Microsoft says RIP Windows XP AutoRun for USB

Powered by SC Magazine
 

The feature that became an attack vector.

Microsoft has finally decided to push out a Windows update that should stop attempts to exploit AutoRun with a USB stick.

AutoRun is a feature of the Windows operating system that fires up any program once a USB or CD/DVD is inserted into a computer.

In recent years hackers have increasingly turned to AutoRun, which permits programmers to deliver instructions via Autorun.inf files to run programs without first gaining user permission.

The problem for Microsoft was that while the obvious solution was to disable AutoRun, it was considered a legitimate feature, which happened to be exploited by the Conficker worm, Rimecud and Taterf.

"AutoRun isn't an accident -- it's by design, and as I mentioned we care about the very real positive uses of the feature. In other words, in a very real sense, it's not a bug, it's a feature," said Adam Shostack, a Microsoft security program manager.

So Microsoft wasn't calling its Windows Update a "security update" but rather an "Important, non-security update" which effectively disabled AutoRun.

The feature remained in Windows 7 but Microsoft claimed to have largely addressed AutoRun abuse. One of its reasons for issuing the "non-security update" was that it found that Windows XP users were 10 times more likely to get infected when faced with such an attack.

First introduced in Windows 95, the feature has caused security professionals frustration. In 2008, infected digital picture frames exploited the feature and while it was possible to disable AutoRun, doing so was not an easy task.

At last year's AusCERT security conference IBM accidentally issued delegates a thumb drive which exploited AutoRun.

Copyright © iTnews.com.au . All rights reserved.


Microsoft says RIP Windows XP AutoRun for USB
 
 
 
Top Stories
Don’t mention digital disruption to David Whiteing
Buzzwords don’t curry favour with CBA's new CIO - it’s all just innovation to him.
 
Content, cost & constant innovation: How Foxtel plans to take on Netflix
Nell Payne inhabits the “brave new world of blue strings and networking”. Just don't ask her to put a TV screen on your microwave.
 
Westpac fires starting pistol on core banking upgrade
St George readies itself for move to Celeriti.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Microsoft launches Office for Android preview
May 22, 2015
Microsoft has launched a preview of Office for Android smartphones. Pre-release versions of ...
Microsoft is working on an iOS email chat feature called Flow
May 22, 2015
Microsoft is working on a new chat app, but at the moment we know more about what we DON'T know, ...
Windows 10 free upgrade: Microsoft details who gets what
May 22, 2015
Microsoft was meant to be streamlining its OS with Windows 10, so why is upgrading so confusing? ...
Windows 10 has an edition to suit everyone's needs
May 15, 2015
Microsoft unveils a mind-melting six editions of Windows 10 ahead of its Winter 2015 launch. ...
Firefox 38 FINAL released, debuts new tab-based preferences
May 13, 2015
Mozilla has unveiled the latest version of Firefox 38.0 FINAL for desktop, with Firefox for ...
Latest Comments
Polls
Should Optus make a bid for iiNet?

   |   View results
Yes
  43%
 
No
  57%
TOTAL VOTES: 590

Vote