The good news is that security savvy Windows users will, more than likely, have already disabled the AutoRun and AutoPlay features. The bad news is that a new zero-day vulnerability could care less, and executes automatically anyway.
The zero-day vulnerability in question was first spotted by Sergey Ulase, a researcher with security vendor VirusBlokAda, who when talking about some new malware samples he had been analysing noted "You should take into consideration that virus infects Operation System in unusual way through vulnerability in processing lnk-files (without usage of autorun.inf file). So you just have to open infected USB storage device using Microsoft Explorer or any other file manager which can display icons (for i.e. Total Commander) to infect your Operating System and allow execution of the malware".
According to security experts at Sophos , a new rootkit has been discovered which goes by the name of Stuxnet and exploits this vulnerability to install itself onto even a fully patched Windows PC by running from a USB memory stick even if the user has disabled Windows AutoRun and AutoPlay. It does, however, require the user to browse the device using Windows Explorer in order to be able to do this, rather than just execute automatically upon insertion.
"Threats such as the infamous Conficker worm have spread very successfully via USB devices in the past, but were in part reduced by disabling AutoPlay. The risk is that more malware will take advantage of the zero-day exploit used by the Stuxnet rootkit, taking things to a whole new level" Says Graham Cluley, senior technology consultant at Sophos, adding "the exploit is still being analysed by the security community, but there are disturbing suggestions that the malware could be trying to access data specific to Siemens SCADA systems - software that controls national critical infrastructure".
I'm a hacker turned writer and consultant, specialising in IT security. I've been a freelance word punk for over 20 years and along the way I have seen 23 of my books published, produced and presented programmes for TV and radio, picked up a bunch of awards and continue being a contributing editor with PC Pro - the best selling IT magazine in the UK .