Microsoft is investigating new reports that malware is propagating through USB devices, the software giant's Security Response Center said.
The attacks may be linked to an unknown vulnerability in Windows, Sophos' Chester Wisniewski said in a blog post. The flaw permits a malicious Windows shortcut file (.lnk) installed on a USB device to run a Dynamic Link Library (DLL), with no user interaction required. The DLL installs malware onto the machine.
Because of this, users who have disabled AutoRun, a Windows feature that allows files or programs to immediately run as soon the device is connected to a computer, are not protected.
"If you can execute malware even when AutoPlay is disabled, the risk is very high," Wisniewski wrote.
The exploits were first detected last month by Belarus-based anti-virus firm VirusBlokAda. According to the company, the malware on the USB devices installs two drivers, which serve as rootkits that hide the actual malware, making it nearly impossible to detect.
Malware that propagates via removable media is not new; the much-publicised Conficker worm used that vector to spread to millions of computers worldwide.
See original article on scmagazineus.com
Microsoft looks into malware spreading via USB
By
Dan Kaplan
on
Jul 19, 2010 10:39AM

Disabling AutoRun doesn't combat threat.
Got a news tip for our journalists? Share it with us anonymously here.
Sponsored Whitepapers
Planning before the breach: You can’t protect what you can’t see
Beyond FTP: Securing and Managing File Transfers
NextGen Security Operations: A Roadmap for the Future

Video: Watch Juniper talk about its Aston Martin partnership
Don’t pay the ransom: A three-step guide to ransomware protection