People are becoming even more tech illiterate.

I just checked a freshly installed Windows 11 and the autoplay is off by default.

So to follow up on the value of your question: People react loudly without checking what they react about. It's enough for them to get a few online upvotes in a world where they don't matter otherwise.

Because people in general want things to be 'easy' far more than they they care about security risks they don't understand. If they cared about security at all, they wouldn't be plugging random USB sticks into their computers in the first place.

You are remembering that the executable features of autorun.inf is disabled, which is still true. Autoplay (if enabled) as it exists currently only applies for discovered media file types and makes your default configured media player responsible for handling them. It would not be possible to execute arbitrary tasks unless you had an ACE exploit for the installed media player.

Think of it as a seatbelt. You don't plan on crashing your car, but shit happens. It's even possible a brand new USB drive from a "reputable" company could have something on it.

You forgot the lack of mental capacity in the average windows victim.

It's surprising how many people will plug in a random USB drive that they find. Apparently that's how the CIA got the Stuxnet virus into Iran's system and nerfed their centrifuges back in the day.

[rubber duckies intensify]

Usb killer: you guys do things with the computer?

There is also a registry hack for this but I have not looked into it or tested it. (And I agree with your sentiments re: Microsoft.)

Yep, plug it into your coworker's computer to test it first.

Two devices which can get handy for those:

https://usbkill.com/products/usbkill-shield

https://github.com/cecio/USBvalve

You can use ntfsfix on the drive to do a check and remove dirty bit. This isn’t a full check though, and could mask or hide actual issues with the drive if it’s failing.

There’s also chkntfs which is more robust but I’m not sure if that’s open source and I’m not familiar with it.

Using ntfsfix is a good quick fix in my experience, but at the end of the day, NTFS is a Microsoft exclusive format and shared disks should be mounted in a format that both OSes can use, like exFAT, or Btrfs with the WinBtrfs driver (the latter I’m not familiar with, I’ve always used exFAT for shared disks, but I don’t use Windows anymore).

Did you try to disable "Fast Startup" ?

By default, Windows does not do a real shutdown anymore. It closes the user session and hibernates, to speed up the following start up. As a consequence, the Windows partition (and EFI partition ?) are not properly unmounted.

If you have Windows, it might be worth getting it to run Scandisk - or whatever the current equivalent is - on that drive.

That would at least give it less excuse to set problematic bits. In theory there'd be no harm doing this. In practice, well, make sure you have other copies of whatever is on that drive on the off-chance Windows constantly setting that bit is a sign of an underlying problem that Scandisk would make worse (or Windows/the disk decides to mangle files for some other reason.)

95, and they disabled it circa Vista because it was obviously a stupid idea.

Ironically, this was originally only for drives that reported themselves as optical media (CD/DVD), but now modern versions of Windows actually won't autoplay an immutable commercially pressed CD, even if it has the correct autoplay.inf file on its root directory structure, but somehow it will autorun things on a flash drive which is a medium explicitly capable of being fucked with by a malicious actor.

Because that makes sense.

...with usbguard installed and configured with a default-deny policy.

Personally, I'm using Win10 'til it doesn't get security updates anymore.

Then I'll give Linux a go.