YSK: Removable drives/thumb drives are potentially dangerous in Windows 11
YSK: Removable drives/thumb drives are potentially dangerous in Windows 11
If you plug a USB drive into Microsoft Windows, in many cases it will try to do things "for you" with the drive. Not a great idea. There could be malware lurking on that USB drive.
There are a couple of things you can do to help mitigate the issue. These tips assume Windows 11.
Turn off Autoplay
- Open Settings. Press Windows + I to open the Settings app.
- Go to Bluetooth & devices. In the left sidebar, click on "Bluetooth & devices."
- Select Autoplay. Scroll down and click on "Autoplay."
- Turn Off Autoplay. You'll see a toggle switch labeled "Use Autoplay for all media and devices." Turn this off.
This will turn it off completely. You can, if you want, make individual settings for different types of devices.
Deny Execute Access (Pro or Enterprise versions of Windows 11)
- Open Group Policy Editor. Press Windows + R, type gpedit.msc, and press Enter.
- Navigate to the Removable Storage Access Policies. Go to Computer Configuration > Administrative Templates > System > Removable Storage Access.
- Modify Policies. You can enable the policy "Removable Disks: Deny execute access" to prevent execution from removable drives.
- Apply and Reboot.
Note, there are some cases where you may want to execute scripts or programs from a removable drive. If that's the case, you may not want to do this, or make a note of it so you can re-enable if needed.
why the fuck did they re-enable autoplay? it was a terrible idea when they did it years ago and they quickly disabled it.
People are becoming even more tech illiterate.
I just checked a freshly installed Windows 11 and the autoplay is off by default.
So to follow up on the point you are trying to make: People are illiterate because they react loudly without checking what they react about. It's enough for them to get a few online upvotes in a world where they don't matter otherwise.
Including the Dev team at Microsoft I guess.
I just checked a freshly installed Windows 11 and the autoplay is off by default.
So to follow up on the value of your question: People react loudly without checking what they react about. It's enough for them to get a few online upvotes in a world where they don't matter otherwise.
Because people in general want things to be 'easy' far more than they they care about security risks they don't understand. If they cared about security at all, they wouldn't be plugging random USB sticks into their computers in the first place.
You are remembering that the executable features of autorun.inf is disabled, which is still true. Autoplay (if enabled) as it exists currently only applies for discovered media file types and makes your default configured media player responsible for handling them. It would not be possible to execute arbitrary tasks unless you had an ACE exploit for the installed media player.
Because people get all their music from MP3s downloaded via limewire, and store them on usb drives apparently.
Such a modern operating system! Forward thinking Microsoft.
Uhhh... Shouldn't you just not plug random shit into your computer?
Think of it as a seatbelt. You don't plan on crashing your car, but shit happens. It's even possible a brand new USB drive from a "reputable" company could have something on it.
You forgot the lack of mental capacity in the average windows victim.
It's surprising how many people will plug in a random USB drive that they find. Apparently that's how the CIA got the Stuxnet virus into Iran's system and nerfed their centrifuges back in the day.
[rubber duckies intensify]
Usb killer: you guys do things with the computer?
Yeah but maybe someone else does it
Why the fuck is the non execute setting, a principal safety feature, restricted to the pro and ent versions!?
Fuck you Microsoft.
There is also a registry hack for this but I have not looked into it or tested it. (And I agree with your sentiments re: Microsoft.)
Registry changes are too confusing for normal computer users. The year of the Windows desktop is a pipe dream held dearly by the utterly deranged.
It's even worse than that. If you plug a USB device into a computer, it can pretend to be a keyboard and mouse, and do malicious things that way.
Do not plug any random device into your hardware.
Yep, plug it into your coworker's computer to test it first.
Some malicious USB drives have a capacitor that will discharge and fry your whole system. Unless you have an air-gap system that you don't care about, unknown USB drives should be disposed of.
Oh, and all this and more can be accomplished with a sneaky charging cable too. So you have to dial in your level of paranoia to suit your situation. The person most likely to tamper with your computer is a spouse. Search and chat histories as well as GPS devices are becoming common in divorce cases.
