Slashdot Mirror
Microsoft Kills AutoRun In Windows
aesoteric writes "Microsoft has finally decided to push out an update to disable AutoRun in its XP operating system, a Windows feature that had been increasingly exploited by virus writers over the years. But because Microsoft still sees AutoRun as a feature and not a security hole, it isn't calling its Windows Update a "security update" but rather an "Important, non-security update" — but it effectively disables the AutoRun feature anyway."
After the recent AutoRun on Linux scare, will this mean patched XP boxes are more secure than Linux? The mind BOGGLES!
Would be nice to have the option to enable/disable the feature..
If you do not know how to start a piece of software running, or cannot follow some simple directions to do so, you really have no business using a computer in the first place.
Man, this is just like Sony removing the "Other OS" feature from the PS3. I PAID for Windows XP because of the Auto-Run feature, as I'm sure many others have as well. This is a clear case of bait-and-switch deceptive marketing practicing. I wonder if a legal case could be made...
Rhymes that keep their secrets will unfold behind the clouds.There upon the rainbow is the answer to a neverending story
When I insert a USB stick, Windows XP opens an AutoPlay window asking me what action to take. If the autorun.inf file is found, the default choice in the AutoPlay window is to run whatever is in autorun.inf. What now? Does XP completely ignore autorun.inf with this update?
Their CD rootkits won't run automatically
Bet you there's a super-secret way to re-enable autorun on a specific medium for just such reasons
(which will be discovered and exploited by malware writers)
I for one think this is a sensible thing to do.
This is an update to KB967940, regarding the patch offered in KB971029 going to automatic updates.
I had to look up the numbers, so I thought I'd just share, and save anyone else the trouble.
Whoosh.
Or an infected CD-ROM or DVD, etc. Or the infected ISO you downloaded and mounted as a drive. Or the network drive that was just mounted. Or your MP3 player mounted in UMS mode. Or an infected external drive. Or a CF or SD/SDHC card mounted through a USB adapter. Or ...
You get the picture. Auto-Run was a bad idea. I'm glad they disabled it.
Put my fist through my alarm clock with its ding-dong death inside my ear. - The Blackjacks.
Interesting that this bugfix was released only for XP. In 7, there's a dialog, but autorun.inf can show anything there, so most users will be just as easily fooled.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Given that PKI (Public Key Infrastructure) has been around longer than Internet Explorer, I could never understand why autorun.inf files weren't signed. Didn't Microsoft learn from all the problems induced by autorun-like behaviours on Amiga and Macintosh?
Up until about MacOS 8 (I think) the Finder used to automatically execute .CODE resources in files on disk/HDD/CD whenever a new disc came online which is how most Mac viruses got propagated.
Will nobody else say it? Ok, I'll say it without inserting some criticism about the timing, the need for this change, or whatever.
This needed to be done. The patch needed to be the default. The patch is here and it provides an improvement on the Windows experience not only for the Windows users, but for those of us who share an Internet with them.
So thank you, Microsoft, for doing the right thing.
Help stamp out iliturcy.
One might even suggest it wasn't a coincidence, but that would be absurd!
Great Intellect...
non-security updates don't always auto-update. This will remain an attack vector until they declare it a security update.
[sarcasm] He has auto-sarcasm turned of, you insensitive clod! [/sarcasm]
Autorun is not a bad idea. It has just been badly implemented. MS obviously found it easier to just disable it than to make it secure.
Autorun as not a bad idea. It was a very good idea that was badly implemented. For any media, there is no reason that the autorun needed to run an executable. It could have very easily have used an OS supplied splash screen that used an ini to supply text, a graphic and a few launch buttons. That is all most autoruns do anyway. By using the OS's executable, it would have made it as secure as any other application that could display a graphic and text. Since IE was in the OS and could do both, the OS supplied autolauncher would not make the system any less secure than not having it at all. For writable media, the OS should let you generate an encrypted key that gets written to the media authorizing it to autolaunch an actual executable.
Don't post as AC, get a nickname. Maybe something with "pompous" in it is available.
Remove the "hide file extension" stupidity that makes it easy for trojans to get ran.
Honestly, the manager that green-lighted that feature and continues to make it exist in the OS needs to be fired, tarred, feathered, and then put in stockades so the rest of us can do what we want to him.
Do not look at laser with remaining good eye.
You sir are what we call in the IT world as a....
N00B.
Please come back when you actually know something about computers.
Do not look at laser with remaining good eye.
They need to also by default show file extensions in explorer.
Although everybody keeps saying that it will display "MyPhoto.jpg.exe" as "MyPhoto.jpg" and thus mislead people, while I certainly admit it is quite likely, I am confused why the MS defenders don't point out that it should not confuse people because a real "MyPhoto.jpg" would display as "MyPhoto" and thus be different than the bogus file.
Can somebody explain this?
If in fact it deletes the entire ".jpg.exe" it would explain confusion, but then it means MS is using different rules in different parts of the code (ie it uses only the ".exe" rather than ".jpg.exe" to figure out what to do) which I think is far stupider than I believe even they would have done in the dark ages of 1990 or whenever they started this...