Hacker News Reader

Comment by jonathankoren | Hacker News Reader

>Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network.

I don't get why autorun was created. It's an obvious security issue.

View on HN

When Autorun, and Windows 95, were being developed, CD-Rs were multi-thousand dollar machines with media that cost $15+/disc, and USB was still being hashed out in the research labs. As such, the only real removable media that would have been used under Autorun would have been professionally mastered CDs, which had a $450+ minimum outlay for a master, and usually a minimum lot size atop of that, which was more than most people up to no good would have been willing to spend. Yes, as Autorun became a more viable attack vector, more protections should have been put in place, but in 1995, it was pretty low-risk.

> It's an obvious security issue.

Probably legitimately wasn't at the time! The general landscape and security issues and reasonable concerns just weren't the same.

Of course it's as clearly insane as giving pregnant women beer in maternity wards now, but wasn't at the time.

We already had viruses on DOS before CDs existed. The fact CDs supported autorun and Microsoft programmed Windows to have that feature on by default was mind-blowingly stupid and an obvious vector for viruses even at the time Windows 95 was new.

> We already had viruses on DOS before CDs existed.

But they weren't a credible threat that was significant enough to be worth worrying about.

We already have guns, but I don't do anything to protect myself against gun attack. It wouldn't be worth the time or effort or inconvenience for the level of threat. Maybe in thirty years we'll live in a dystopia and it'll be laughable that I went around unprotected against guns? But for today it's reasonable to ignore.

Convenience. Security is bothersome, anyways /s.

Reply on news.ycombinator.com