Two devices which can get handy for those:
so one thing that has been driving me nuts is that windows is doing something to my external TB drive to where Ubuntu thinks its corrupt. (I have dual-boot) after googling it, windows sets the drive flag as a "dirty" NTFS system, and Linux no longer reads it afterwards. not sure if there's any solution to fix that, but I'll give these a shot.
You can use ntfsfix on the drive to do a check and remove dirty bit. This isn’t a full check though, and could mask or hide actual issues with the drive if it’s failing.
There’s also chkntfs which is more robust but I’m not sure if that’s open source and I’m not familiar with it.
Using ntfsfix is a good quick fix in my experience, but at the end of the day, NTFS is a Microsoft exclusive format and shared disks should be mounted in a format that both OSes can use, like exFAT, or Btrfs with the WinBtrfs driver (the latter I’m not familiar with, I’ve always used exFAT for shared disks, but I don’t use Windows anymore).
Did you try to disable "Fast Startup" ?
By default, Windows does not do a real shutdown anymore. It closes the user session and hibernates, to speed up the following start up. As a consequence, the Windows partition (and EFI partition ?) are not properly unmounted.
If you have Windows, it might be worth getting it to run Scandisk - or whatever the current equivalent is - on that drive.
That would at least give it less excuse to set problematic bits. In theory there'd be no harm doing this. In practice, well, make sure you have other copies of whatever is on that drive on the off-chance Windows constantly setting that bit is a sign of an underlying problem that Scandisk would make worse (or Windows/the disk decides to mangle files for some other reason.)
wasn't autoplay here since like win98 or so though?
95, and they disabled it circa Vista because it was obviously a stupid idea.
Ironically, this was originally only for drives that reported themselves as optical media (CD/DVD), but now modern versions of Windows actually won't autoplay an immutable commercially pressed CD, even if it has the correct autoplay.inf file on its root directory structure, but somehow it will autorun things on a flash drive which is a medium explicitly capable of being fucked with by a malicious actor.
Because that makes sense.
It does make sense from the perspective of "destroy the public's perception of 'unsafe' USB storage so that we can push them to use our 'safe' cloud storage (on our terms) instead".
That seems to be the opposite of what the others are saying: https://en.wikipedia.org/wiki/Autorun.inf#Inf_handling
Windows 7, Windows 8, Windows 8.1, Windows 10
For all drive types, except DRIVE_CDROM, the only keys available in the [autorun] section are label and icon. Any other keys in this section will be ignored. Thus only CD and DVD media types can specify an AutoRun task or affect double-click and right-click behaviour.[9][10]
An hour old post about Windows on the Fediverse and no one has said use Linux?
Use Linux.
...with usbguard installed and configured with a default-deny policy.
Personally, I'm using Win10 'til it doesn't get security updates anymore.
Then I'll give Linux a go.
I hope it's a positive experience when you do!
I just checked a freshly installed Windows 11 and the autoplay is off by default.
Were you trying to get upvotes just for the fun of it??
First of all I believe you are incorrect.
You're doing a single anecdotal "test" from (I assume) one copy of the installation media. News flash, not all installation images of Windows 11 are the same.
And I will answer your anecdotal evidence with some anecdotal evidence of my own: almost every friend and coworker I've asked about this says Autoplay is on. And when I check Google or ChatGPT, they confirm that a fresh install of Windows 11 will have it on by default. So....I guess everyone else is wrong about this but you're right about every installation of Windows 11.
Secondly, your question ignores the fact that people should probably check to see if it's on. It can get turned on accidentally or even by an update. Microsoft is constantly messing arbitrarily with user preferences and settings with their weekly updates. You do know that, right?
Finally, you posted some version of this same reply multiple times in this thread. Why? Are you just doing that to "get upvotes for fun"?
BTW, there's no karma on lemmy....upvotes don't matter.
It's fine to correct someone, but first do a better job of checking your methodology, and second, don't assume their motivations for trying to share helpful info.
I checked two more computers after reading your reply (first time setups) and they all have autoplay off, so I remain skeptical of what you stated.
There are so many trolls and misinformation floating around.
As far as I have seen with those "fresh" installs, your information is not matching the reality here, so I'm moving on to other sources.