full-disclosure - Re: DLL hijacking with Autorun on a USB drive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4AF648D23C9547A0A956D0E9F36B2A25@localhost>
Date: Wed, 15 Sep 2010 00:07:07 +0200
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: "Dan Kaminsky" <dan@...para.com>, "Larry Seltzer" <larry@...ryseltzer.com>
Cc: full-disclosure@...ts.grok.org.uk, Valdis.Kletnieks@...edu
Subject: Re: DLL hijacking with Autorun on a USB drive

Dan Kaminsky wrote:

> h0h0h0.  There be history, Larry.
>
> Short version:  Go see how many DLLs exist outside of c:\windows\system32.
> Look, ye mighty, and despair when you realize all those apps would be broken
> by CWD DLL blocking.

No, that's the too much shortened version.
The correct version but is: Go see how many DLLs exist outside of the DLL
search path.
CWD DLL blocking does NOT break all those apps!
Apps which install their DLLs into their own application directory won't
notice CWD blocking at all.

And apps which break can be easily fixed:

[HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\application.exe]
"Path"=...

exists for more than 15 years now.

Stefan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/