Autofool

Do you use any Windows XP version?

You most probably are vulnerable to a very simple attack that may make your life miserable.

1) Have you heard of the "Sony Rootkit Scandal"?

2) Do you know what the "autorun" feature is?

3) Do you always do your normal work in windows in a restricted user account?

If your three answers are negative, you belong to the highest risk group of autorun infections. If it serves of any consolation, it seems that your high risk group is majoritary.

Last year, a very smart guy at "Sysinternals.com", Mark Russinovich, discovered that Sony basicly put a malicious trojan horse software in audio cds. That malicious software automatically ran if the victim put the audio CD in a computer drive to play it. If the user had administrative privileges, then the virus corrupted the operating system configuration and sent over the internet some private information about the system that we, the public, still don't know exactly what it was. All of this supposedly with the intention of restricting the number of CD copies the user could do in the computer. The rootkit also was designed in such a way that if the victim deleted the rootkit files, then the system would be rendered unusable. That is, using the excuse of preventing piracy Sony hijacked the computers of its customers.

The very successful spread of this attack tells us the following, besides that Microsoft Windows sucks and that Sony doesn't have any kind of ethics:

1. You can not rely on antivirus. A trojan horse as the Sony rootkit is trivial to detect by any antivirus. But they don't detect it:
   
   1. First, because if the design of windows security is brain-damaged, the "security" software design is brute force stupidity:
      
      1. The Sony Rootkit goes on to modify operating system drivers, and all kinds of delicate configurations, and on top of Windows itself not even noticing the user, the antivirus, that supposedly adds extra checks also keeps mum
      2. The SW that is doing the configuration changes is running off removable media, which should tag it as non-trustable
      3. The changes themselves are no simple "configuration change" but a "diservice pack", an antivirus should understand that this is not peanuts.
         
   2. Second, cry and weep, because Symantec itself, the maker of "Norton Antivirus" installs its own rootkit that hides files and messes with the system, supposedly to "protect" the users from their own folly [more details]. This mess can and has been exploited by viruses. Thus, this "security guard" company makes holes in your computer security but forgets to tell the guards to check them.
   3. Third, The existence of viruses is actually a subject in the highest interest of antivirus providers. The more paranoid and ignorant the users are, the greater profits they make. What I am saying is that the attitude of "security software providers" is to tell their users/customers: "Be as ignorant as you have always been; we will magically solve the problem for you, provided that you give us handsome money". As you may see in this article, that attitude only leads to user/consumers abused by triplicate: By Microsoft, that provides them an inherently faulty and insecure Operating System, and also puts pressure on the customers to use antivirus (see the "security notification" in XP SP2 that complaints that the computer doesn't has an antivirus); they are abused by the Antivirus providers that take money providing worthless, if not worse, software, which is not subject to any accountability of efficacy; and of course, by the hackers/crackers themselves.
   4. There are rumours that some Antivirus providers discovered the Sony rootkit, but after contacting Sony, they thought that it was Ok. This rumor, in other words, means that the antivirus companies do not simply protect your computers, but they may decide which companies' softwares are allowed to hijack them.
      
2. Demonstrates that far too many users run day to day tasks such as listening to music in accounts with far too excessive administrative priviledges
3. Demonstrates that the "autorun" feature is a grave security concern.

In Windows, there are no other ways, but to sometimes use an "Administrator" account to do otherwise mundane tasks. Some SW for Windows abusively requests the user to have administrative rights. Why? If it is for installation, most probably to install some form of a rootkit; that is, to hijack the computer. If it asks for administrative rights for day-to-day usage, then most probably the software does a task that the operating system does or should do, that reflects, either bad Windows design, that the application is not well designed to request from the Operating System the services it requires, or that the application doesn't want to use Operating System services, perhaps because the application has something to hide from the auditing tools of the O.S. services. Although this may be argued as "consensual"

In any case, my advise is to strongly prefer software that can be installed and run in very restricted accounts over software that requires too many privileges. If you like that software, then you may install it "System-Wide" using the administrative account. That kind of software exists, and tends to be Open Source. If it is Open Source, try to enjoy compiling it yourself. Then, you know that if some day you want a feature, in the worst case scenario you will very probably be able to hire someone to program it for you.

Second: TURN OFF THE AUTORUN. Right now, there are some guys developing the concept of malware that picks up the private information such as passwords and credit card numbers from a system with the autorun enabled in which a simple USB flash drive is inserted. If the user, on top of having the autorun enabled also has administrative priviledges, then the computer may get infected for good. Microsoft is so negligent about security, that XP doesn't provide any User Interface applet to completely disable the autorun, there is no reliable way other than doing it through the registry:

"NoDriveTypeAutoRun" registry key, I here reproduce the values for convenience:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Value	Meaning
0x1	Disables Autoplay on drives of unknown type.
0x4	Disables Autoplay on removable drives.
0x8	Disables Autoplay on fixed drives.
0x10	Disables Autoplay on network drives.
0x20	Disables Autoplay on CD-ROM drives.
0x40	Disables Autoplay on RAM drives.
0x80	Disables Autoplay on drives of unknown type.
0xFF	Disables Autoplay on all types of drives.

[note: This information is official documentation of Windows 2000, probably applies identically to XP]
Autorun
AutoRunAlwaysDisable
NoDriveAutoRun (in HKLM)
NoDriveAutoRun (in HKCU)
NoDriveTypeAutoRun (in HKLM)

If you are not an "administrator", you are still vulnerable, because the program may lift all the data that your user account is able to read, including *your* passwords or credit card numbers...

If you look on the internet about how to disable the many autorun features, you will come across many tools such as TweakUI that do this kind of system tweaks hiding the complexities of managing the registry. Well, if you think it is acceptable to use "TweakUI" or any of its equivalents without caring to research how it is done without any tool, then you haven't get the principal idea of this post: You can not become dependent on software that you don't know exactly how it works, what it does, what it doesn't; you can not remain ignorant about the security problems that Windows has. It is very similar to do your own Due Dilligence about the stockmarket to get interested in the security of your computer.

Windows Operating Systems must be approached by you with a lot of distrust for your own sake.

Let's say that you follow the advise of rather than relying on antivirus, antispam filters, antispyware, antiworms, popup blockers; you opt to research how the computers get infected, and how it is possible to prevent the infections: Then you not only get out of the vicious cycle of malware -> paranoia -> expense -> anti-malware -> false sense of security -> malware; then you start to really understand that most antimalware is complete bullshit; that Windows sucks so much that one really has to try to use alternatives such as Mac OS X, Linux, Solaris, or any other reasonable Operating System, that tools such as Virtualization are not geek ways to lose time, you learn how to really take control of nearly indomitable Windows Operating Systems; and above all you liberate yourself from lots of frustrations, making your computing experience more enjoyable and productive.