NatCh
05-08-2007, 11:03 AM
SillyFD-AA Worm Moves By Flash Drive
The more things change the more they stay the same. In a bout of rampant nostalgia, some worm writer (apparently going by the handle of "1BYTE") has gone old school, mimicking the methods used to spread viruses via floppy disks, only now it's USB flash drives.
The approach is simple enough, the worm consists of a simple autorun.inf file, on the drive. When the drive is connected, the file -- you guessed it -- autoruns, installing the worm on the computer. It seems this one doesn't actually do much, aside from propagating itself to other USB drives, the only reported effect is to add a message to the Internet Explorer title bar that reads "Hacked by 1BYTE." Reportedly, most anti-virus software will keep it from doing even that much. However, there's not really anything that stops the approach from being exploited by those who mean actual harm, rather than just a bit of annoyance.
Since a USB drive has no write-protect notch to cover with tape, the recommendation is to turn off Windows' autorun feature -- for those who have not long since done so.
For a few more details, along with a discussion of how bad people's "USB hygiene habits" are, see the full article (http://weblog.infoworld.com/zeroday/archives/2007/05/usb_worm_gets_i.html).
The more things change the more they stay the same. In a bout of rampant nostalgia, some worm writer (apparently going by the handle of "1BYTE") has gone old school, mimicking the methods used to spread viruses via floppy disks, only now it's USB flash drives.
The approach is simple enough, the worm consists of a simple autorun.inf file, on the drive. When the drive is connected, the file -- you guessed it -- autoruns, installing the worm on the computer. It seems this one doesn't actually do much, aside from propagating itself to other USB drives, the only reported effect is to add a message to the Internet Explorer title bar that reads "Hacked by 1BYTE." Reportedly, most anti-virus software will keep it from doing even that much. However, there's not really anything that stops the approach from being exploited by those who mean actual harm, rather than just a bit of annoyance.
Since a USB drive has no write-protect notch to cover with tape, the recommendation is to turn off Windows' autorun feature -- for those who have not long since done so.
For a few more details, along with a discussion of how bad people's "USB hygiene habits" are, see the full article (http://weblog.infoworld.com/zeroday/archives/2007/05/usb_worm_gets_i.html).