How can mounting a USB stick on an AutoRun-disabled VM affect your host's BIOS? Honest question, I want to know.
Don’t lost track of the fact that USB is an acronym for
Universal Serial Bus. That device could contain any number of USB endpoints, each implementing a different device class. What if one of the endpoints identifies as a Human Interface Device — for example a keyboard — and injects a number of commands to the system? From the users perspective, invisibly. Or even deeper, a bridge device, giving it access to the underlying I2C bus - maybe even the SMB?
Yeah, but who is going to maintain the discipline required to ensure any potential infection does not spread from the separate PC to others in your stable?
There is the Yubikey which types for you like a USB keyboard. There is that Rubber Ducky, which types like a USB keyboard and can type like it was there at 100 words per second or something as fast as a keyboard will accept, such as Windows-R, CMD, and do any number of commands from the command prompt.
https://shop.hak5.org/products/usb-rubber-ducky-deluxeAs for virgin clean PC's, I used to (and still do) use something called Deep Freeze, reboot to restore thing. If the host computer it's installed on gets infected, before it can propagate any problems to the rest of the network (assuming you disconnected it physically from the rest of the network), you just reboot, and it's back as new, as if it was never updated.
Most malware is unaware of it's existence. It's great for setting up kiosks that provide internet access through regular browsers. At the end of the session, reboot, it's back to the way it was. If you need to update anything, reboot, turn it off, update, reboot, and it will stay that way.
In theory, it can still be hacked, but in practice it's as if the whole computer is one giant VM. Reboot, and it's back to the way it was yesterday.
If you need to save data or files or documents, you save them on a different drive or partition or folder designated as such. But the rest of the OS, reboot, and it goes back to the way it was.
Most linux distributions can be run on read-only filesystems (same as from cd) BUT the only true security hole is running them as root, because volumes can be remounted in rw mode on the fly. I'm using this strategy on my raspberryPi that is running the game console emulators for the kids. They don't do no shutdown, they just pull the plug/wallwart. Roms are stored on etx4 USB, mounted read-only. This one is just mounted in rw mode on the PC, to manage the roms and emulator binaries.
Just make sure you run linux as unprivileged user. Privilege escalation is a thing though, but unlikely on patched systems. However, when you're not connected to the net, i doubt there is a fair chance of catching a successful exploit via USB.