New malware/would NoScript prevent infection?

eradic8 · Post by **eradic8** » Fri Jul 16, 2010 1:24 pm

Would NoScript be able to prevent this new type of Malware from infecting a usb drive in the first place.
http://krebsonsecurity.com/2010/07/expe ... tcut-flaw/

Post by **Giorgio Maone** » Fri Jul 16, 2010 1:27 pm

Unfortunately not, because this vulnerability has nothing to do with the web and gets exploited as soon as you insert the infected USB dongle and browse its content in Windows Explorer (note: Windows Explorer is a filesystem browser, while Internet Explorer is a web browser -- the two used to be the same in the early days, but now they're very different).

eradic8 · Post by **eradic8** » Sun Jul 18, 2010 9:57 am

Thanks Giorgio, I just had trouble understanding how you could get infected by this malware simply by opening Windows explorer when you have a USB drive connected. Still not sure I fully understand.

Post by **Giorgio Maone** » Sun Jul 18, 2010 10:00 am

eradic8 wrote:Thanks Giorgio, I just had trouble understanding how you could get infected by this malware simply by opening Windows explorer when you have a USB drive connected. Still not sure I fully understand.

Windows performs some actions automatically when you insert an USB drive. This attack exploits a flaw in one of these operations.

Post by **therube** » Sun Jul 18, 2010 1:56 pm

Appears this is not a "typical" autorun vulnerability.

Dslreports: Rootkit-TmpHider - USB infector without usage of Autorun.inf

MS: Microsoft Security Advisory (2286198) Vulnerability in Windows Shell Could Allow Remote Code Execution

eradic8 · Post by **eradic8** » Mon Jul 19, 2010 8:25 am

Thanks Guys, I undesrstand Microsoft are taking this very seriously and are currently working on a patch for this vunerability. Hopefully they will sort it out soon, in the meantime I will have to hope my Norton 2010 internet security can protect me from this vunerability.

dhouwn · Post by **dhouwn** » Mon Jul 19, 2010 9:02 am

Norton 2010 is a signature-based virus-scanner in the first place and with this functionality, it won't protect you against the vulnerability per se but against infection with known malware.

Post by **therube** » Tue Jul 20, 2010 11:45 pm

Interesting read, Vulnerability in Windows Shell Could Allow Remote Code Execution.

eradic8 · Post by **eradic8** » Thu Jul 22, 2010 8:26 am

It just got a whole lot worse. http://www.sophos.com/blogs/gc/g/2010/0 ... ges-risky/

InformAction Forums

New malware/would NoScript prevent infection?

New malware/would NoScript prevent infection?

Re: New malware/would NoScript prevent infection?

Re: New malware/would NoScript prevent infection?

Re: New malware/would NoScript prevent infection?

Re: New malware/would NoScript prevent infection?

Re: New malware/would NoScript prevent infection?

Re: New malware/would NoScript prevent infection?

Re: New malware/would NoScript prevent infection?

Re: New malware/would NoScript prevent infection?