Honeynet looks to trap USB malware The Honeynet project has picked up research by a German student to trap malware designed to spread via USB keys. USB-distributed malware – like Stuxnet and its bloated cousin, Flame – presents problems for network-based security, since they don’t spread through the network. The Bonn University student, Sebastian Peoplau, has …
In my understanding, the "autorun" from USB can be disabled, yes.
However, Windows system-level messages - such as the notification that a removable device has been plugged in - are not the same thing. A message such as this is what the malware uses to decide that a USB key is present, and therefore available to be infected.
The point is to have on board all available security measures *before* the original infection can be transmitted; this involves disabling autorun on installation and also installing security software and other security procedures before the system has any contact with anything bar MS update and updates for appropriate security software. The admin has to institute a number of blindingly obvious security procedures, password protect admin use, disable booting from CDs/DVDs (I can sniff a password easily that way) and so on. Doing these things from the start will prevent the fecker from installing and thus ever detecting the presence of a USB device, autorun or not.
I set/keep auto-run off on all my boxes, and zero-out and re-format every new flash device and new floppy diskette (not too many of those, these days) before first use.
Both accidental, and purposeful, malware contamination of manufacturer-supplied media has happened before.
The first routine in new malware will be to detect that piece of software, and to stop infecting that, probably easily detectable, USB device.
But it won't become popular as it'll interfere with thousands of badly written auto-backup features which just wait for an USB-stick to be plugged into the PC and then back up data.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
