full-disclosure - Re: DLL hijacking with Autorun on a USB drive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 1 Sep 2010 23:10:42 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: matt <matt@...ackvector.org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: DLL hijacking with Autorun on a USB drive

No one is saying there's no threat. It's the way people are going
about it that is doing the difference.

Patching the "vulnerable" application won't fix this whole issue.
Removing the feature from Windows core will, surely break a lot of programs.

Truth is, that dll shouldn't have been in that network share in the first place.
And that's the whole difference between Unix-like and Windows.
Once something gets into Windows, by design, you are allowing a great
deal of access.
Ok, as of late they did strides in securing this area, but it wasn't
designed this way.

The focus should be on keeping that darn dll out of your trusted zone,
not what to do with it when it is inside.

As the saying goes, prevention is better than cure.

Cheers,
Chris.

On Wed, Sep 1, 2010 at 9:47 PM, matt <matt@...ackvector.org> wrote:
>> And yeah, I find it a joke that you think that ".ppt.exe" isn't pretty
>
>> damn obvious.
>
>> I might have fell for that when I was 9, but I haven't had a problem
>> with a windows box in years.
>
>> I will admit, at 3AM when I've been working for 18 hours and awake for
>> 36, it is possible that I may double-click
>> such a malicious file and then immediately think "OH shit" and rebuild.
>
> Thats the real threat of this, to be honest.  Yes, you, me, and (hopefully)
> the rest of the people on this list know what to look for before clicking on
> something.  But, > do you view a .doc, or .ppt, or .mp3 as malicious and
> threatening as a .exe, .bat, or .vbs?  Probably not.
>
> And, you cannot honestly tell me that you've never browsed to a network
> share and opened a Word document.  And, if that Word document opens and
> there's legitimate data being displayed (ie - it's the document that you
> were expecting to open), would you ever consider that you just compromised
> your system?
>
> I think that's what a lot of you are missing.. there's no real trickery
> involved; No changing of icons, no hiding extensions, no fake files.. a DLL
> could be dropped into any directory containing Office documents and now each
> one of those Office documents are, essentially, backdoored.  And, not only
> that, but this is affecting file formats which were previously considered
> benign or harmless (for the most part).
>
> - matt
>
> www.attackvector.org
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/