Full Disclosure mailing list archives

Previous By Date Next
Previous By Thread Next

Re: DLL hijacking with Autorun on a USB drive

From: Christian Sciberras <uuf6429 () gmail com>
Date: Wed, 1 Sep 2010 23:10:42 +0200
No one is saying there's no threat. It's the way people are going
about it that is doing the difference.

Patching the "vulnerable" application won't fix this whole issue.
Removing the feature from Windows core will, surely break a lot of programs.

Truth is, that dll shouldn't have been in that network share in the first place.
And that's the whole difference between Unix-like and Windows.
Once something gets into Windows, by design, you are allowing a great
deal of access.
Ok, as of late they did strides in securing this area, but it wasn't
designed this way.

The focus should be on keeping that darn dll out of your trusted zone,
not what to do with it when it is inside.

As the saying goes, prevention is better than cure.


Cheers,
Chris.



On Wed, Sep 1, 2010 at 9:47 PM, matt <matt () attackvector org> wrote:

 And yeah, I find it a joke that you think that ".ppt.exe" isn't pretty



damn obvious.



I might have fell for that when I was 9, but I haven't had a problem
with a windows box in years.



I will admit, at 3AM when I've been working for 18 hours and awake for
36, it is possible that I may double-click
such a malicious file and then immediately think "OH shit" and rebuild.


Thats the real threat of this, to be honest.  Yes, you, me, and (hopefully)
the rest of the people on this list know what to look for before clicking on
something.  But, > do you view a .doc, or .ppt, or .mp3 as malicious and
threatening as a .exe, .bat, or .vbs?  Probably not.

And, you cannot honestly tell me that you've never browsed to a network
share and opened a Word document.  And, if that Word document opens and
there's legitimate data being displayed (ie - it's the document that you
were expecting to open), would you ever consider that you just compromised
your system?

I think that's what a lot of you are missing.. there's no real trickery
involved; No changing of icons, no hiding extensions, no fake files.. a DLL
could be dropped into any directory containing Office documents and now each
one of those Office documents are, essentially, backdoored.  And, not only
that, but this is affecting file formats which were previously considered
benign or harmless (for the most part).

- matt

www.attackvector.org


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Previous By Date Next
Previous By Thread Next

Current thread: