New .lnk type vulnerability

Yes - any executable file can be packed within another file. Easy to do with MS Office documents.

See:

Microsoft Office Security, part one
http://www.symantec.com/connect/articles/microsoft-office-security-part-one

Dangerous document formats and social engineering
http://isc.sans.org/diary.html?storyid=2528

DLLs haven't been used (that I know of) because it seems easier to use other types of executables.

----
rich

 

Thanks for that info Rmus... and would applocker stop the dll/executable (i haven't implemented dll rules)?
More importantly, do avtivirus software identify rogue dlls (such as those used in this sort of attack) as viruses?

 

I don't use Applocker, so I can not answer. There is an Applocker thread somewhere...

There has been just one report of this exploit in the wild last week, but nothing was said about the DLL:

Microsoft unpatched DLL load hijacking exploit is in wild
http://news.techworld.com/security/...ll-load-hijacking-exploit-is-in-wild/?olo=rss


----
rich

 

Alert: MS Fixit for New .lnk type vulnerability

Microsoft ships 'Fix-It' for DLL load hijacking attack vector
Knowledge Base Article

 

Yes and yes.

 

Even if i haven't implemented dll rules?? That has to be great..

 

One has to implement the DLL rules to potentially block DLLs.

 

DLL Hijacking expands to EXE files
Clearing up Some Misconceptions About Binary Planting
Online Binary Planting Exposure Test

 

Is this of any use?
http://www.computerworld.com/s/arti..._hijacking_attacks?taxonomyId=17&pageNumber=1

 

It's interresting to know that this scenario of a dll or exe embedded in office format would be a fail for SRP which can't separate office from the embedded objects.

AppLocker can, as it works at kernel level and correctly identifies the different processes.

 

It's quite annoying to see that most developers aren't minimally interested in solving such.

http://secunia.com/advisories/windows_insecure_library_loading/

I wonder when laws will start to exist forcing software developers, first to put in the market not so buggy applications, and then, according to the difficulty of fixing security bugs, penalise them accordingly, if they don't fixed them within a given time.

Unfortunately, all it takes is for software developers to introduce an EULA, where you pretty much agree that if problems do happen, it's your own problem.

 

Indeed it is, thanks

 

Binary Planting Attack Vectors

Opening a Can of Binary Planting Worms: Binary Planting as Worm Propagation Method

 

Evidently, a properly configured application firewall will alert at the attempted connection to a remote shared folder:

 

Sure, but people keep chiming in saying personal firewalls are useless and/or easily bypassed by most malware , even though you seem to prove over and over again that's not necessarily true.

 

@ MrBrian

Thanks for the links

@ Rmus

So you are vulnerable but your setup blocked it

I got various errors and realised because i either don't have some of those things and/or i have disabled them i'm not vulnerable And that's running XP/SP2 with less than half a dozen updates

Good test though for others to try

 

http://www.physorg.com/news205050403.html or http://economictimes.indiatimes.com...rweapon-attacks-China/articleshow/6658468.cms

 

Breaking The SetDllDirectory Protection Against Binary Planting: The curious case of Windows environment variables or how to re-hack fixed iTunes and Safari