Re: USB delivered attacks - lessons learned/summary (so far)

[H Carvey <keydet89 () yahoo com>]

In-Reply-To: <016501c44847$e686ac40$6701010a@JASEVO>


> USB devices don't use autorun - 

More specifically, parsing and execution of the autorun.inf file at the root of the device is not enabled for 
removeable drive types.

XP - http://support.microsoft.com/default.aspx?scid=kb;en-us;314855
2K - http://support.microsoft.com/default.aspx?scid=kb;EN-US;173584

This KB article describes the Registry key in question:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;136214

Hope that helps...

> Somebody said that 2600 had something about this type of thing in the
> current 2600 magazine.  That would suggest that a few other people have
> been playing with this idea.  Somebody with more brains, ideas or time
> than I is likely to come up with something pretty nasty.

I think "playing" is the key term.  I don't have a USB hard drive to test with, but using a thumb drive shows that 
taking advantage of the autorun functionality on such devices is a loosing proposition in situations where the target 
Registry key has NOT been modified.