Re: USB delivered attacks - lessons learned/summary (so far)

From: H Carvey (keydet89@yahoo.com)
Date: Tue Jun 08 2004 - 16:31:08 EDT


('binary' encoding is not supported, stored as-is) In-Reply-To: <016501c44847$e686ac40$6701010a@JASEVO>


>USB devices don't use autorun -

More specifically, parsing and execution of the autorun.inf file at the root of the device is not enabled for removeable drive types.

XP - http://support.microsoft.com/default.aspx?scid=kb;en-us;314855
2K - http://support.microsoft.com/default.aspx?scid=kb;EN-US;173584

This KB article describes the Registry key in question:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;136214

Hope that helps...

>Somebody said that 2600 had something about this type of thing in the
>current 2600 magazine. That would suggest that a few other people have
>been playing with this idea. Somebody with more brains, ideas or time
>than I is likely to come up with something pretty nasty.

I think "playing" is the key term. I don't have a USB hard drive to test with, but using a thumb drive shows that taking advantage of the autorun functionality on such devices is a loosing proposition in situations where the target Registry key has NOT been modified.



This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:55 EDT