Autorun: good for you?
Yes, if you're a five-year-old and you're tired of always asking mom or dad how to start the game on the CD. No need to know how! Just pick up the disc (a little peanut butter on your fingers helps with the grip), slide it in the drive, and wait for the game to start. Groovy!
No, if you're a security administrator. Many people still aren't aware of the security risk that autorun raises. It isn't new anymore, but DarkReading's Social engineering, the USB way is still the best story the make the point. Check it out.
I really can't think of any business reason for keeping this feature enabled. Please shut if off, domainwide, as soon as you can.
In Windows Vista/Server 2008, go here:
Computer Configuration | Administrative Templates | Windows Components | AutoPlay Policies
Enable the "Default behavior for AutoRun" policy and set the default to "Do not execute any autorun commands."
Enable the "Turn off Autoplay" policy and set it to "All drives."
In Windows XP/Server 2003, go here:
Computer Configuration | Administrative Templates | System
Enable the "Turn off Autoplay" policy and set it to "All drives."
While this might be old news for many of my readers, disabling autorun still doesn't seem to be a common security mitigation. At a recent conference I was surprised at the number of folks who haven't considered the risks of leaving it enabled. Surely by now most of you have heard about how certain music CDs can spread rootkits in your network. Yeah, holding down the [Shift] key when inserting a CD-ROM or USB drive will bypass the autorun.inf file -- but do you really want to rely on individual users remembering this? Nope. Group policy is your security friend: put it to good use here and disable autorun right now.
(BTW, Sony is up to their dirty old tricks again.)
Updated, 22 September 2007. Turns out there's a registry key that keeps track of all USB drives your computer has ever seen, and this key will override the Autorun settings if you insert a drive that your computer has seen before. So in addition to changing Autorun, you'll also need to delete this other key. Write a little script and call it from group policy. Here's the key to delete:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
More details here.
