Ah, the Bruce Schneier blog comments have the very valuable comment: The removable media device setting is a flag contained within the SCSI Inquiry Data response to the SCSI Inquiry command. Bit 7 of byte 1 (indexed from 0) is the Removable Media Bit (RMB). A RMB set to zero indicates that the device is not a removable media device. A RMB of one indicates that the device is a removable media device. Drivers obtain this information by using the StorageDeviceProperty request.
So U3 is a different hardware spec, and U3 function can't be copied to non-U3 media. That's good. But the remarks about custom USB hardware there make me want to reach for the ol' glue gun! Of course, the real problem is still failure to adhere to least privilege. Thanks for the link, Bill. Henry Troup Watchfire Corporation [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Call Subject: RE: strange new virus I wouldn't be so sure about that. Check out: http://www.schneier.com/blog/archives/2006/06/hacking_compute.html --------------------------------------------------------------------------- ---------------------------------------------------------------------------
