Penetration Testing mailing list archives

RE: Security with USB Devices


From: "Damien Lewis" <dwlewis () comcast net>
Date: Tue, 26 Jul 2005 19:10:12 -0400

Not sure if this would work as I haven't tested it, but why not have a
CD-ROM Autorun the USB drive?  In addition, here is some information from M$
regarding the USB Mass Storage Device Driver that is installed by default on
Windows 2000 and XP:
http://www.microsoft.com/whdc/device/storage/usbfaq.mspx

Best regards,

DL

-----Original Message-----
From: NewYork User [mailto:newyorkuser () gmail com] 
Sent: Tuesday, July 26, 2005 10:52 AM
To: pen-test () securityfocus com
Subject: Security with USB Devices

List, 

Does any one know a good program to "autorun" from USB drive on a windows
2000 or an XP machine? I have tried the traditional Autorun.inf but didn't
have any luck. I looked up in google but couldn't find any useful stuff. I
saw some commercial programs to use for backup etc..But its not of any use
if I want to prove my point that data can be vulnerable if use of USB drives
is not restricted either by using a program or any kind of security control.
I created a simple batch file to open up a Netcat listener. It is pretty
common for the users lock their machines and leave their desks. I'm looking
for any kind of scripts that can run a batch file automatically or can copy
the data automatically. Any ideas?

Thanks for your help.



Current thread: