Disable Autplay globally for a device?

[Dave-ee Jones]

Hoi,

Just wondering if there is a way of disabling Autoplay for a device for every computer you plug it in to? Very frustrating having the Autoplay box pop up every time I plug in my Bunny or USB. I know you can do it for a single computer but I'm wondering if you can 'tag' your device so it doesn't trigger Autoplay.

Thanks.

[Forkish]

From what I unserstand, putting a small non text file (.gif ect.) and then rename the file autorun.inf in the root of the drive, the computer won’t be able read the file, stopping the autorun from completing. I used to use USBVaccine by Panda Security . It ‘vaccinates’ usbs to stop them from autorunning. I believe their Implementation process is similar.

[Dave-ee Jones]

6 hours ago, Spoonish said:

From what I unserstand, putting a small non text file (.gif ect.) and then rename the file autorun.inf in the root of the drive, the computer won’t be able read the file, stopping the autorun from completing. I used to use USBVaccine by Panda Security . It ‘vaccinates’ usbs to stop them from autorunning. I believe their Implementation process is similar.

So I could just have the contents of 'autorun.inf' something random (provided it doesn't accidentally have the correct tags somewhere in it, haha). I don't really want to use USBVaccine on my Bunny..it might decide to go "oh, it wants to boot? Nahnahnah we can't have that happen!".

[digip]

I don't know that the autorun.inf makes any difference. i don't have it on any of my thumbdrives, it still prompts. It's OS independent, not by device, but by what the OS is configured to do. Windows by default won't "autorun" any content these days, but will prompt "what do I do with this shit", if not disabled. OS's like linux can be set to not auto-mount as well, and some will mount and open a folder, while others just show the icon and let you choose, but again, is how it's setup on the OS side. Devices don't have a say, which is why old switchblade attacks stopped working, then they started using the CD-Rom partitions on U3 drives, which prompted since I think Vista, to not auto-run executables, but will now prompt for everything unless disabled altogether. autorun.inf is really only a viable attack method for older systems that aren't patched or configure to work around it like a default XP install pre SP2. If a device had the ability to tell the OS what to do, then shit would be a lot different, hence, why we have the Ducky, bash bunny, and similar HID attack devices these days.

[Dave-ee Jones]

41 minutes ago, digip said:

I don't know that the autorun.inf makes any difference. i don't have it on any of my thumbdrives, it still prompts. It's OS independent, not by device, but by what the OS is configured to do. Windows by default won't "autorun" any content these days, but will prompt "what do I do with this shit", if not disabled. OS's like linux can be set to not auto-mount as well, and some will mount and open a folder, while others just show the icon and let you choose, but again, is how it's setup on the OS side. Devices don't have a say, which is why old switchblade attacks stopped working, then they started using the CD-Rom partitions on U3 drives, which prompted since I think Vista, to not auto-run executables, but will now prompt for everything unless disabled altogether. autorun.inf is really only a viable attack method for older systems that aren't patched or configure to work around it like a default XP install pre SP2. If a device had the ability to tell the OS what to do, then shit would be a lot different, hence, why we have the Ducky, bash bunny, and similar HID attack devices these days.

Nonono, 'autorun.inf' tells Windows what to do with the device in the popup menu that comes up, but if you set 'autorun.inf' to something random it won't be able to read it, overriding Windows' default popup menu which appears when you don't have an 'autorun.inf'.

[digip]

7 hours ago, Dave-ee Jones said:

Nonono, 'autorun.inf' tells Windows what to do with the device in the popup menu that comes up, but if you set 'autorun.inf' to something random it won't be able to read it, overriding Windows' default popup menu which appears when you don't have an 'autorun.inf'.

If "autorun" is enabled, autorun.inf will execute whatever you point it to, ie: executable attacks ala switchblade and older USB attacks, which don't work on Vista and later(or should't) by default now. What you see as pop-ups asking what to do on insert, is "autoplay". These are two different things in "windows" based operating systems. On other OS's it's handled differently, but similar concept. "Autorun" is actually a setting, you can enable/disable in the registry, which will make things like the older switchblade attacks still work on recent windows CD drives. It's disabled by default since Vista. Autorun.inf still helps load things off CD's like installers with fancy gui's but they won't automatically "run" on insert, which they used to, and how spyware that would call home, would auto-install on Sony music CD's when listening to the audio CD and how the older USB hacks worked in XP and Server 2003.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutorun (for XP and Server 2003 group policy changes to disable) and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cdrom  AutoRun from 1 to 0(or I may have that backwards) and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR for most Windows systems to change USB options start =4 to disable storage options, start = 3 to enable. The USBstor changes only works for known drives. New drives auto prompt or reset to start=3 (as far as I know), unless you disable "autoplay" settings manually > Control Panel\Hardware and Sound\AutoPlay > change for ALL or indivdually per device settings.