NEWS FROM THE LAB - Friday, June 4, 2010

Windows 7 AutoPlay and Virtual CDs Posted by Sean @ 13:12 GMT

Some folks read Wednesday's post about autorun-worm infected Samsung Wave microSD cards and commented — thank goodness Windows 7 fixes that issue. Only optical media is allowed to AutoPlay on Windows 7, so USB devices can't spread autorun-worms.


Well, while Windows 7 does significantly improve the AutoPlay/AutoRun user experience, it isn't bulletproof. There's a small, not likely to be exploited, loophole.

Virtual CDs.

For example, Western Digital USB hard drives ship with Virtual CDs on board to install WD's SmartWare software.

You can see the CD device here along with the Passport:

Windows 7, Virtual CD

This is how a default Windows XP installation handles the Virtual CD's autorun.inf:

Welcome to WD SmartWare

It just launches the installer program, no questions asked.

Now this is how Windows 7 AutoPlay handles the Virtual CD's autorun.inf:

Windows 7 AutoPlay

The installer on the Virtual CD is the default option, but it doesn't launch.

On the plus side, AutoPlay functionality can easily be turned off in Windows 7:

Windows 7 Control Panel, AutoPlay

Do note that this isn't a Windows 7 vulnerability.

From Microsoft's Security Research & Defense blog: "It is worth noting that some smart USB flash drives can pose as a CD/DVD drive instead of standard ones (see http://en.wikipedia.org/wiki/U3 for an example). In this specific scenario, the operating system will treat the USB drive as if it is a CD/DVD because the type of the device is determined at the hardware level."

This is just a curiosity to be aware of — not a flaw.

Bottom-line, don't let Windows 7's improved handling of AutoPlay give you a false sense of security. There are more and more USB drives shipping with Virtual CDs, and sooner or later, one of them will be infected during the manufacturing process.