Slashdot Mirror
Spikes Detected In Autorun Malware
msm1267 writes "Researchers recently have seen a major increase in the volume of autorun malware in some countries, thanks to a couple of new worms infecting those older machines. The two new worms, Worm.JS.AutoRun and Worm.Java.AutoRun, both take advantage of the autorun functionality to spread, and the JavaScript worm has other methods of propagation, as well. Researchers at Kaspersky Lab say that the volume of autorun worms has remained relatively constant over the last few months, but there was a major spike in those numbers in April and May, thanks to the distribution of the two new pieces of malware."
This is a Windows thing right?
Time to sell more AV !! Let the sheep fear the big bad wolf !!
It's Bush's fault!
Well they were likely behind STUXNET, and they did promote the threats of Stuxnet to get funding for themselves.
Because they keep being screwed by things like this all the time and there is no rioting band of geeks with pitchforks and shovels and rakes (and implements of destruction /Guthrie) demanding that this be removed from Windows.
>autorun.inf
The most dangerous thing to ever come out of a computer company. That this feature made it past review demonstrates the utter disregard for the most basic security at all, especially since boot sector worms had been around for years in DOS and Win3.1 before Win95 ever graced us with its presence. Since Windows 95, it's been trivial to write auto executing code because Microsoft deliberately yanks down the pants and underwear of the end user and says "Go to it!"
The fact that autorun still exists in modern versions of Windows is even more telling. "Backwards compatability" is more important than keeping users safe. Yes, I know that it's turned off by default since Vista, but the option to turn it on should never be there in the first place. Autorun in The Year of Our Lord and Savior Jesus Christ Twenty-Thousand-And-Thirteen is beyond the pale.
--
BMO
NSA did a predictive sales analysis for the XBone and decided to take matters into their own hands...
...and you won't autorun a virus.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Just after NSA deploy its own exploit
A little while ago, there was some Android malware on Google Play that had this as a side effect.
It not only infected your phone, but then installed an autorun script on SD cards so the next time you plugged your phone into your PC, it would infect Windows as well.
You can bet such things will continue... or if it was the cause of some of the spikes, as well.
No doubt we'll see more of this type of article for the next year as the drive to bury XP intensifies. It's not going to yield the results they expect, but hey.
Help stamp out iliturcy.
I tried to follow a perp earlier, but he'd gone and stuck a banana in my patrol car's tailpipe, and it stalled out.
Seriously, who the fuck is still running Windows, and still uses autorun? Whenever I help any of my less computer-savy friends with their computers, (those who refuse, or sadly for them, can't use Linux) with their Windows computers, I usually just back everything up using Linux, and do a clean reinstall. It's no longer worth my time to try to unfuck a Windows install, any version.
One time, I got so sick of this idiot who kept asking me to fix his laptop, that when he did it for the third or fourth time, (third or fourth virus or deleted critical system file...) that I backed up his machine's disk, installed Fedora 11. He'd simply said "please just fix it," but hadn't specifically authorized this... I interpreted his request for me to fix it as a tacit request to install Linux. When I was done, and he saw what I did, he threw the laptop. He literally picked it up, ripped the power cord out, and threw it.
But hey, I never had to unfuck his stupid XP install again, or listen to him bitch about how fucked up his computer was.
I bumped into him again and saw on his shiny new(er) laptop over his shoulder that he was using Ubuntu. There was no point to this story, but I thought it was funny and ironic.
One thing we've recently seen in my workplace is a Trojan horse virus embedded in a fake Flash player update which carries a valid Adobe signature.
So even allowing only signed apps to install is no guarantee of security.
The main difference with something like UAC versus Apple's Gatekeeper is that Apple made the effort to sell as many programs as possible in their own online store for the Mac, and Microsoft didn't really have an equivalent. So Apple was in a position to put something in place allowing only those store purchased items to be installed by end users (while admins of a box could still have less restrictive settings and load whatever they wished). This allows configuring a system with everything a user needs up front, but still giving the user freedom to buy and load a wide selection of programs after the fact, while ensuring they all come from a known, safe source.
THE ONLY reaosn this is done is from some rich govt wanting to spy on people
THEY aint rich? IF they was it would be done to newer machines and people with money....
SEE why attacking old old old windows xp isnt gonna get ya very rich or far.....
cheap buggers like myself know this and dont care
"Once the worm is on a new [Microsoft Windows] PC, it extracts a DLL from its code and then copies itself to the temporary user folder. It also copies the Java executable from %ProgramFiles% to the same folder" link
AccountKiller
ShellHWDetection
Provides notifications for AutoPlay hardware events.
Startup type: Disabled
You know, Microsoft started out having programs available from Microsoft. Then they got hit with an antitrust suit. Didn't end too well for them either. Can this please happen to every corporation who is guilty instead of just 1?
Seriously? Who hasn't disabled autorun? I remember thinking autorun was a bad idea in 1995 when Windows first included it, and have disabled it on the corporate network for at least... 8 years?
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Sounds like you have quite a bit of people using porn / torrents in your workplace...
That is the only place I've seen the fake flash player ads.. the are quite common there... The new one is fake chrome update ads.. Probably firefox as well...
