32-bit windows drivers and bloatware every time you plug the disk in, even on a 64-bit os. Needless to say the drivers and bloatware are completely unnecessary to access the drive itself.
You can disable autorun but cannot do anything to stop the read-only drive appearing and being mounted. To make it even more annoying, the small read-only drive gets the first available (lower) drive letter than the real drive.
Whatever marketing moron at Sandisk though that this was a good idea should be castrated (Preferably with a rusty knife) in an attempt to ensure he can't pollute the human gene pool further.