McDonalds serves up a McVirus in Japan

[Quik]

I'm almost certain that there are ways to make a drive auto-execute something. Give me a day or two to test my theory, and I'll get back to you.

[MyndFyre]

If its file system agnostic then why does the USB drive have to be FAT formatted?

It doesn't *have* to be FAT-formatted.  However, USB drives are typically FAT-formatted because of the quick-eject nature of the drive.  You can only format them to NTFS if you tell the system to require you to use the "Eject" feature of the "Safely Remove Hardware" icon (since NTFS is journaling, removing while there are still cached actions to be done can leave the file system in an inconsistent state).

I was merely mentioning FAT for illustrative purposes.  I demonstrated that this was the behavior using NFS (Network File System) as well.

[Newby]

x86] link=topic=7605.msg95118#msg95118 date=1161140776]
It doesn't *have* to be FAT-formatted.  However, USB drives are typically FAT-formatted because of the quick-eject nature of the drive.  You can only format them to NTFS if you tell the system to require you to use the "Eject" feature of the "Safely Remove Hardware" icon (since NTFS is journaling, removing while there are still cached actions to be done can leave the file system in an inconsistent state).

I ejected it once without ejecting (FAT32) and I lost data. :/

[iago]

x86] link=topic=7605.msg95104#msg95104 date=1161136540]

According to the guys on that security list (that I referenced), it will iff it's formatted as a CDFS.  At least, that's how I understand it. 

The guys on the security list, or your understanding, are wrong.  As I demo'd, any time a drive letter is mounted, Explorer will check to see if it's auto-runnable.  It is filesystem-agnostic.

Well, I was going off what unTactical said.  Perhaps everything CAN run a program when you plug it in, which would probably be even worse.

Maybe it's possible that there's some half-thought-out security measure that prevents non-CDFS from auto-executing a program? 

[Chavo]

x86] link=topic=7605.msg95118#msg95118 date=1161140776]

If its file system agnostic then why does the USB drive have to be FAT formatted?

It doesn't *have* to be FAT-formatted.  However, USB drives are typically FAT-formatted because of the quick-eject nature of the drive.  You can only format them to NTFS if you tell the system to require you to use the "Eject" feature of the "Safely Remove Hardware" icon (since NTFS is journaling, removing while there are still cached actions to be done can leave the file system in an inconsistent state).

I was merely mentioning FAT for illustrative purposes.  I demonstrated that this was the behavior using NFS (Network File System) as well.

The two parts of my reply went hand in hand, you can't answer half of it and ignore the rest! :)  Especially when your answer to that question contradicts the statement in the latter part of my post!

As this screenshot shows, autorun.inf is clearly modifying the label for my usb drive just fine, but it is definately not autorun-ing the specified executable or changing the default action of the drive.  I don't doubt you are right, but obviously its not working here :)

[Warrior]

http://blogs.msdn.com/windowsvistasecurity/archive/2006/10/03/USB-Blocking-in-Release-Candidate-1.aspx
Bitlocker ftw