bugtraq - Re: USB risks (continued)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <001301c4567b$1ea0b030$6401a8c0@mainguy>
Date: Sun, 20 Jun 2004 00:00:24 -0400
From: "Kevin Davis" <computerguy@....rr.com>
To: <full-disclosure@...ts.netsys.com>, <bugtraq@...urityfocus.com>
Subject: Re: USB risks (continued)


Many USB keys have hardware switches to make them read only.  With Windows
2000 or Windows XP, no special drivers are required to read USB keys.

Autorun works on removable USB CD drives.

----- Original Message ----- 
From: "RSnake" <rsnake@...cking.com>
To: "Gadi Evron" <ge@...tistical.reprehensible.net>
Cc: "Harlan Carvey" <keydet89@...oo.com>;
<full-disclosure@...ts.netsys.com>; <bugtraq@...urityfocus.com>
Sent: Friday, June 18, 2004 7:54 PM
Subject: Re: USB risks (continued)


>
> Autorun doesn't work with USB keyfobs.  Actually, it is my
> understanding that it doesn't work on any media that is deemed writable
and
> removable.  The distinction between USB devices and CDs is that the media
is
> writeable, but the drives aren't removeable on CDs.  That of course isn't
true
> if you have a USB drive, but I think part of the deal there is that you
need to
> install special drivers to even read USB CD drives.  That's kinda a weird
> distinction, but I researched it quite a bit earlier this year and that's
just
> how they define it.  With the advent of bootable USB devices, and more USB
> support, you can pretty much bet things will change, but for right now,
autorun
> isn't an issue.
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html