full-disclosure - Re: Downloads Folder: A Binary Planting Minefield

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 22 Feb 2012 18:32:30 +0100
From: "ACROS Security Lists" <lists@...os.si>
To: <noloader@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com, cert@...t.org
Subject: Re: Downloads Folder: A Binary Planting Minefield

Hi Jeff, 

> I don't believe a PE/PE+ executable needs a DLL extension to 
> be loaded by LoadLibrary and friends.

True, any file can be loaded this way, but our pretty extensive experimenting showed
extremely few cases where legitimate applications (in this case mostly installers)
loaded anything other than <something>.dll. The operating assumption here is that the
initial executable (installer) is friendly but whatever it loads with LoadLibrary*
can be potentially malicious. The attacker can therefore not choose which file the
initial executable will load with LoadLibrary* but must plant a file that the
executable is already set to load.

> Perhaps a scanning/cleansing tool would be helpful.

Certainly. In the mean time, "del Downloads\*" is a free and efficient superset of
that ;-)

Cheers,
Mitja

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/