Free Republic
Browse · Search
Bloggers & Personal
Topics · Post Article

Skip to comments.

Changes in Windows to Meet Changes in Threat Landscape (disable autorun, duh)
Microsoft ^ | Tuesday, April 28, 2009 9:37 AM | MSRCTEAM

Posted on 04/29/2009 6:16:20 AM PDT by palmer

Changes in Windows to Meet Changes in Threat Landscape

Customers have heard us say over the years that the threat environment is an ever-evolving one. That means that one of our jobs in working to keep customers safe is to continually monitor the threat environment and make changes to adapt to it.

Today, we're announcing modifications in Windows that adapts to recent changes in the threat environment. Specifically, wee announcing changes to the behavior in AutoPlay so that it will no longer enable an AutoRun task for devices that are not removable optical media (CD/DVD.). However, the AutoRun task will still be enabled for media like CD-ROM. There are more details on the change over at the Windows 7 blog as well as at the Security Research and Defense (SRD) blog.

The reason we're making this change is that we've seen an increase, since the start of 2009, in malicious software abusing the current default AutoRun settings to propagate through removable media like USB devices. The best known malicious software abusing AutoRun is Conficker, but it's not alone in that regard: there is other malicious software that abuses this feature. You can get more details on this change and others in the threat environment from the Microsoft Malware Protection Center's blog.

Because we've seen such a marked increase in malicious software abusing AutoRun to propagate, we've decided that it makes sense to adjust the balance between security and usability around removable media. We've tried to be very measured in this adjustment to maximize both customer convenience and protection. Since non-writable media such as CD-ROMs generally aren't avenues for malicious software propagation (because they're not writable) we felt it made sense to keep the current behavior around AutoPlay for these devices and make this change only for generic mass storage class devices.

This change will be present in the Release Candidate build of Windows 7. In addition, we are planning to release an update in the future for Windows Vista and Windows XP that will implement this new behavior.


TOPICS: Business/Economy
KEYWORDS: autoplay; autorun; ms
Only took them 10 years to figure this out.
1 posted on 04/29/2009 6:16:20 AM PDT by palmer
[ Post Reply | Private Reply | View Replies]

To: palmer
This is ridiculous. The Windows operating system is vital to business in America. It is beyond time for the federal government to do what is necessary to direct a Microsoft Corporation that will allow for full integration and security among every application and across platforms. The federal government needs to take control of this company so private interests don't continue to supplant America's best interests.

Mr. President, take control of Microsoft Corporation so real change and improvement can be encouraged.

;-)

2 posted on 04/29/2009 6:23:21 AM PDT by Sgt_Schultze (Si vis pacem, para bellum)
[ Post Reply | Private Reply | To 1 | View Replies]

To: palmer
there is other malicious software that abuses this feature

The grammar of that little assertion just makes me cringe.

Yikes!

3 posted on 04/29/2009 6:26:11 AM PDT by KayEyeDoubleDee
[ Post Reply | Private Reply | To 1 | View Replies]

To: palmer
Since non-writable media such as CD-ROMs generally aren't avenues for malicious software propagation (because they're not writable) we felt it made sense to keep the current behavior around AutoPlay for these devices and make this change only for generic mass storage class devices.

Bzzzzzt! Wrong answer, thanks for playing anyway.

From the rootkit fiasco on Sony music CDs I consider all media suspect and do not allow any autoplay. The "trouble" of hitting play on a CD I want to listen to (as opposed to just ripping) isn't worth the risk of it trying to install something.

Sometimes I want to put in a software disk and look at the documentation on it or try to find a driver. I don't want it starting the setup program to start installing something.

4 posted on 04/29/2009 6:28:44 AM PDT by KarlInOhio (No free man bows to a foreign king.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Sgt_Schultze

We don’t need the likes of Nancy Pelosi or Arlen Specter, or WORSE, dictating software development.


5 posted on 04/29/2009 6:29:27 AM PDT by 2harddrive (...House a TOTAL Loss.....)
[ Post Reply | Private Reply | To 2 | View Replies]

To: Sgt_Schultze

That will only happen after TOTUS gives a speech something like this: “some people would want us to just sit back and play music? Or watch videos. But we cannot afford to take no action. We must always do the selected action.”


6 posted on 04/29/2009 6:29:28 AM PDT by palmer (Cooperating with Obama = helping him extend the depression and implement socialism.)
[ Post Reply | Private Reply | To 2 | View Replies]

To: palmer

I’ve always found autorun to be more annoying than anything else.


7 posted on 04/29/2009 6:31:49 AM PDT by Psycho_Bunny (ALSO SPRACH ZEROTHUSTRA)
[ Post Reply | Private Reply | To 1 | View Replies]

To: KarlInOhio

Absolutely right. I routinely nuke all autoplay and autorun keys in the registry after winstalling windows. That breaks a few odds and ends, but saves me lots of grief in the long run.


8 posted on 04/29/2009 6:32:22 AM PDT by palmer (Cooperating with Obama = helping him extend the depression and implement socialism.)
[ Post Reply | Private Reply | To 4 | View Replies]

To: palmer

Autorun is a PIA, can’t stand it. This feature was probably designed for people like my Harvard garduated Ex-Boss who after using a computer for almost 3 decades still cannot figure out how to copy a file from his hard drive, floppy disk, or CD-rom. Hard to believe he was President of our company, than again he fits the description of most windows users. Good thing he is a libtard and doesn’t read FR.


9 posted on 04/29/2009 6:45:25 AM PDT by quesera (The age of darkness is upon us.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: palmer
...wee announcing...

Wee are?

Surf the net on Linux. Plenty of vulnerabilities, no exploits.

10 posted on 04/29/2009 7:15:45 AM PDT by OpeEdMunkey (We seem to have reached a critical mass of stupid people.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: KayEyeDoubleDee
The grammar of that little assertion just makes me cringe.

...which abuses?

...other malicious software that abuses?

Inquiring minds want to know.

11 posted on 04/29/2009 7:19:27 AM PDT by OpeEdMunkey (We seem to have reached a critical mass of stupid people.)
[ Post Reply | Private Reply | To 3 | View Replies]

To: quesera
This feature was probably designed for people like my Harvard graduated Ex-Boss . . .

I believe he appeared in a Dilbert cartoon:


12 posted on 04/29/2009 9:31:52 AM PDT by Oatka ("A society of sheep must in time beget a government of wolves." –Bertrand de Jouvenel)
[ Post Reply | Private Reply | To 9 | View Replies]

To: palmer

For a non techie idiot like me, how do I fix it?


13 posted on 04/29/2009 3:37:15 PM PDT by manic4organic (We Are S0 Screwed)
[ Post Reply | Private Reply | To 1 | View Replies]

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
Bloggers & Personal
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson