Honestly, if the victim thinks it's legitimate and they've plugged it in, autoplay being disabled is no big deal to the attacker, chances are, they're going to double-click the setup.exe/install.exe anyway...

You haven't heard of BadUSB?

Don't plug in untrusted USB devices.

Yeah, I heard. Still the case of a badly configured device.

Remember kids, it's a software driver configuration. Show me that BadUSB that works on the dumb DOS operating system. No? Yeah, didn't think so. Only "clever" OS'es are pwned by this, and if you dumb them down then nothing gets to run automatically.

BadUSB or similar could be setup to work on DOS if the system firmware does USB keyboard mapping. You can do copy con foo.exe or something with debug, and then stream the executable you want to run, then run it. A bit more work, and there's no standard networking and all that, but it's doable if you really want it done; but you'd need a target to make it worthwhile.

Sooo... we go back to my initial point of a "badly configured system"?

Well, most of my recent computers don't have an option for keyboards that's not USB. But a system with no inputs is probably the most secure you can get.

You can also hotglue unused ports and physically prevent unplugging the intended devices. But that's not realistic for most systems.

It's the old usability vs security compromise.

Any DOS is susceptible to Bad USB emulating a keyboard if the BIOS supports USB keyboards.

Autorun/autoplay are only one possible vector for attack. No matter how well configured your device is it can still be destroyed by an electrical attack where a bad USB device charges capacitors and then zaps your device. Got it boomer?

Or USB Killer... Although there's generally no financial incentive for an attacker to mail you a USB Killer.

Like with most DoS style attacks it's mainly vandalism. Though an online DoS could be used for market manipulation at the right time, it usually isn't.

I think you missed the point of the scam.

If someone thinks they just got a free copy of Office, and is willing to plug the USB drive in, then they're also willing to run the 'Setup.exe' on it, too.

I am curious what's on that USB stick. Is it a flash drive/HID thing like a rubber ducky that types something in to run a payload?

Or, just bad phrasing on the article?

Autorun.inf plus some html file or simple app displaying a msgbox.

I thought Autorun was no longer a thing since Vista or so.

I thought plugging a thumb drive in can deliver malware without opening files.

Something about full memory access before block level … or is that PCIe?

USB doesn't have implicit DMA (Direct Memory Access), so it can't install malware on your computer without getting past your operating system. (Though just enabling autoplay will do the trick - and I have no idea whether thats turned on by default these days.)

Firewire used to have DMA access via how the port was physically wired, but afaik it was fixed before being phased out. Thunderbolt also gets access to the PCIe bus (and also by extension, DMA). I'm not sure what the security situation is there.

As others have mentioned, USB devices can also do physical damage to your computer if they want to, by charging a capacitor over a few seconds then discharging it all at once.

Its generally a bad idea to plug mystery USB devices into your computer.

> Thunderbolt also gets access to the PCIe bus (and also by extension, DMA). I'm not sure what the security situation is there.

There is support for having the user authorize the device before logically connecting it to the rest of the system; see e.g. https://wiki.archlinux.org/title/Thunderbolt#User_device_aut...

It would not surprise me if this does nothing, because firmware implements it poorly, and/or because users click OK on everything.

Device authorization for PCIe tunnels is TB3+ feature, older versions are out of luck.

The situation with firmware is not that bad, though. There are exactly two of them, Intel and Apple. Apple devices have the Apple implementation and the rest of the world Intels.

On capable hardware, IOMMU is also used (for all security levels).