full-disclosure - Re: DLL hijacking with Autorun on a USB drive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTi=0Z6XQTFpGevWwwCvSbnN5xfZixykiVefmAXaF@mail.gmail.com>
Date: Fri, 27 Aug 2010 01:29:32 -0400
From: Dan Kaminsky <dan@...para.com>
To: Valdis.Kletnieks@...edu
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: DLL hijacking with Autorun on a USB drive

On Fri, Aug 27, 2010 at 1:05 AM, <Valdis.Kletnieks@...edu> wrote:

> On Thu, 26 Aug 2010 20:39:04 PDT, Dan Kaminsky said:
>
> > There may very well be a legitimate boundary cross from this DLL
> > stuff, but we haven't seen it yet. All the present stuff has the
> > indelible mark of a false boundary, in that no fix can be imagined
> > that actually closes the vector.
>
> Oh you're wrong there Dan.  I can imagine fixes that would close the
> vector (starting with fixes that impose a legitimate enforcable boundary).
>
> Fixes that will be accepted by Joe Sixpack? I think we saw where UAC ended
> up. :)
>

Hehe.  You start with the beginnings of imagining a fix.  Here, you say 'the
desktop will be aware of when it is launching content safe for viewing, vs.
dangerous, and will behave differently'.  Eventually you realize:

1) You have to build this database
2) You have to maintain this database, even in the face of third party apps
adding handlers
3) You have to determine what the differential behavior is going to be on a
safe vs. unsafe type

And it's in the middle of 3) that you end up...well...where UAC ended up :)

Again, let me emphasize.  Really interesting vector, will probably end up
attached to an unambiguous flaw.  But right now, we're just seeing flaws
along the lines of "Double clicking an icon in Explorer might execute
arbitrary code".  It doesn't matter that that's true even if there's a
network share, or a USB stick.  That's what Explorer *does*.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/