Microsoft looks into malware spreading via USB

Microsoft is investigating new reports that malware is propagating through USB devices, the software giant's Security Response Center said.

The attacks may be linked to an unknown vulnerability in Windows, Sophos' Chester Wisniewski said in a blog post. The flaw permits a malicious Windows shortcut file (.lnk) installed on a USB device to run a Dynamic Link Library (DLL), with no user interaction required. The DLL installs malware onto the machine.

Because of this, users who have disabled AutoRun, a Windows feature that allows files or programs to immediately run as soon the device is connected to a computer, are not protected.

"If you can execute malware even when AutoPlay is disabled, the risk is very high," Wisniewski wrote.

The exploits were first detected last month by Belarus-based anti-virus firm VirusBlokAda. According to the company, the malware on the USB devices installs two drivers, which serve as rootkits that hide the actual malware, making it nearly impossible to detect.

Malware that propagates via removable media is not new; the much-publicised Conficker worm used that vector to spread to millions of computers worldwide.

See original article on scmagazineus.com