flyinghaggis Posted January 13, 2009 Posted January 13, 2009 We've been finding that pupils (and staff) seem to be increasingly bringing in USB memory sticks they've been given as freebies into school. Most of these seem to be formatted (I'm assuming it's done purely using software rather than custom hardware in the sticks) specifically so that they appear in windows as both a 'virtual CD' partition and a partition that contains the USB drives data. When connecting them to a PC the USB stick autoruns and windows detects it as a virtual CD drive which launches an app (often a Menu or a promo screen) from an .exe file and them mounts the USB data partition. What's really worrying is that despite us having autorun turned off for users and Windows GP file path restrictions in place to stop executables running from removable drives the way these sticks emulate a CD drive seems to bypass this allowing the initial menu program to run ? Has anyone found a fix to stop these type of memory sticks from being used and/or autorunning when connected as they're potentially a pretty major security loophole ? Also is there any kind of program to reformat these sticks so we can get rid of the hidden virtual CD partition? I've tried the U3 removal tool but it's not detecting the USB drive as being a U3 model ?
ajbritton Posted January 13, 2009 Posted January 13, 2009 Hmmm. Never heard of that. Not sure how a normal USB drive could be formatted to appear as a CD (except of course by the inclusion of AUTORUN.INF that points to a custom icon for the partition). Do you actually have one in your posession to test? I am very surprised to find that GP restrictions are not effective. Perhaps students are disconnecting PCs from LAN at critical moment during logon which can affect GP processing. Are you using a blacklist or whitelist approach for restrictions? In my experience, the whitelist approach is far more reliable.
Griffo Posted January 13, 2009 Posted January 13, 2009 I have had a few of them brought to me but never really looked at how it was done. There are also a few branded ones like a Liverpool Echo or LFC one that i seem to remember launches IE and goes to their website when inserted. Not a problem for us as we simply dont allow any access to usb drives
ICT_GUY Posted January 13, 2009 Posted January 13, 2009 I have a kingston one, it drives me mad, the U3 removal tool does not work on them either. Its so annoying I hardly ever use the stick now.
flyinghaggis Posted January 13, 2009 Author Posted January 13, 2009 (edited) Hmmm. Never heard of that. Not sure how a normal USB drive could be formatted to appear as a CD (except of course by the inclusion of AUTORUN.INF that points to a custom icon for the partition). Do you actually have one in your posession to test? I am very surprised to find that GP restrictions are not effective. Perhaps students are disconnecting PCs from LAN at critical moment during logon which can affect GP processing. Are you using a blacklist or whitelist approach for restrictions? In my experience, the whitelist approach is far more reliable. Yeah, I'm amazed MS haven't blocked these sticks in windows as it's basically using a hack to fool windows into thinking the USB stick is a CD drive. Given this works as a limited user without admin rights it leaves the whole thing seriously open to being exploited! We've using a blacklist rather than whitelist which may be part of the issue? I've tried it myself using our test pupil account so it's definitely not a problem caused by pupils unplgugging network cables/etc. I have had a few of them brought to me but never really looked at how it was done. There are also a few branded ones like a Liverpool Echo or LFC one that i seem to remember launches IE and goes to their website when inserted. Not a problem for us as we simply dont allow any access to usb drives Admittedly the ones I've seen so far have been innocent in what they've done but my fear was that one might get infected with a virus and/or pupils might find out how to create their own customs sticks that would allow them to run programs bypassing our security (which looks like these specifically formatted sticks do) ! It's also frustrating because after plugging in these devices they install then prompt for a reboot (because of the virtual CD drive) so it's acutally permanently altering the configuration of the PC which is a concern. Has anyone found a way to block them yet other than blocking all removable USB drives? Edited January 13, 2009 by flyinghaggis
RabbieBurns Posted January 13, 2009 Posted January 13, 2009 my 16bg sandisk has this cr*p on it. It also creates a directory structure on the disk it thinks i might want. Documents. Photos etc. If i delete them, they re-appear next time I plug it in. ANNOYING. I even formatted the drive and it still happens. GrRR
flyinghaggis Posted January 13, 2009 Author Posted January 13, 2009 They certainly make it difficult to reformat the drive (assuming it can be done) but then I guess they don't want you removing their advertising material! You can't easily do it in windows because it sees it as though it was a CD drive and only lets you format the 'other' USB partition on the drive natively. The only way I could think to carry it out would be to use Linux (or some kind of DOS cmd prompt boot) where you could physically see the partition structure on the drive and remove it?
