6 ms·

Microsoft finally says adios to Autorun

65 points by taylorbuley 16y ago

misterbwong 16y ago
Let me be the first to say: FINALLY Autorun was an annoyance at best and a security hole at worst. I'm glad they've finally decided to do away with it. I do wonder why they didn't decide to do this across all media, though. FTA: As we've pointed out before, the changes to Autorun still don't go far enough. CDs and DVDs by default still automatically execute code when inserted. Adam Shostack, a program manager for Microsoft's Trustworthy Computing group, said here that Microsoft has yet to see in-the-wild attacks that exploit Autorun on “shiny media.”
- taylorbuley 16y ago
  I was thinking about editing the "finally" out of the headline per HN style but I figured it wasn't that much editorial spin to be glad this thing is moribund.
- pasbesoin 16y ago
  So, this is partially obviated, now, but FWIW: Article ID: 967715 - Last Review: September 9, 2010 - Revision: 6.2 How to disable the Autorun functionality in Windows http://support.microsoft.com/kb/967715 http://support.microsoft.com/kb/967715
- yuhong 16y ago
  Yep, there is a difference between Autorun on media that is instantly writable and those that has to be specifically burned.
BoppreH 16y ago
I still can't understand why they added the "feature" in first place. Sure, automatic execution of setups and the like is very convenient, but even a small "are you sure you want to run this" dialog would have closed the security hole most times.
- statictype 16y ago
  but even a small "are you sure you want to run this" dialog would have closed the security hole most times. I doubt this very much. People will just click through it each and every time.
- callahad 16y ago
  > I still can't understand why they added the "feature" in first place. I imagine, in the early 1990s, that the user experience seemed extremely natural. Put a tape into a VCR and it starts playing. Put a LaserDisc into a player and it starts playing. Put a cartridge into a game console and it starts playing. Put a CD into a stereo and it starts playing. Why shouldn't a CD you put in your computer start playing?
  - BoppreH 16y ago
    Because you don't store personal documents and credentials in your VCR or stereo. Traps for future data collection are also not possible, as far as I know.
    - jbri 16y ago
      Back when autorun was implemented, there wasn't any realistic way of getting those off a system even if you did compromise it through autorun.
      - jarek 16y ago
        To underscore this comment: the first release of Windows 95 shipped without an email client, a web browser, or a TCP/IP stack.
      - BoppreH 16y ago
        They can still be erased or tampered.
  - thought_alarm 16y ago
    Well, when you insert a tape into a VCR you still have to hit PLAY before it does anything. Not that there's anything wrong setting your computer to automatically play a CD. But it's not about audio, it's about software. Starting with Windows 3.0, Microsoft's approach to Windows OS usability involved hiding the file system from the user. Autorun is merely an extension of that philosophy. It allows Microsoft to hide a CD-ROM's ugly MS-DOS file system from the user. An alternate approach is to make the file system less ugly.
thought_alarm 16y ago
I didn't know Autorun was removed (sort of) in Windows 7. I guess that's one less thing some of us can brag about. It's hard to understand how Autorun survived Microsoft's big security push in the mid-2000s. I would have guessed it would be the first thing to go. But they can't remove Autorun without severely breaking backward compatibility; you can't suddenly force users to locate SETUP.EXE in a sea of weird setup files in order to install Office. That's why it's still enabled for CDs and DVDs. As a result, Microsoft and its users continue to pay a price for what turned out to be a really terrible design decision.
- deleted 16y ago
  [deleted]
- larsberg 16y ago
  The push only involved auditing use of APIs. High-level decisions were, generally, not re-thought. For a more concrete example, if you were hosting IE within a window of your process, you had to harden the heck out of anything that IE could host, how it accessed URLs and the hosting environment, etc. But, nobody was going to ask you WHY you were hosting IE in the first place.
amalcon 16y ago
I have always wondered who could have possibly thought Autorun was a good idea. Let's give complete control of the system to anyone who gives you a CD! Your neighbor's photo album can give you a virus now! Sony can install a ridiculous content protection system without your knowledge or consent!
- jarek 16y ago
  There's that saying about hindsight.
  - nandemo 16y ago
    It's such a huge flaw that there's no need for hindsight, really. A good tester should be able to point out the problem with autorun with no prompt.
    - jarek 16y ago
      Autorun was introduced in Windows 95. The security world, especially on consumer OSes, and especially again on Windows 9x, was very, very different back then. CIH wouldn't come around for another three years. CD-R burners were pretty expensive and pretty rare, cheap USB drives were a twinkle in someone's eye that wouldn't materialize for another five years at least. We don't know that the problem wasn't noticed; maybe it just wasn't considered to be crucial. Consider the magic-like benefits it would have been weighed against: all you have to do is put the CD in! Edit: the USB specification and first USB consumer products weren't released until 1996. Further food for thought.
      - nandemo 16y ago
        Well, I don't really understand how that contradicts what I'm saying. I still think a decent tester should have been able to point out the problem back then and mark it as "critical". For me it's so uncontroversial it could even be an interview question. Viruses and trojans already existed back in 1995, and I don't think anyone would claim then that CD-R burners would remain expensive for long.
nyellin 16y ago
Even though it will be more difficult for worms to spread over USB, this does NOT mean USB keys are no longer an attack vector. For attacks targeted at specific computers, you can bypass the new restrictions with Teensy and similar devices. http://www.offensive-security.com/metasploit-unleashed/SET_Teensy_USB_HID_Attack http://www.offensive-security.com/metasploit-unleashed/SET_T...
- nyellin 16y ago
  Furthermore, in my opinion, leaving autorun enabled for CD/DVDs was the right decision. Most people don't use CDs for transferring files anymore. Viruses wont be able to get much traction by spreading over CD/DVDs, because barely anyone inserts writable disks.
iwwr 16y ago
"Over the past few years technologies such as in the U3 functionality found on many thumb drives has provided alternatives." In my experience, U3 is nothing but crippleware. It should be killed with fire.
bni 16y ago
Great! Lets hope they remove the "functionality" that blindly executes all files ending in .exe next.
kenjackson 16y ago
There are two core reasons why autorun wasn't viewed as a huge security threat: 1) As one other person already pointed out, there was no real vector in which to steal info from the client computer. There was no default email client, web browser, or even TCP/IP stack. Computers were silos where data was moved via floppy. 2) There was a reasonably fair assumption that if you put in a CD you were going to run the application installed on the app. If it had opened up in file explorer and there were files "setup.exe" or "readme.exe" or "runme.exe" -- 99% of the time those files will get run anyways. To put it another way... using the most secure web browser on the planet today is probably a bigger known security risk in 2011 than autorun was in 1995. With that said, the benefit of a web browser is a fair bit larger than autorun.

