Microsoft looks into malware spreading via USB

By

Disabling AutoRun doesn't combat threat.

Microsoft is investigating new reports that malware is propagating through USB devices, the software giant's Security Response Center said.

The attacks may be linked to an unknown vulnerability in Windows, Sophos' Chester Wisniewski said in a blog post. The flaw permits a malicious Windows shortcut file (.lnk) installed on a USB device to run a Dynamic Link Library (DLL), with no user interaction required. The DLL installs malware onto the machine.

Because of this, users who have disabled AutoRun, a Windows feature that allows files or programs to immediately run as soon the device is connected to a computer, are not protected.

"If you can execute malware even when AutoPlay is disabled, the risk is very high," Wisniewski wrote.

The exploits were first detected last month by Belarus-based anti-virus firm VirusBlokAda. According to the company, the malware on the USB devices installs two drivers, which serve as rootkits that hide the actual malware, making it nearly impossible to detect.

Malware that propagates via removable media is not new; the much-publicised Conficker worm used that vector to spread to millions of computers worldwide.

See original article on scmagazineus.com

Microsoft looks into malware spreading via USB
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

CBA looks to GenAI to assist 1200 'security champions'

CBA looks to GenAI to assist 1200 'security champions'

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Log In

  |  Forgot your password?