RabbieBurns Posted January 13, 2009 Posted January 13, 2009 mine appears as a usb+cd in ubuntu as well. Mine is a legitimate paid for 16gb memory stick not a freebee POS. Its annoying as H3ll.
takeware Posted January 13, 2009 Posted January 13, 2009 Hi Formatting wont do it I'm afraid, neither will partitioning. U3 and some others emulate a CD in their firmware - which means as far as Windows is concerned it's pretty much a separate device. Some of manufacturers provide tools to manipulate the vCD - can't recall whether U3 do. M-Systems (who designed the U3 system and then partnered with Sandisk to try to poularise it) used to provide such tools as a downloadable SDK. But we are going back quite a while. Drives are so cheap now why bother with it? HTH
flyinghaggis Posted January 13, 2009 Author Posted January 13, 2009 (edited) Drives are so cheap now why bother with it? I'm not bothered about using the drives TBH. My primary concern's really what the sticks do as I don't like the idea of pupils bringing in USB drives that install virtual hardware onto a PC and appear to bypass security policies! As you say it looks as though these drives actually contain different hardware controllers (rather than just being regular sticks formatted in a special way) to handle the CD emulation so you'd need a specifically written piece of software for each hardware controller type to alter/format them Would be nice to reformat them if we could but failing that I'd be happy to block them altogether if anyone knows a way! Edited January 13, 2009 by flyinghaggis
Geoff Posted January 13, 2009 Posted January 13, 2009 You do realise your systems are vulnerable to USB switch blade hacking? USB Switchblade - Hak5 We just disable USB here. There's so many loopholes in Windows related to it, it's not worth trying to tie it down.
takeware Posted January 13, 2009 Posted January 13, 2009 It's difficult for the OS to tell the difference between a real CD drive and a good emulation in software. This may possibly be an understatement ;-) I'm going to tread very carefully here - as I'm new here are don't want to overstep the mark - but we have software that does that (and a lot more). I'm happy to provide more details - but via private mail or only with explicit permission. One way you can differentiate between a resident CD and one on a USB device is that the interloper is not there at startup (obvious loophole - if it's already plugged in at startup). A utility is possible that detects the (late) arrival of a vCD and kicks it out. I don't know how useful that would be? If enough interest is there I might be able to get something made up and available as a freeware download (once we test it). Let me know?
flyinghaggis Posted January 13, 2009 Author Posted January 13, 2009 You do realise your systems are vulnerable to USB switch blade hacking? USB Switchblade - Hak5 We just disable USB here. There's so many loopholes in Windows related to it, it's not worth trying to tie it down. We've seen this before and it's pretty concerning TBH. USB is something I'd like to block (and think it's we'll probably ultimately be forced into in future given data protection issues and the exploits for it) but there's no way SMT will allow it at the moment without months of discussion. Even then it probably won't happen! How'd you manage to convince SMT to allow you block all USB devices! Do you just block it on pupil PCs or for staff aswell?
Sirbendy Posted January 13, 2009 Posted January 13, 2009 google for U3 removers...I do it to staff ones on demand, and I've removed it from my own. Bloody annoying thing it is.
flyinghaggis Posted January 13, 2009 Author Posted January 13, 2009 I actually tried the U3 removal tool on the last stick I encountered but it didn't appear to register the drive as being a U3 model so I couldn't remove the 'read-only' CD partition. I think it might be a different kind of drive though it looks like it works in a similar way.
takeware Posted January 13, 2009 Posted January 13, 2009 ... When connecting them to a PC the USB stick autoruns and windows detects it as a virtual CD drive which launches an app (often a Menu or a promo screen) from an .exe file and them mounts the USB data partition. What's really worrying is that despite us having autorun turned off for users and Windows GP file path restrictions in place to stop executables running from removable drives the way these sticks emulate a CD drive seems to bypass this.... Been discussing this with a colleague and wonder if the U3 or similar drive managed to install it's launcher on the PC - so that it ws able to run later - and appeared (to XP) to be running from the PC rather than the drive? Just a thought - as I can't see any way that it can get booted up without Autorun. (I've designed numerous applications over the last few years to make startup as easy as possible from removables but without 'injecting' a launcher or autorun I still can't see a way it can be done). On the vexed question of USB and security - as you may know this is our speciality - so again I will try to tread carefully. Please tell me if you dont find this helpful and I will desist straight away! I know it's not easy to preserve a good level of security and keep the convenience and flexibility of allowing removable memory devices to be used. As Geoff says there are a lot of considerations and some real 'gotchas'. The reason we have concentrated a lot of developement on this area is that there seems to be many schools - a majority of schools as far as I can tell - who want or need both. We have achieved this in numerous schools over the last three years or so but again as Geoff points out the problems are becoming more complex as the BECTA requirements etc require higher security and Impact Level labelling etc. making the problems very different when a student / pupil is logged in from when a staff member is. In the latter case the prime need (in my understanding) is to enure that data leaving is encrypted and is auditable (and that everyone knows that) - while with the pupils it's principally to prevent the kind of problems we've been discussing here (exes / autorun etc) and the bringing in - or taking out - of MP3s and other copyright stuff. It seems to me that every school is a little (or a lot) different in its needs and emphasis - and I'm constantly amazed at the diversity! You will no doubt have gathered that we have not given up on the quest (for the best of both worlds) - far from it. But I am keen to know what the key people on the frontline are thinking and how they plan to meet these challenges. Not sure I can help with arguments to persuade SMT to up the Araldite budget (kidding) but otherwise I might be able to help a bit here and there!
