DLL hijacking issue prompts Microsoft advisory, tool

Powered by SC Magazine
 

"A new take on an old attack vector".

Microsoft is alerting the public about a new vector that can be used to infect PCs when an application is tricked into loading a malicious library.

The software giant issued the advisory this week after recent research revealed that a class of vulnerabilities known as "DLL (dynamic-link Library) preloading" can be exploited remotely by an attacker who places a malicious library on a network share, Christopher Budd, senior security response communications manager at Microsoft, said in a blog post. In the past, the attacker needed access to the local client system to perpetrate the exploit.

"In this [new] scenario, the attacker would create a data file that the vulnerable application would open, create a malicious library that the vulnerable application would use, post both of them on a network share that the user could access, and convince the user to open the data file," Budd wrote. "At that point, the application would load the malicious library and the attacker's code would execute on the user's system."

In addition to users disabling WebDAV and blocking outbound SMB (Server Message Block) traffic at the perimeter to prevent the threat, Microsoft released a tool that prevents the loading of libraries from network shares.

Andrew Storms, director of security operations at nCircle, a vulnerability management firm, called the threat a "new take on an old attack vector."

"Programs that are trying to load libraries may try to do so from an arbitrary directory, not a specific one," he told SCMagazineUS.com. "It's going to load the malware library as opposed to the library from Windows."

HD Moore, chief security officer of Rapid7, was among the first researchers to discover the issue, which he called DLL hijacking. Over the weekend, he posted exploit code as part of his open-source Metasploit hacking toolkit.

He said last week that 40 different Windows applications are susceptible to the attack. Now that the exploit is out, more and more researchers have claimed to discover vulnerable applications, including Windows Live Mail and PowerPoint.

"This vulnerability is triggered when a vulnerable file type is opened from within a directory controlled by the attacker," Moore wrote in a blog post. "This directory can be a USB drive, an extracted archive, or a remote network share. In most cases, the user will have to browse to the directory and then open the target file type for this exploit to work. The file opened by the user can be completely harmless. [T]he flaw is that the application launched to handle the file type will inadvertently load a DLL from the working directory."

Microsoft did not say whether any of its programs are vulnerable.

"We are currently conducting a thorough investigation into how this new vector may affect Microsoft products," Budd wrote. "As always, if we find this issue affects any of our products, we will address them appropriately."

Storms said organisations should play close attention to the issue — particularly whether any Microsoft products are vulnerable — and take the necessary mitigation steps, including educating users. However, they also should understand that a successful exploit is difficult to accomplish.

"It's not as easy as a click-a-link-and-be-owned kind of thing," he said. "Two steps of user interaction [are required]."

See original article on scmagazineus.com

Copyright © SC Magazine, US edition


DLL hijacking issue prompts Microsoft advisory, tool
 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
More 4G from Optus in Darwin
Nov 21, 2014
Click to see where Optus has expanded coverage to the suburbs near Darwin.
Optus steps up regional 4G coverage
Nov 20, 2014
Once 700Mhz services are working, Optus claims regional users will have a "faster and more ...
This Huawei 4G phone costs $99
Nov 12, 2014
The $99 Huawei Ascend Y550, available through Vodafone, enters the budget market as one of the ...
4G smartphones: Microsoft's Lumia 830
Nov 7, 2014
Microsoft has announced its flagship Windows Phone, the Nokia Lumia 830 4G, will be available in ...
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  4%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1766

Vote
Do you support the abolition of the Office of the Information Commissioner?