DLL hijacking with Autorun on a USB drive

[Dan Kaminsky]

h0h0h0.  There be history, Larry.
Short version:  Go see how many DLLs exist outside of c:\windows\system32.
Look, ye mighty, and despair when you realize all those apps would be broken
by CWD DLL blocking.

No, that's the too much shortened version.
The correct version but is: Go see how many DLLs exist outside of the DLL
search path.
CWD DLL blocking does NOT break all those apps!
Apps which install their DLLs into their own application directory won't
notice CWD blocking at all.
[HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\application.exe]
"Path"=...
exists for more than 15 years now.
Stefan

An automatic patch that breaks random apps will not be an automatic
patch -- and neither will the twenty patches after it.

Nobody cares that the breakage "can be fixed" with some fifteen year old key.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Larry Seltzer]

There's lots of ways for programmers to get this right, which is why
you're going to see a lot of patches coming out over a long period of
time. Forget the registry key, there's a SetDLLDirectory() API call
(http://msdn.microsoft.com/en-us/library/ms686203(VS.85).aspx ), although
it seems to me this should take a PATH-type string with multiple
directories rather than just one.

But since there's nothing Microsoft can impose without breaking lots of
apps, nothing systemic will be done. The fact that Microsoft is this
concerned about the number of apps that will be broken also illustrates
the extent of the problem, because each of those installations is likely
vulnerable.

-----Original Message-----
From: Dan Kaminsky [mailto:***@doxpara.com]
Sent: Tuesday, September 14, 2010 6:54 PM
To: Stefan Kanthak
Cc: Larry Seltzer; full-***@lists.grok.org.uk;
***@vt.edu
Subject: Re: DLL hijacking with Autorun on a USB drive

h0h0h0.  There be history, Larry.
Short version:  Go see how many DLLs exist outside of

c:\windows\system32.

Look, ye mighty, and despair when you realize all those apps would be broken
by CWD DLL blocking.

No, that's the too much shortened version.
The correct version but is: Go see how many DLLs exist outside of the DLL
search path.
CWD DLL blocking does NOT break all those apps!
Apps which install their DLLs into their own application directory won't
notice CWD blocking at all.
[HKLM\Software\Microsoft\Windows\CurrentVersion\App

Paths\application.exe]

"Path"=...
exists for more than 15 years now.
Stefan

An automatic patch that breaks random apps will not be an automatic
patch -- and neither will the twenty patches after it.

Nobody cares that the breakage "can be fixed" with some fifteen year old
key.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Stefan Kanthak]

h0h0h0. There be history, Larry.
Short version: Go see how many DLLs exist outside of c:\windows\system32.
Look, ye mighty, and despair when you realize all those apps would be broken
by CWD DLL blocking.

No, that's the too much shortened version.
The correct version but is: Go see how many DLLs exist outside of the DLL
search path.
CWD DLL blocking does NOT break all those apps!
Apps which install their DLLs into their own application directory won't
notice CWD blocking at all.

And apps which break can be easily fixed:

[HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\application.exe]
"Path"=...

exists for more than 15 years now.

Stefan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Stefan Kanthak]

... the user has opened the "bad" file ...

The victim "views" a "data" file, does not (directly) run an executable.
The data file could be as harmless as a Word document or a plain-text
file.

Word (resp. MS Office) documents ain't harmless: they may contain VBA
code.
Plain text files can be harmfull too: any *.pl, *.js, *.vbs, *.reg
which gets opened^Winterpreted by its associated application, not
just viewed in the editor, can cause havoc.
And it doesn't really matter whether the user double-clicks the file,
or starts the resp. application first and opens the file from there.

Stefan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[V***@vt.edu]

BTW: Windows developers and administrators should know their platform.

You're new here, aren't you? :)

Out in the real world, if they have a McSE cert and know enough to keep the
server running, they get the job even if they don't understand what some of
those mystical registry keys do. The sad fact of the matter is that there are
a *lot* of servers out there, and there simply aren't enough truly clued
experienced admins to run them all. So most of them limp along with an unclued
admin (who very well may be also acting as a secretary, or a junior designer,
or a tech writer or a grad student, and who really wants to get back to their
"real" job instead of futzing around with the server).