Geoff Posted January 13, 2009 Posted January 13, 2009 How'd you manage to convince SMT to allow you block all USB devices! Do you just block it on pupil PCs or for staff aswell? It's the status quo. Way back when we removed floppy/CD drives. It's just a continuation of that policy. Generally it's disabled in the bios apart from select PCs (Offices/Staffroom). Basically anywhere there isn't going to be unsupervised pupils.
ZeroHour Posted January 14, 2009 Posted January 14, 2009 One thing to try, make a blacklist hash of the autorun.inf exe it calls. I have a u3 stick so when I get back we can see if the hash blocks it or if each stick/manufacturer has a custom build of the exe.
nadeem Posted January 14, 2009 Posted January 14, 2009 The 'official' U3 removal is here Bring the power of portable software to your USB flash drive - make it a U3 smart drive! We actually intentionally gave out USB sticks this year to our students that were formatted in this way - it means that I know they have and can't delete certain information [forms, handbooks, etc] (and as a bonus to them they have storage space for their academic work) 1
7andY Posted January 21, 2009 Posted January 21, 2009 Latest Sophos Anti-virus has Application Control which stops all kinds of Nasties like this. Works very well, judging by the reports I get from Sophos. Stops all these U3 type fiddles, games, iTunes, media players... and more!! 7&
RabbieBurns Posted January 31, 2009 Posted January 31, 2009 The 'official' U3 removal is here Bring the power of portable software to your USB flash drive - make it a U3 smart drive! We actually intentionally gave out USB sticks this year to our students that were formatted in this way - it means that I know they have and can't delete certain information [forms, handbooks, etc] (and as a bonus to them they have storage space for their academic work) Removed from my pen drive perfectly.. Thanks
synaesthesia Posted February 1, 2009 Posted February 1, 2009 Slightly off topic but this could also be a bit of a security issue with the Conficker infection doing the rounds at the moment. The partition and autorunning program may well be read only but I'd be a little worried that variations of this worm may be able to make use of that.
mac_shinobi Posted February 1, 2009 Posted February 1, 2009 couldn't you use usbdlm to block all other drive letters except one that can be used for the usb memory stick in conjunction with ( assuming you have R2 ) to block autorun.info and exe's ( either or - or just both ) on the memory stick ( which you know will always load as that drive letter ( which you configured / set earlier using the usbdlm inf file ) due to usbdlm.
Tweedle Posted January 9, 2011 Posted January 9, 2011 Sorry to drag up an old thread... google for U3 removers...I do it to staff ones on demand, and I've removed it from my own. Bloody annoying thing it is. Actually no, it's people like you who buy it assuming its a normal flash drive who are annoying. U3's autoplay ability is excellent but people like you who buy it in a packet with the U3 logo never actually understood what it is. Then you're the first to moan about it and the next thing you know so is everyone else. Sandisk then get feedback that U3 is not popular and scrap it. The potential of it was huge but because people like you didn't understand what you were buying it's been dumped. For those moaning about the security aspects, its no more dangerous than a CD-rom that hasn't been completely disabled (and if you disabled it then why even have it in the machine?). As someone said on page 2, they handed them to students so they could know for sure that students had copies of documents. This technology also had other uses - such as onboard storage of drivers for USB devices. It would have eliminated the need for M$ to have to include thousands of drivers with every version of Windows and then bloating your hard drive. Didn't think about that last one huh. I have a tool kit for those who wish to remove their U3 partitions - pm me your email and I'll be in touch. You can also install your own .iso images to the virtual CD too (which is just as dangerous as burning a CD before anyone comments).
SimpleSi Posted January 9, 2011 Posted January 9, 2011 Sorry to drag up an old thread... Its not a problem that you've dragged up an old thread. Its your attitude it that's the problem. If the subject was currrent then maybe some of your comments would be relevent and useful. But the subject isn't current and your remarks aren't. regards Simon
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now