Microsoft aims 'non-security' update at gaping security hole

Disabling Autorun once and for all


Microsoft is delivering a Windows software update designed to quash once and for all the difficulty of disabling Autorun, a feature that allows the spread of malware through CDs, USB, and other removable media.

The update fixes an unspecified issue that prevents the NoDriveTypeAutoRun registry key from working as expected, Microsoft says. It comes a month after the US Computer Emergency Readiness Team called out Redmond for offering instructions on disabling Autorun that were "not fully effective."

Autorun's convenience has long been offset by the risk it poses. That's been a given since at least 2005 with the advent of the Sony rootkit fiasco, which in large part was enabled by the ability of music CDs to silently install anti-copying software on end users' machines.

In the wake of Conficker, a worm that's infected more than 10 million machines in the past three months, the stakes have never been higher. Among the vectors it uses to spread, Conficker (which also goes by the name Downadup) makes use of USB flash drives and mapped networked drives to propagate to new machines.

This week's update is the same fix that Microsoft made available here last May, so users who have already installed it (and then carried out the instructions that follow) should be safe.

Ironically, Microsoft describes the fix as a "non-security update," and it offers this explanation: "In this case, we are communicating the availability of an update that affects your ability to perform subsequent updates, including security updates. Therefore, this advisory does not address a specific security vulnerability; rather, it addresses your overall security."

We're not sure about that. What we do know is that if this update is the difference between Autorun being enabled or disabled, it will make users infinitely safer, and that can only be a good thing. ®

Broader topics

Narrower topics


Other stories you might like

  • US says Russian ran online marketplace of stolen logins
    Cyber-souk offered bundle deals of account access and credit card info, says Uncle Sam

    A Russian national was indicted in the US on Tuesday for allegedly running an online marketplace selling access to credit card, shopping, and web payment accounts belonging to tens of thousands of victims.

    Igor Dekhtyarchuk, 23, who is on the FBI's Cyber's Most Wanted list, is suspected to be the mastermind of an underground cyber-souk dubbed "Marketplace A" by the US Department of Justice. The site, launched in 2018 and known as a carding shop in the cyber-security industry, sold login details for people's internet banking and retail accounts so that fraudsters could, for instance, go on spending sprees on a stranger's dime.

    Marketplace A functioned like any other online store, and even had bundle deals, such as an offer to buy access to two online retail accounts and get some credit card information thrown in, for the same victim, it was claimed. The credentials were priced according to a victim's account balances; miscreants allegedly had to pay more for data associated with accounts with more money to steal from.

    Continue reading
  • CafePress fined for covering up 2019 customer info leak
    Watchdog demands $500,000 after millions of people's info stolen and sold

    The FTC wants the former owner of CafePress to cough up $500,000 after the customizable merch bazaar not only tried to cover up a major computer security breach involving millions of netizens, it failed to safeguard customers' personal information.

    In a complaint [PDF] filed against CafePress former owner Residual Pumpkin Entity and PlanetArt, which bought the platform in 2020, the FTC alleges multiple instances of shoddy security practices at the online biz. In a settlement proposed by the US watchdog, Residual Pumpkin will pay up the half-million dollars.

    The complaint highlighted that in February 2019 criminals stole, and then sold on the dark web, a treasure trove of personal information they found relatively easily on CafePress systems. This data included: more than 20 million unencrypted email addresses and encrypted passwords; millions of unencrypted names, physical addresses, and security questions and answers; more than 180,000 unencrypted Social Security numbers; and the last four digits of for tens of thousands of credit cards.

    Continue reading
  • Russia is the advanced persistent threat that just triggered. Ready?
    Data security looks very different when your life depends on it

    Opinion Stress-testing security is the only way to be sure it works. Until then, the worst security looks much the same as the best. As events in Ukraine show, leaving the stress-testing of assumptions until a threat is actually attacking is expensively useless.

    Yet if an untested solution is no solution at all, the problem becomes how you define an adequate test. In security, that means how far do your responsibilities go? 

    Continue reading
  • UK government opens consultation on medic-style register for Brit infosec pros
    Are you competent? Ethical? Welcome to UKCSC's new list

    Frustrated at lack of activity from the "standard setting" UK Cyber Security Council, the government wants to pass new laws making it into the statutory regulator of the UK infosec trade.

    Government plans, quietly announced in a consultation document issued last week, include a formal register of infosec practitioners – meaning security specialists could be struck off or barred from working if they don't meet "competence and ethical requirements."

    The proposed setup sounds very similar to the General Medical Council and its register of doctors allowed to practice medicine in the UK.

    Continue reading

Biting the hand that feeds IT © 1998–2022