full-disclosure - Re: Downloads Folder: A Binary Planting Minefield

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKCnhM4JBzoZSVMf88=HzKv2ryjEe9vcRvP83qKdXu1zDeATnQ@mail.gmail.com>
Date: Wed, 22 Feb 2012 16:50:24 -0800
From: Nate Theis <nttheis@...il.com>
To: security@...ossecurity.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Downloads Folder: A Binary Planting Minefield

Hmm, interesting AV evasion technique: Seemingly legitimate app, but the
download page gives both a malicious DLL and the main executable, the main
executable uses LoadLibrary insecurely.
On Feb 22, 2012 9:33 AM, "ACROS Security Lists" <lists@...os.si> wrote:

> Hi Jeff,
>
> > I don't believe a PE/PE+ executable needs a DLL extension to
> > be loaded by LoadLibrary and friends.
>
> True, any file can be loaded this way, but our pretty extensive
> experimenting showed
> extremely few cases where legitimate applications (in this case mostly
> installers)
> loaded anything other than <something>.dll. The operating assumption here
> is that the
> initial executable (installer) is friendly but whatever it loads with
> LoadLibrary*
> can be potentially malicious. The attacker can therefore not choose which
> file the
> initial executable will load with LoadLibrary* but must plant a file that
> the
> executable is already set to load.
>
> > Perhaps a scanning/cleansing tool would be helpful.
>
> Certainly. In the mean time, "del Downloads\*" is a free and efficient
> superset of
> that ;-)
>
> Cheers,
> Mitja
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/