Microsoft slammed over security advice
Nibble
CERT says Downadup workaround is dumb
Thursday, 22 January 2009, 13:07
US COMPUTER Emergency Readiness Team (US-CERT) has warned that Microsoft's advice about how to beat the Downadup worm is flawed.
Vole recommended switching off Windows' Autorun feature as a method of stopping one of the fastest-spreading attacks on the Web.
However US-CERT said Microsoft's instructions on turning off Autorun are "not fully effective" and "could be considered a vulnerability." µ
L'Inq
CERT
Share this:
Share
Advertisement
Subscribe to the INQ Newsletter
Sign-up for the INQBot weekly newsletter
INQ Whitepapers
Business Intelligence Software
Customer Relationship Management (CRM)
Enterprise Accounting Software
Enterprise Resource Planning (ERP)
Enterprise Systems Management
Jobs
Advertisement
INQ Poll
Would you mind telling us why?
You have given a statement that their advice to turn off autorun is not fully effective, but why? I know it may seem obvious, but a good article does not just make statements - it backs them up with reasons and evidence.
Also, where is the mention of the Windows update file they released? If turning off autorun is their advice, why release an update? Clearly their 'advice' is also to keep up to date with Windows updates.
Come on, if you are going to post an article, do a decent job and post a more complete article.
The linked CERT advisory tells us that they method in which Microsoft says to disable Autorun is not fully effective. They outline an example to prove it and also how to properly disable it for all drives. The article is not specifically about the recent worm outbreak, merely about a flaw in one of Microsoft's recommended workarounds.
The INQ misleading? Posting incomplete information? No reasons or evidence? I wonder why it was labelled 'Nibble'?
Just a thought.
Here's the US-CERT article in question (TA09-020A):
http://www.us-cert.gov/cas/techalerts/TA09-020A.html
I can't believe anyone dumb enough to ALLOW any autorun feature on their machine in the current environment.... It's one of the first things I disable on any new computer.
Once you HAVE the virus, you can no longer download updates from Microsoft and most antivirus software vendors. One thing the virus does is block requests from you computer to these web sites. Following the steps from a site I found - http://www.downadup.com - downloading a free removal tool, disabling AutoPlay, and repairing the registry - you can remove this virus and protect from infection.
the program will not let you delete the part of the usb drive it's on. If anyone knows how to do this please reply ;-)
If Sandisk are selling USB drives like this then it's no surprise that virus writers are exploiting Sandisk's usb drives.
PS - I know it's not just Sandisk, but still I'll start there ;-).
PPS - The Inq, please FIX THE COMMENT PARAGRAPH BUG.