65 points by taylorbuley 16y ago

Let me be the first to say: FINALLY Autorun was an annoyance at best and a security hole at worst. I'm glad they've finally decided to do away with it. I do wonder why they didn't decide to do this across all media, though. FTA: As we've pointed out before, the changes to Autorun still don't go far enough. CDs and DVDs by default still automatically execute code when inserted. Adam Shostack, a program manager for Microsoft's Trustworthy Computing group, said here that Microsoft has yet to see in-the-wild attacks that exploit Autorun on “shiny media.”

taylorbuley 16y ago
I was thinking about editing the "finally" out of the headline per HN style but I figured it wasn't that much editorial spin to be glad this thing is moribund.
pasbesoin 16y ago
So, this is partially obviated, now, but FWIW: Article ID: 967715 - Last Review: September 9, 2010 - Revision: 6.2 How to disable the Autorun functionality in Windows http://support.microsoft.com/kb/967715 http://support.microsoft.com/kb/967715
yuhong 16y ago
Yep, there is a difference between Autorun on media that is instantly writable and those that has to be specifically burned.

BoppreH 16y ago

I still can't understand why they added the "feature" in first place. Sure, automatic execution of setups and the like is very convenient, but even a small "are you sure you want to run this" dialog would have closed the security hole most times.

statictype 16y ago
but even a small "are you sure you want to run this" dialog would have closed the security hole most times. I doubt this very much. People will just click through it each and every time.
callahad 16y ago
> I still can't understand why they added the "feature" in first place. I imagine, in the early 1990s, that the user experience seemed extremely natural. Put a tape into a VCR and it starts playing. Put a LaserDisc into a player and it starts playing. Put a cartridge into a game console and it starts playing. Put a CD into a stereo and it starts playing. Why shouldn't a CD you put in your computer start playing?
- BoppreH 16y ago
  Because you don't store personal documents and credentials in your VCR or stereo. Traps for future data collection are also not possible, as far as I know.
  - jbri 16y ago
    Back when autorun was implemented, there wasn't any realistic way of getting those off a system even if you did compromise it through autorun.
    - jarek 16y ago
      To underscore this comment: the first release of Windows 95 shipped without an email client, a web browser, or a TCP/IP stack.
    - BoppreH 16y ago
      They can still be erased or tampered.
- thought_alarm 16y ago
  Well, when you insert a tape into a VCR you still have to hit PLAY before it does anything. Not that there's anything wrong setting your computer to automatically play a CD. But it's not about audio, it's about software. Starting with Windows 3.0, Microsoft's approach to Windows OS usability involved hiding the file system from the user. Autorun is merely an extension of that philosophy. It allows Microsoft to hide a CD-ROM's ugly MS-DOS file system from the user. An alternate approach is to make the file system less ugly.

thought_alarm 16y ago

I didn't know Autorun was removed (sort of) in Windows 7. I guess that's one less thing some of us can brag about. It's hard to understand how Autorun survived Microsoft's big security push in the mid-2000s. I would have guessed it would be the first thing to go. But they can't remove Autorun without severely breaking backward compatibility; you can't suddenly force users to locate SETUP.EXE in a sea of weird setup files in order to install Office. That's why it's still enabled for CDs and DVDs. As a result, Microsoft and its users continue to pay a price for what turned out to be a really terrible design decision.

deleted 16y ago
[deleted]
larsberg 16y ago
The push only involved auditing use of APIs. High-level decisions were, generally, not re-thought. For a more concrete example, if you were hosting IE within a window of your process, you had to harden the heck out of anything that IE could host, how it accessed URLs and the hosting environment, etc. But, nobody was going to ask you WHY you were hosting IE in the first place.

amalcon 16y ago

I have always wondered who could have possibly thought Autorun was a good idea. Let's give complete control of the system to anyone who gives you a CD! Your neighbor's photo album can give you a virus now! Sony can install a ridiculous content protection system without your knowledge or consent!

jarek 16y ago
There's that saying about hindsight.
- nandemo 16y ago
  It's such a huge flaw that there's no need for hindsight, really. A good tester should be able to point out the problem with autorun with no prompt.
  - jarek 16y ago
    Autorun was introduced in Windows 95. The security world, especially on consumer OSes, and especially again on Windows 9x, was very, very different back then. CIH wouldn't come around for another three years. CD-R burners were pretty expensive and pretty rare, cheap USB drives were a twinkle in someone's eye that wouldn't materialize for another five years at least. We don't know that the problem wasn't noticed; maybe it just wasn't considered to be crucial. Consider the magic-like benefits it would have been weighed against: all you have to do is put the CD in! Edit: the USB specification and first USB consumer products weren't released until 1996. Further food for thought.
    - nandemo 16y ago
      Well, I don't really understand how that contradicts what I'm saying. I still think a decent tester should have been able to point out the problem back then and mark it as "critical". For me it's so uncontroversial it could even be an interview question. Viruses and trojans already existed back in 1995, and I don't think anyone would claim then that CD-R burners would remain expensive for long.

nyellin 16y ago

Even though it will be more difficult for worms to spread over USB, this does NOT mean USB keys are no longer an attack vector. For attacks targeted at specific computers, you can bypass the new restrictions with Teensy and similar devices. http://www.offensive-security.com/metasploit-unleashed/SET_Teensy_USB_HID_Attack http://www.offensive-security.com/metasploit-unleashed/SET_T...

nyellin 16y ago
Furthermore, in my opinion, leaving autorun enabled for CD/DVDs was the right decision. Most people don't use CDs for transferring files anymore. Viruses wont be able to get much traction by spreading over CD/DVDs, because barely anyone inserts writable disks.

iwwr 16y ago

"Over the past few years technologies such as in the U3 functionality found on many thumb drives has provided alternatives." In my experience, U3 is nothing but crippleware. It should be killed with fire.

bni 16y ago

Great! Lets hope they remove the "functionality" that blindly executes all files ending in .exe next.

kenjackson 16y ago

There are two core reasons why autorun wasn't viewed as a huge security threat: 1) As one other person already pointed out, there was no real vector in which to steal info from the client computer. There was no default email client, web browser, or even TCP/IP stack. Computers were silos where data was moved via floppy. 2) There was a reasonably fair assumption that if you put in a CD you were going to run the application installed on the app. If it had opened up in file explorer and there were files "setup.exe" or "readme.exe" or "runme.exe" -- 99% of the time those files will get run anyways. To put it another way... using the most secure web browser on the planet today is probably a bigger known security risk in 2011 than autorun was in 1995. With that said, the benefit of a web browser is a fair bit larger than autorun.