Talk:Autorun

From Free Knowledge Base- The DUCK Project: information for everyone
Jump to: navigation, search

CERT Advisory VU#889747 Microsoft Windows fails to properly handle the NoDriveTypeAutoRun registry value

Overview

Microsoft Windows fails to properly handle the NoDriveTypeAutoRun registry value, which may prevent Windows from effectively disabling AutoRun and AutoPlay features. Description

AutoRun, which was introduced with Windows 95, is a feature that causes Windows to automatically take an action when a removable media device is inserted. For example, when an AutoRun-enabled CD-ROM is inserted, Windows may automatically execute a program on that disc. This also holds true for U3-enabled USB devices, which emulate a CD-ROM device as well as provide USB mass storage capabilities. These devices can automatically execute code when they are inserted into a Windows system. The AutoRun action can also take place when the user clicks the icon for an AutoRun-enabled device. AutoRun is enabled by default in Windows. AutoPlay, which was introduced with Windows XP, extends AutoRun capabilities to also allow a menu to be presented to the user, which lists actions that the user may take. AutoRun and AutoPlay can be disabled by setting the CDRom Autorun registry value to 0 and also setting the NoDriveTypeAutoRun registry value to 0xFF. The NoDriveTypeAutoRun registry value is directly tied to the Group Policy setting for "Turn off Autoplay."

Microsoft Windows fails to properly handle the NoDriveTypeAutoRun registry value. According to Microsoft's documentation, setting NoDriveTypeAutoRun to 0xFF should disable AutoPlay for all types of drives. However, when this registry value is present, Vista enables some AutoPlay features that may not have been enabled prior to setting that registry value. For example, if NoDriveTypeAutoRun is set to 0xFF, Vista may execute a program specified in the Autorun.inf file when the device icon is clicked. Other values for NoDriveTypeAutoRun may also enable certain AutoPlay features in Vista. For Windows versions older than Vista, the NoDriveTypeAutoRun registry value is simply ignored with respect to certain AutoRun features. In other words, setting the value will not put the system at additional risk, but will not disable AutoRun completely. Impact

Microsoft Windows may have some AutoPlay enabled, even though the Group Policy Editor and associated registry values indicate otherwise. This may allow an attacker to cause a user to inadvertently execute arbitrary code on a removable device, such as a USB drive.

Certain versions of malicious code called Conficker or Downadup use the AutoRun feature to propagate. Solution

Apply an update This issue is addressed for Windows Vista and Server 2008 systems in Microsoft Security Bulletin MS08-038. This update corrects the behavior of NoDriveTypeAutoRun on those platforms. Windows 2000, XP, and Server 2003 users should install the update in Microsoft Support Document KB967715. Please also consider the following workarounds.


Disable AutoRun With limited testing, it appears to be possible to disable AutoRun and AutoPlay on Microsoft Windows systems by saving the following text as a .REG file and importing it into the registry: 

   REGEDIT4
   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
   @="@SYS:DoesNotExist"

This registry value appears to prevent windows from parsing and taking actions based on the Autorun.inf file, which both AutoRun and AutoPlay utilize. Note that Windows can cache AutoRun capabilities of devices via the MountPoints2 registry key, though. So even after disabling AutoRun as described above, Windows may still automatically execute files on devices that Windows has listed in this cache. For this reason, we also recommend removing this cache by deleting the MountPoints2 registry key for each user: 

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Below are the original workaround settings that we had published. However, disabling the MCN message may prevent Windows from properly detecting when a CD-ROM is changed. Therefore, the above workaround may be more appropriate.

  • Set the Autorun registry value for CDs to 0. This will prevent Windows from sending a Media Change Notification (MCN) message when a CD-ROM is inserted, which will in turn prevent AutoPlay with these devices.
  • Disable AutoPlay for all media and devices, by clearing the Use AutoPlay for all media and devices setting in the Windows Control Panel. Details for how to do this are available in the Windows Help and How-to.
  • Do not set the NoDriveTypeAutoRun registry values in HKLM or HKCU. If they are present, we recommend removing the values. This can be also be accomplished by using the Group Policy Editor to set the "Turn off Autoplay" option to "Not Configured."
  • Set the "Default behavior for Autorun" to Enabled - "Do not execute any autorun commands" in the Group Policy Editor.

The relevant settings in the Group Policy editor can be reached by running gpedit.msc and going to Local Computer Policy -> Computer Configuration -> Administrative Templates -> Windows Components -> AutoPlay Policies.

