This articles is aimed at those professionals, and how they can minimize the risk of passing an infection onto other machines.
How it Works ?
Malware uses two main techniques to spread through Pendrive (USB). The first, and less serious, is infecting executable files on the Pendrive (USB), so that when they are run on another machine, the infection moves with them.
The more common, and more dangerous, is to spread via the `autorun.inf` file, which Windows automatically executes when the drive is connected, meaning that no user interaction is needed. Conficker has been getting a lot of attention recently, and this was one of the methods it used to spread itself, but many
other malicious programs used the same technique.
It is possible to disable the autorun feature from Windows, but this requires that the client machine has done this, which is not always the case, as most users will not have the technical knowledge to do this.
How to Fix USB Malware ?
Since we cannot rely on the computer to prevent the execution of the autorun.inf file, we must do this from the Pendrive (USB). It is possible to buy Pendrive (USB) with read-only switches, so that they can be locked to prevent the computer writing to them, but this can cause problems, is easily forgotten,
and doesn't help once the Pendrive (USB) has been infected.
However, if the Pendrive (USB) is FAT32, which most are, with the exception of some of the new 8GB+ drives, we can create a quick fix using a hex editor, and a basic knowledge of the FAT32 directory table.
First, we create a blank `autorun.inf` file on the Pendrive (USB), then open up the disk in a hex editor. It doesn't matter if you open the physical disk, or the logical partition, but if the disk has more than one partition, it is better to do the latter. Make sure that the disk is opened with read/write permissions, and that you haven't got anything accessing it at the time. HxD for Windows is a small, portable hex editor, if you don't already have one.
Download : HxD for Windows
Note : While this can be done to a disk with data on, it is safer to do it to a blank one, just in case there is a problem. If not, make sure that you have a copy of any data on the stick, if you don't, the you are liable to any loss of data that might occur.
Next, run a search in the disk for the string `AUTORUN`, as a non-Unicode text string. It should find it near the beginning of the disk. The area we are interested in is as follows.
41 55 54 4F 52 55 4E 20 49 4E 46 20
A U T O R U N I N F
The first 8 bytes are the filename (with a space at the end, because autorun is only 7 characters), followed by a 3 bytes file extension (INF), followed by one byte for the file attributes. It is this final byte that is relevant.
The current value of the byte (0x20) has just the archive bit set. What we want to do, is to change this byte to 0x40, which sets the device bit, which is never normally found on a disk. The block will now look like this.
41 55 54 4F 52 55 4E 20 49 4E 46 40
A U T O R U N I N F @
Once this has been saved to disk, ignoring any warning that this might corrupt the disk, we then unmount and remount the volume. Now, when you browse to the disk, the autorun.inf file can be seen, but it cannot be deleted, opened, edited, overwritten, or have its attributes changed.
When this Pendrive (USB) is connected to an infected machine, which will try to create an autorun.inf file on it, it will fail with an error, (Cannot create file), meaning that this Pendrive (USB) cannot be infected, and thus cannot pass an infection on to any other computers.
S0, Hope now your USB will be free from Malware attacks. Should this technique become widely used, we will almost certainly see malware that can bypass it, but until that happens, it can provide a simple but effective defense against USB spreading malware.
If you have any comments , questions or suggestions , then comment Below or send me an email.
4
