USB Flash Drive Virus Proof of Concept

I came across something very disturbing a few minutes ago, and I think the world really needs to know about it. I know you all know that Windows is horribly vulnerable to every PC malady that has ever existed, but here's one that is basically built-in on purpose by Microsoft.

This particular exploit utilizes the built in autorun.inf 'feature' in all recent versions of Windows to run its payload, whose source code can be seen at QuantumG's site where I Stumbled Upon it. What the code does, is basically as soon as you insert the flash drive containing this program, opener.exe, and the 4 lines in autorun.inf, it will find any other removable drives, copy itself onto them, and hide itself. The actual process goes like this:

1. Open an explorer window for the drive we're running from.
2. Make sure there is only one copy of opener.exe running.
3. Scan the available drives for any that are removable.
4. Check that there is some free space on the drive.
5. Check that the drive doesn't already have an autorun.inf.
6. Dump the following into autorun.inf:

   [autorun]
   shell\eject=Eject
   shell\eject\command=opener.exe
   shell=eject
   

   This creates a new shell command which I've just randomly named "Eject" and, importantly, makes it the default action.
7. Write a copy of opener.exe to the drive.
8. Mark both autorun.inf and opener.exe as hidden.
9. Do any other removable drives we can find.
10. Wait about a minute.
11. Go back to step 3.

This is very basic virus behavior, but if the author was malicious, absolutely anything they wanted to do could be done. This has very serious implications for users, and needs to be addressed post-haste by Microsoft. Let's get the word out, you can help by Stumbling, Digging, or doing whatever you can to share this post and get it fixed.

Original site at http://rtfm.insomnia.org/~qg/opener.php
Image courtesy of Francois Thé