One aspect of the auto-run problem is that XP is still pervasive operating system for a lot of low-resource countries in the developing world. Users in these countries are more likely to own a flash drive than a computer. They then visit multiple computers in cyber cafes, campus labs, etc and spread malware inadvertently. I personally battled "flash viruses" that in East Africa in 2009 as a lab admin and Haiti in 2011. It felt difficult to lock down the auto-run capability on that XP; I recall different opinions from security software companies and Microsoft on what a true lock down of this capability was. Im my opinion, here are some ways to make this trend go away.
* Help these countries bury XP and even Windows. This means providing better alternatives to the Microsoft charity licenses for XP and the dominant pirate market for XP by having more Linux friendly initiatives at a high government ministry level. Red Hat, Canonical send goons!
* Free anti-virus providers need to all make this auto-run vulnerability an audit failure with a clear path to correcting it. Because if you become a computer owner in a low-resource country, you are likely to only use free-ware ant-virus.
I don't know how many "guess the ext" games I had to play when some place would tell everyone to turn on full filenames without warning them NOT to fuck with the dot three
Three measures help make loss of extension metadata more difficult.
The first part is to warn the user when changing the extension. Windows has been doing this half since I started using Windows in 1999.
The second part is not to include the extension in the automatically selected text when the user renames a file. Windows 7 gets this right, and Windows Vista may have, though I don't have any Vista PCs on hand with which to confirm this.
Finally, the operating system should allow application installers to register patterns that the file manager uses when identifying a file's content type by its contents. For example, "<!DOCTYPE HTML" or "<html" would suggest HTML, regular expression "GIF8[79]a" would suggest GIF, "\xFF\xD8" would suggest JPEG, "\x89PNG\r\n\x1A\n" would suggest PNG, "NES\x1A" would suggest NES game, etc. To my knowledge, Windows has not yet adopted a counterpart to UNIX file(1).
Stallman wants primary recognition, for having done all the EASY stuff!
So you think Emacs, g++, and glibc are "easy stuff"? Kernel may be hard, but templates in C++ are undecidable .
Seriously, who the fuck is still running Windows
People who need to run iTunes or any other application listed as "garbage" in Wine's AppDB.
and still uses autorun?
You got me there. Windows for the past six years has defaulted to using autorun only for optical discs, and with the proliferation of USB flash drives and high-speed Internet access in urban areas, only farmers use optical discs.
They want to be able to buy software and install it, e.g. games.
What keeps professional developers of Windows applications from porting their applications to use the framework formerly known as Metro and sell games through the Windows Store? "They work only with Windows 8 and Windows RT, and most users have Windows 7." In that case, what keeps professional developers of Windows games from offering their games through GOG and Steam?
Buy a tablet or etch-a-sketch instead, or perhaps a Chromebook.
The content owner has not made this comment available on mobile
Add to playlist to watch it later on a PC
I don't think gatekeeper means what you think it means. It's not a walled garden. It's not uac. It's a sensible anti malware tool.
So where should a developer of applications distributed as free software or otherwise without charge come up with the $99 per platform per year to register with Gatekeeper and other platforms' counterparts?
maybe microsoft found pandoras source code
Anyone can. The Pandora handheld computer runs a GPLv2 licensed Linux operating system.
Unless that software is Lotus, Borland, Novell, or one of the hundreds of other software packages that Windows has prevented from running well
True, upgrading from Windows 98 to Windows 8 will break some (not all) applications. Microsoft can't do much about applications that use an API contrary to specification. Once each new version of MS-DOS or Windows came out, most of the important software patches to which you refer were swiftly updated.
In one sense it is an open platform because it allows any software or hardware developer to release their stuff to the system without Microsoft's consent.
"Hardware"? Hardly. Device drivers for x86-64 need to be digitally signed with a kernel-mode code signing certificate issued by a Microsoft-trusted commercial CA to a registered business entity, and these certificates expire. Keeping up with renewing a certificate per platform per year can pose a substantial expense to hobbyist hardware tinkerers. And even pure software developers run into problems. While Windows for x86 and x86-64 is an open platform with respect to desktop applications, it isn't so open for applications that use Windows 8's Modern UI or applications for Windows RT, which must go through either the Windows Store or a sideloading CAL for enterprise line-of-business applications that's even more expensive than the iOS enterprise developer program.
Windows Vista and newer don't autorun directly*... they instead bring up a number of options when removable media is inserted, with the top one being the autorun program if one exists.
Then let's call our fake antivirus installer "View files on this drive" or something to that effect.
And, it certainly can't be done on Windows.
The people least aware of the risks of general-purpose computing are also the people least likely to change defaults.
Would NO ONE open a file browser, and navigate to that media, and select that file he was interested in? NO ONE AT ALL?
If the user receives no visible notification that the operating system has made a particular device available for viewing in the file manager, then the user is not likely to check in the file manager and is instead likely to think the operating system is broken. It'd be better to automatically open the file manager when a volume is mounted, but of course, the file manager would have to not have some sort of critical "bannerbomb" bug that allows an application's icon to trigger code execution.
Would NO ONE open the file in a text editor, to see what it really is, as opposed to what it claims to be?
Correct. Virtually no one would go that far, especially given how long it takes Windows Notepad to open a 100 MB file. The millions of clueful users of Windows are outweighed by hundreds of millions with less clue.
Your walled garden is but one possible approach to solving the problem of poorly configured systems.
It also happens to be the most profitable among such approaches, especially to the operating system publisher. The major game consoles and iOS bear this out.