Systems Affected (Learn More) Vendor Status Date Notified Date Updated Microsoft Corporation Affected 19 Feb 2008 27 Feb 2008

SOURCE: https://www.kb.cert.org/vuls/id/889747

Advanced Autorun / Autoplay settings ADM file

it turns out that the 'NoDriveTypeAutorun' value that Group Policy changes is a little more flexible than the Group Policy Editor might initially suggest

create a new ADM file for Group Policy which would allow disable Autorun on *just* removable drives, or any other reasonable combination of drive types

There is a small amount of misinformation around on the Internet regarding the NoDriveTypeAutorun setting, so make sure you check the Microsoft website for the 'real deal'. The most useful article I found was here, which describes the numbering system behind the registry key, and also the default values for all the recent Microsoft OSes. It also advocates installing an extra hotfix, 950582 in order to get it the NoDriveTypeAutorun key to to work properly

The default settings for NoDriveTypeAutorun are different between Windows 2000/2003 and Windows XP/Vista. Windows 2000/2003 (and I think prior versions as well) use a default value of 0x95, which disables unknown, network and removable drives by default, and Windows XP/Vista use a default value of 0x91, which just disables unknown and network drives (but NOT removable). This ADM file sets the XP/Vista setting by default, but if you want to set it to the 2000/2003 default use the 'Removable Drives' option.

The ADM file. Save it as 'AdvancedAutorun.adm', and then importing into the Group Policy Editor as usual (right click Administrative Templates, Add/Remove Templates). The new settings will appear under a new folder called 'Advanced Autorun Settings' in the normal place. 

 ; Advanced Autorun settings (AdvancedAutorun.adm)
 ; See http://support.microsoft.com/kb/953252 for details
 
 CLASS MACHINE
 
 CATEGORY !!AdvancedAutorun
 	POLICY !!AutorunAdvanced
 		KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
 
 		PART !!Autorun_Box          DROPDOWNLIST REQUIRED
 			VALUENAME "NoDriveTypeAutorun"
 			ITEMLIST
 				NAME !!Autorun_Default		VALUE NUMERIC 145 ; 0x91
 				NAME !!Autorun_NoRemovable	VALUE NUMERIC 149 ; 0x95
 				NAME !!Autorun_NoFixed		VALUE NUMERIC 153 ; 0x99
 				NAME !!Autorun_NoRemovableFixed	VALUE NUMERIC 157 ; 0x9D
 				NAME !!Autorun_NoCD		VALUE NUMERIC 177 ; 0xB1
 				NAME !!Autorun_NoRemovableCD 	VALUE NUMERIC 181 ; 0xB5
 				NAME !!Autorun_NoFixedCD	VALUE NUMERIC 185 ; 0xB9
 				NAME !!Autorun_None		VALUE NUMERIC 255 DEFAULT ; 0xFF
 			END ITEMLIST
 		END PART
 		PART !!Autorun_Text1	TEXT
 		END PART
 		PART !!Autorun_Text2	TEXT
 		END PART
 	END POLICY
 END CATEGORY
 
 CLASS USER
 
 CATEGORY !!AdvancedAutorun
 	POLICY !!AutorunAdvanced
 		KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
 
 		PART !!Autorun_Box          DROPDOWNLIST REQUIRED
 			VALUENAME "NoDriveTypeAutorun"
 			ITEMLIST
 				NAME !!Autorun_Default		VALUE NUMERIC 145 ; 0x91
 				NAME !!Autorun_NoRemovable	VALUE NUMERIC 149 ; 0x95
 				NAME !!Autorun_NoFixed		VALUE NUMERIC 153 ; 0x99
 				NAME !!Autorun_NoRemovableFixed	VALUE NUMERIC 157 ; 0x9D
 				NAME !!Autorun_NoCD		VALUE NUMERIC 177 ; 0xB1
 				NAME !!Autorun_NoRemovableCD 	VALUE NUMERIC 181 ; 0xB5
 				NAME !!Autorun_NoFixedCD	VALUE NUMERIC 185 ; 0xB9
 				NAME !!Autorun_None		VALUE NUMERIC 255 DEFAULT ; 0xFF
 			END ITEMLIST
 		END PART
 		PART !!Autorun_Text1	TEXT
 		END PART
 		PART !!Autorun_Text2	TEXT
 		END PART
 	END POLICY
 END CATEGORY
 
 [strings]
 AdvancedAutorun="Advanced Autorun Settings"
 Autorun_Box="Turn off Autoplay on:"
 Autorun_Default="No drives (XP/Vista default)"
 Autorun_NoRemovable="Removable drives"
 Autorun_NoFixed="Fixed drives"
 Autorun_NoRemovableFixed="Removable, Fixed drives"
 Autorun_NoCD="CD-ROM drives"
 Autorun_NoRemovableCD="CD-ROM, Removable drives"
 Autorun_NoFixedCD="CD-ROM, Fixed drives"
 Autorun_None="All drives (including RAM drives)"
 AutorunAdvanced="Turn off Autoplay (advanced)"
 Autorun_Text1="Windows XP and Vista disable Network and Unknown drives by default"
 Autorun_Text2="Windows 2000 and Server 2K3 also disable Removable drives by default"


Source: http://www.edugeek.net/forums/windows/25714-advanced-autorun-autoplay-settings-adm-file.html

Credit to Minkus.

Retrieved from "http://wiki.robotz.com/index.php?title=Talk:Autorun&oldid=7311"