Slashdot Mirror
Microsoft To Disable Autorun
jchrisos writes "Microsoft is planning to disable autorun in the next Release Candidate of Windows 7 and future updates to Windows XP and Vista. In order to maintain a 'balance between security and usability,' non-writable media will maintain its current behavior however. In any case, if it means no more autorun on flash drives, removable hard drives and network shares, that is definitely a step in the right direction. Will be interesting to see what malware creators do to get around this ..."
Why wasn't this the default to begin with? There's no good reason to automatically run anything on media like hard disks or flash drives. It's an obvious virus vector.
It's been a long time.
Since non-writable media such as CD-ROMs generally aren't avenues for malicious software propagation
Because no that's infected ever burns a CD, nope, never.
@ Will be interesting to see what malware creators do to get around this ..."
Attrib -w? Flip the Writeprotect dword in StorageDevicePolicies?
BBH
CD is read-only, thus not applicable. RTFS.
It's been a long time.
non writable media will maintain current behavior. pray attention.
It is about bloody time too.
It only took Microsoft 14 years to fix this massive security hole.
If I were God, wouldn't I protect my churches from acts of me?
I don't think so. Just tell the user to double click the setup.exe icon if it doesn't run automatically. Gotta turn off autorun in the user's brain.
Todos mis movimientos están friamente calculados
Not sure exactly what's doing it, but in my Ubuntu and gNewSense installs:
If I insert a CD with autorun files on it or it has an autorun folder, I am prompted that this disc has software on it designed to run automatically, and I am asked what I would like to do about it.
Seemed to be pretty sensible really. I mean *I* inserted the CD, so I expect something to happen.
Sony Music has announced a lawsuit against Microsoft using the DMCA, claiming that the new software patch circumvents horribly inadequate copyright protection.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
In any case, if it means no more autorun on flash drives, removable hard drives and network shares, that is definitely a step in the right direction.
Whoa...! Wait... they had autorun there too?!?! Dear god...
Here be signatures
Didn't Sony install rootkits as part of CD insertion/autoRun? CD-ROMs are a vector for malware.
Also, I remember some website getting sued because they mentioned how to disable autorun, effectively disabling their anti-copy rubbish. So will Microsoft be sued for removing this?
take any USB controller, have it emulate a Human Interface Device (aka keyboard), use it for the keystrokes of "windows, up, up, up, enter, virus-website, enter" and it's game over. you can do the same on Mac, just a tad more difficult.
CD-ROMs could have kept the common "Play button" interface from the beginning. Everyone knew this procedure. You insert a VHS into a VCR, you press play. You insert a cassette tape into a Walkman, you press play. CD into a CD player, press play. When the CD-ROM came out, wouldn't it logically follow to insert the CD-ROM, then press the "Play button" to execute any "autorun" functionality? That way it's a user-initiated event, but one that your entire target audience is already going to be familiar with. And the users who weren't intended on "playing" the CD-ROM don't press they play button and can go about, uninterrupted, copying it or navigating the file system as they intended. It's not a huge deal, but I just find it odd that Microsoft's implementation of "Autorun" was the solution to this "problem" back in the day.
Pay $0.03 more per disc and most of that stops. I've found that there are quite a few discs out there that are too cheap, they just don't work.
My blog. Good stuff (when I remember to update it). Read it.
Activate? The...software?
Eh?
On my U3 drives (both of them), the following would happen upon insertion:
Loading drivers
Found USB hub!
Loading drivers
Found USB mass storage device!
Loading drivers
Found USB CD-ROM!
The drives that appear are as follows:
A regular read/write USB flash drive, empty except for whatever I've put into it
A read-only CD-ROM
After the drivers all load (automatically and without intervention, under most Windowses), it would autorun the virtual CD drive as configured in windows.
Of course, I now have U3 disabled (more because I find no need for it, than because it is somehow evil), but that's how it worked for me.
Kid-proof tablet..
another good idea is reduce the number of "run on startup" lists to one. theres a billion options for running your stuff on startup. should be just one place.
while im ranting, i hate that i've got two processes in task manager called rundll32.exe that i havent a clue what they do
With a name like readme, NO ONE will open up that shit!
tookthemlongenough
Shoes for Industry. Shoes for the Dead.
Don't use hunt and peck typing, use proper typing. Starting a program using a KB is a lot faster than using a mouse.
Here's a link to disable autorun on 2k and XP for real. You won't get a prompt for what to do, the system won't try to do anything with a USB key or CD rom or removable drive. I recommend it to anyone who has to put other peoples' USB drives in their systems. http://windowssecrets.com/2007/11/08/02-One-quick-trick-prevents-Autorun-attacks
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff
Save that to a reg file. Disables autoplay system wide for all devices.
Please see http://technet.microsoft.com/en-us/library/dd349797.aspx
Vulnerability
An attacker with physical access to the computer could insert an Autorun-enabled DVD or CD into the computer that automatically runs a malicious program.
Countermeasure
Configure the NoDriveTypeAutoRun entry to a value of 255, disable Autorun for all drives.
In which case the malware is already running on the machine. Considering the point of adding your malware to autorun was to get it running on the machine, I'm not sure this is a significant security risk.
And they're not removing the feature. They're just making sure the default is "off". It's the sensible thing to do.
If you're secure enough about what's on the disks/pendrives/cameras/network shares you mount to use it then by all means turn it back on. But that ought not be the default because not everybody is at that level.
I'm not one to praise Microsoft usually, but this is a move in the right direction.
Help stamp out iliturcy.
I have to agree. I use gnome-do all the time to run my applications because I can't be bothered searching through the menus if I already know what the program does. I even use it for my IM client: if I want to chat to someone, I enter their name and hit enter as soon as there are enough letters to match their name.
I was arguing with a coworker why autorun is so dangerous. He said he never had a problem with it. So while he was away from his desk, I modified his USB key with an autorun that changes his desktop background to Unicorns and Rainbows. :-)
This all happens as fast as I type. S is safari, F is firefox, m is mail, p-space-s is photoshop, t-space-m is textmate etc...
Who still uses the dock??
And serious kudos to Microsoft for turning off autorun- that blesses me.
Wake me when they disable "autorun" for E-Mails.
Seriously, when's the last time you heard about 100,000 PCs getting infected by malware on a USB stick?
It's certainly a good step, but the problem it solves pales compared to pretty much everything else that windos has burdened itself with over the past decade or so.
Assorted stuff I do sometimes: Lemuria.org
What about floppy disks? Will the write-protection tab enable autorun?
Yeah I will never buy another Sandisk USB drive because they do this crazy thing of also having a small ROM in there that appears as a second drive that has an autroun that installs Sandisk 32-bit windows drivers and bloatware every time you plug the disk in, even on a 64-bit os. Needless to say the drivers and bloatware are completely unnecessary to access the drive itself.
You can disable autorun but cannot do anything to stop the read-only drive appearing and being mounted. To make it even more annoying, the small read-only drive gets the first available (lower) drive letter than the real drive.
Whatever marketing moron at Sandisk though that this was a good idea should be castrated (Preferably with a rusty knife) in an attempt to ensure he can't pollute the human gene pool further.