Microsoft Kills AutoRun In Windows 340
aesoteric writes "Microsoft has finally decided to push out an update to disable AutoRun in its XP operating system, a Windows feature that had been increasingly exploited by virus writers over the years. But because Microsoft still sees AutoRun as a feature and not a security hole, it isn't calling its Windows Update a "security update" but rather an "Important, non-security update" — but it effectively disables the AutoRun feature anyway."
Re:Option? (Score:5, Informative)
Would be nice to have the option to enable/disable the feature..
It has been an option for as long as I can remember. It used to be one of the first things I turned off after a new install, right after I turned on the display of File Extensions.
Re:What about AutoPlay? (Score:5, Informative)
Knowledge Base references (Score:5, Informative)
This is an update to KB967940 [microsoft.com], regarding the patch offered in KB971029 [microsoft.com] going to automatic updates.
I had to look up the numbers, so I thought I'd just share, and save anyone else the trouble.
Re:not the same thing this is just takeing away a (Score:5, Informative)
Whoosh.
7 and Vista still vulnerable (Score:4, Informative)
Interesting that this bugfix was released only for XP. In 7, there's a dialog, but autorun.inf can show anything there, so most users will be just as easily fooled.
Re:Option? (Score:5, Informative)
Sigh. On a Mac, my drunken bigoted friend, a Mach-O file renamed to foo.jpg will happily run *because* the operating system dives into the file format to figure out how to run it. If I embed the appropriate icon resource in the file it'll even look like your default image viewer is going to open it, and if I subsequently start that image viewer once I've got control you'll never know it wasn't.
That's the security flaw: you can make an icon look to the user like it will only open up the image viewer, when actually arbitrary code will be executed.
Without file extensions being hidden you see foo.jpg.exe and say "that's an exe, I'm not going to run that", even if it has a friendly jpg icon embedded in it.
Re:Knowledge Base references (Score:4, Informative)
Someone needs to mod this up. Anyway another interesting link: http://blogs.technet.com/b/msrc/archive/2011/02/08/deeper-insight-into-the-security-advisory-967940-update.aspx [technet.com]
Re:XP now more secure than Linux? (Score:5, Informative)
After the recent AutoRun on Linux scare, will this mean patched XP boxes are more secure than Linux? The mind BOGGLES!
The 'autorun on Linux scare' appears to be primarily due to automatically displaying thumbnails of corrupted files which exploit holes in image and video rendering libraries; so Windows is at least as insecure. Windows was far more insecure when it would also happily load a DLL from the USB drive in order to perform that rendering because '.' was first in the DLL search path.
Plus Ubuntu, at least, now seem to be wrapping the thumbnail generators in Apparmor which makes it far more difficult to exploit.
Re:Should have never been there. (Score:4, Informative)
True in general, but some Windows installation disks do more than just run setup.exe on startup and instead have rather involved scripts in autorun.inf. I had a driver/utility CD for an NAS device that created a menu of the manufacturer's different models via autorun and could not be invoked any other way
There is no scripting in AUTORUN.INF...it's really just a very simple INI file. The only thing that could be considered a "script" is the ability to run different programs based on the machine architecture and OS version (controlled by square-bracketed INI section heading tags).
If you trust a disc, you can just open the AUTORUN.INF file with a text editor and copy what is to the right of "open=" and paste it into the start menu run box and it will do exactly what would have happened if autorun was enabled.
Re:Knowledge Base references (Score:5, Informative)
Hate to reply to myself, but this http://blogs.technet.com/b/mmpc/archive/2011/02/08/breaking-up-the-romance-between-malware-and-autorun.aspx [technet.com] needs a read too. It plots the relationship between autorun and malware. Interesting how Microsoft still considers this a "non-security related update", as autorun has been an easy vector with which to poison your windows installation. Important to note that autorun will still work as expected on CD and DVD media, meaning Sony Rootkits are still going to be installed on your computer.
non-security updates don't always auto-update (Score:4, Informative)
Re:Sony will be annoyed (Score:4, Informative)
Re:Option? (Score:5, Informative)
The victim will have to do the equivalent of chmod +x on it first.
On the other hand if you create an appropriate disk image file and set the mimetype to application/x-apple-diskimage OSX will mount the disk automatically. And if you put the right things in that disk image (like a package), OSX will start the OSX "Installer" to install it.
Depending on the situation or what the user does it may even run some "preinstall" or "installation check" scripts you supply with that package.
Re:7 and Vista still vulnerable (Score:5, Informative)