Feeds

Malware abusing Windows Autorun plummets

You'll never guess why

Secure remote control for conventional and virtual desktops

Microsoft saw a sharp drop in malware infections that exploit a widely abused Windows Autorun feature almost immediately after it was automatically disabled in earlier versions of the operating system.

As measured by Microsoft's various antimalware programs, Windows XP and Vista suffered 1.3 million fewer infections in the three months following February's retirement of Autorun compared with the three month preceding the change. By last month, attacks hitting Vista machines plummeted 74 percent and fell by 59 percent for those running XP.

Entire families of malware – including Conficker, Taterf, and Rimecud – owe much of their prominence to Autorun, which was designed to make life easier for users by executing code embedded on thumb drives when they were attached to a computer without first prompting the user. Worms and trojans have been abusing the feature for more than a decade to propagate malicious payloads each time an infected drive was inserted.

Microsoft finally killed much of Autorun in Windows 7, but users who wanted to disable the feature in earlier Windows OSes had to make manual changes to their system registry or install a hot fix on Microsoft's website. All of that changed in February, when the company's security team finally began pushing out an automatic update that made the change the default behavior in all supported versions of Windows.

As of last month, Microsoft saw a little more than 400,000 infections by malware that abused the feature, down from a peak of about 1.8 million in June 2010, as shown in the chart below, which Microsoft provided on Tuesday. Almost immediately after the update was released, Microsoft saw a similarly drop in infection attempts, although it wasn't quite as precipitous.

Chart showing infections targeting autorun

Source: Microsoft

What took so long?

The data raises the obvious question: If automatically retiring Autorun reaped such clear benefits, why didn't Microsoft do it years ago?

“There was a lot of work in the industry to get people moved over to new technology built into Windows, and we felt that we had finally got to that point where the industry was in agreement with us that it was time to push it out to everybody,” Jerry Bryant, group manager in Microsoft's Response Communications, told The Reg.

The delay demonstrates one of the challenges that comes when a company commands a market share as massive as Microsoft's Windows. Changes that clearly benefit users have to be weighed against the inconvenience of hardware and software partners, whose embrace is part of the reason Windows is as widely used as it is.

Even now, Autorun hasn't been completely disabled. Windows will dutifully execute code embedded into CDs and DVDs that are inserted into computers. To date, malware criminals have shown little interest in exploiting the weakness, but its survival is a reminder of the tradeoffs that come from keeping users secure. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Free virtual appliance for wire data analytics
The ExtraHop Discovery Edition is a free virtual appliance will help you to discover the performance of your applications across the network, web, VDI, database, and storage tiers.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.