full-disclosure - USB Auto run function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: keydet89 at yahoo.com (Harlan Carvey)
Subject: USB Auto run function

Oscar,

>   This issue has been discused in pentest list. Take
> a look at: 

I don't think the issue is that it's been discussed,
more that it hasn't been really resolved/addressed. 
Take a look at the post you linked to, specifically:

"I think turning off auto-run is a REALLY good idea."

According to MS documentation, autorun functionality
for USB-connected devices *is* off by default. 
However, the poster states pretty clearly that this
wasn't the case in his experience.  Also, the poster
(as well as others, such as the author of the 2600
article) aren't providing information such as the
value of the Registry key in question on systems
they've encountered...