US-CERT: Microsoft's advice on Downadup is flawed

Microsoft's advice on disabling Windows' "Autorun" feature is flawed, the U.S. Computer Emergency Readiness Team (US-CERT) said Wednesday, and leaves users who rely on its guidelines to protect their PCs against the fast-spreading Downadup worm open to attack.

In an alert issued Monday , US-CERT said Microsoft's instructions on turning off Autorun are "not fully effective" and "could be considered a vulnerability."

The flaw in Microsoft's guidelines are important at the moment, because the "Downadup" worm, which has compromised more computers than any other attack in years, can spread through USB devices, such as flash drives and cameras, by taking advantage of Windows' "Autorun" and "Autoplay" features.

Autorun, the focus of the US-CERT warning, lets Windows automatically run any program specified in the "autorun.inf" on, for example, a CD or a flash drive, as soon as the disc or device is inserted or connected. By default, Windows has Autorun enabled.

The problem is that Downadup, which as of last week had infected nearly 9 million PCs worldwide, tries to spread using USB-based devices, typically flash drives. The worm creates an autorun.inf file at the root directory of any USB-based device it finds connected to the infected machine, then when that device is later connected to an uninfected computer, the autorun.inf file copies the worm to the machine without any action on the part of the user, or the user even knowing.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine