Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Security Software

Researcher Finds Tens of Software Products Vulnerable To Simple Bug (softpedia.com) 162

An anonymous reader writes: There's a German security researcher that is arduously testing the installers of tens of software products to see which of them are vulnerable to basic DLL hijacking. Surprisingly, many companies are ignoring his reports. Until now, only Oracle seems to have addressed this problem in Java and VirtualBox. Here's a short (probably incomplete) list of applications that he found vulnerable to this attack: Firefox, Google Chrome, Adobe Reader, 7Zip, WinRAR, OpenOffice, VLC Media Player, Nmap, Python, TrueCrypt, and Apple iTunes. Mr. Kanthak also seems to have paid special attention to antivirus software installers. Here are some of the security products he discovered vulnerable to DLL hijacking: ZoneAlarm, Emsisoft Anti-Malware, Trend Micro, ESET NOD32, Avira, Panda Security, McAfee Security, Microsoft Security Essentials, Bitdefender, Rapid7's ScanNowUPnP, Kaspersky, and F-Secure.
This discussion has been archived. No new comments can be posted.

Researcher Finds Tens of Software Products Vulnerable To Simple Bug

Comments Filter:
  • by Teun ( 17872 )
    The obvious question is; what's a DLL?
    • Re:What's a DLL? (Score:4, Informative)

      by Anonymous Coward on Monday February 08, 2016 @03:17PM (#51464309)

      Dynamic linked library

      • "Windows Dynamic Linked Library" in this case... not seeing a single mention of Linux or OSX in there.

        (Yes, there are equivalents in Linux and OSX, but no indication of the vuln in shared libs, dylibs, or dynamic shared libs, so...)

    • Re:What's a DLL? (Score:5, Informative)

      by Archangel Michael ( 180766 ) on Monday February 08, 2016 @03:18PM (#51464319) Journal

      Dynamic Link Library. Typically a shared resource that can be dynamically loaded and unloaded when needed, and often shared among programs.

      The problem with DLLs are that there are many versions of the same DLL that often need to run at the same time. Which means that you can substitute one version for another, and hijack a program. Nothing new here.

      • Nothing new here.

        And that's the point, right? It's nothing new yet some vendors with some very widely distributed software still have the vulnverability.

        • Re:What's a DLL? (Score:4, Informative)

          by Archangel Michael ( 180766 ) on Monday February 08, 2016 @03:22PM (#51464355) Journal

          Nothing new, because it is how Windows was designed from the early days.

          • Re:What's a DLL? (Score:5, Informative)

            by GIL_Dude ( 850471 ) on Monday February 08, 2016 @03:56PM (#51464621) Homepage
            Although it is very true that it is how windows was designed from the early days, modern versions of windows do have protections against loading DLLs from network locations that applications simply have to opt in to. For those that are designed to be locally installed to have NOT adopted those defenses is just like not bothering to enable ASLR (Address Space Layout Randomization), or other security measures. These applications should be updated to use the protections. Here's info on how to make the updates to applications: https://msdn.microsoft.com/lib... [microsoft.com]
            • Why implement it ? That sounds like too much work!

            • I would say that Microsoft could improve on desktop applications by giving them their own namespace or user space (a la Android) but instead they now call these "legacy apps" and have the unrealistic expectation that you use universal apps which do have these protections.

              I say unrealistic because universal apps don't have anywhere near the capability set that you can get with "legacy apps", and there's no reason to write new desktop applications anymore because typically the best way to deliver your applica

        • That's because it's only a vulnerability in retrospect -- it was intended as a feature.

          (Linux shared libraries -- the fact that every application can use the same copy of, say, GTK instead of having to replicate it -- are the same kind of deal.)

          I haven't read the article, but I suppose the countermeasure is that DLLs should be signed or have hashes checked before loading or something like that.

          • Re:What's a DLL? (Score:4, Informative)

            by TapeCutter ( 624760 ) on Monday February 08, 2016 @06:41PM (#51465737) Journal
            There is no "bug" with the installers or windows, the machine has been compromised prior to running the software.

            TFA is a "beat up" (likely paid for by Oracle), it does not explain how the attacker is able to put the compromised dll on the machine in the first place. If an attacker can put a random binary on your local drive then they already own your machine. What a random installer subsequently does on a compromised machine is irrelevant to how the machine was hacked.

            Car analogy: If a miscreant cuts your brake line without your knowledge, it is not the manufacturer's fault that the brakes no longer work as advertised. If the manufacturer's can make it more difficult to cut the brake line that's great, but they cannot, and should not, be held accountable for malicious damage caused by someone who had unrestricted access to your brake line.
            • by Bert64 ( 520050 )

              Some browsers will auto save files to the designated downloads location, a malicious website can exploit this feature to get a dll into your downloads directory. If you then execute an installer from the same directory then you can be infected.
              Getting a file into your downloads directory is not a compromise as the file has not been executed, and on other platforms the presence of malware in your download directory is harmless unless you actually go out of your way to execute it.

              • by godefroi ( 52421 )

                Uh, if my browser silently downloads (executable!) files without me knowing, yeah, that's a compromise.

            • > If an attacker can put a random binary on your local drive then they already own your machine

              Pretty much no.

              >If a miscreant cuts your brake line without your knowledge,

              Terrible analogy. Because it's not what's occurring here. They don't have unrestricted access to critical systems on your car. It's more like they put a brake line cutting machine in your front seat. It's not until you get into the car and say "Are you sure you want to run the program START CAR with administrative access" that your li

          • Just but in Windows the LD_LIBRARY_PATH analog always includes the current working directory and application directory and a lot of applications have come to depend on that.
            This (binary planting) is also the reason why everybody on Linux warns you about setting PATH to include CWD, of if you really have to to append it at the back.
      • by Gr8Apes ( 679165 )

        The problem with DLLs are that there are many versions of the same DLL that often need to run at the same time. Which means that you can substitute one version for another, and hijack a program. Nothing new here.

        If only it were as benign as that. You can even inject DLLs into a system process, and then have code executed as that process unless things have changed dramatically in the past 4 years.

        • by deKernel ( 65640 )

          I can see this _IF_ the code already attempts a manual load call to the runtime, but I have never seen a method to force an unintended DLL to be loaded into a process space unless the originating binary is modified.

          • Re:What's a DLL? (Score:5, Informative)

            by mhotchin ( 791085 ) <slashdot&hotchin,net> on Monday February 08, 2016 @06:52PM (#51465795)

            Literally the FIRST hit on Google leads to this:
            https://en.wikipedia.org/wiki/... [wikipedia.org]

            tl;dr - it's not really a problem to force an arbitrary process to load a DLL, *if you are an administrator*. As noted elsewhere though, if you have the power to inject, you already owned the machine, so why bother?

          • on linux and the like, you can use LD_LIBRARY_PATH to change to a different shared object. This is often preferable or required (assuming you can't recompile and change the rpath, like with binary blobs). How is this news?
            • by KGIII ( 973947 )

              Just earlier today, I ran this very command:

              sudo ln -sf /lib/$(arch)-linux-gnu/libudev.so.1 /lib/$(arch)-linux-gnu/libudev.so.0

              I did not read the article but the above command not only was acted on - it had the effect I wanted. I better go file a bug report!

        • The "problem" here is that the machine was compromised before the installers are executed. Yes, you could make a more secure installer that fingerprints the dlls it uses, but that doesn't solve the root problem. The root problem is a compromised machine.
          • by Gr8Apes ( 679165 )
            I don't think you quite get the seriousness of the issue. It boils down to if you have access to a windows box where you can create and execute a file on it, you can own the box relatively trivially regardless of your privileges. This is why MS always appears to have whack-a-mole security patches. If you look at the CVEs over time, you'll start to think you're Bill in Groundhog day.
    • Re:What's a DLL? (Score:4, Informative)

      by Anonymous Coward on Monday February 08, 2016 @03:19PM (#51464321)

      Dynamic-link library (also written unhyphenated), or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems. These libraries usually have the file extension DLL, OCX (for libraries containing ActiveX controls), or DRV (for legacy system drivers). The file formats for DLLs are the same as for Windows EXE files – that is, Portable Executable (PE) for 32-bit and 64-bit Windows, and New Executable (NE) for 16-bit Windows. As with EXEs, DLLs can contain code, data, and resources, in any combination.

      https://en.wikipedia.org/wiki/Dynamic-link_library

    • Re:What's a DLL? (Score:5, Insightful)

      by lesincompetent ( 2836253 ) on Monday February 08, 2016 @03:20PM (#51464331)
      The obvious questions are:
      - Why are you here?
      - Why the semicolon?
    • Do you even have a geek card to turn in? You've never heard of "DLL Hell"? WIll wonders never cease...

      • by Goaway ( 82658 )

        Some people using the site now were probably not even born when "DLL hell" was still something that was actually a problem, rather than just a term that Slashdotters parroted.

        • Some people using the site now were probably not even born when "DLL hell" was still something that was actually a problem, rather than just a term that Slashdotters parroted.

          That would mean people who haven't been born yet. Revo uninstaller to the rescue

        • Re:What's a DLL? (Score:4, Interesting)

          by TapeCutter ( 624760 ) on Monday February 08, 2016 @07:01PM (#51465855) Journal
          It's no longer a problem with MS libraries but it can still be a problem with third party dll's, the problem is not that different to having symlinks point to multiple versions of an .so file in unix. In both cases it works when done correctly, but it's easy to get the wires crossed if you're not careful.
      • by Teun ( 17872 )
        Woosh muh?
      • Do you even have a geek card to turn in?

        Teun's geek card has a 5 digit uid, licensed for advanced deadpan sardonic commenting.

        Yours is 4 digit? Damn, you might have to retake your sarcasm detection certification.

    • by Anonymous Coward

      It's like cheese. If You wanna a sandwish You use already made cheese and don't need to milk a cow, then process the milk to turn into cheese. To me, 99.99% of anything is cheesy, unless it's not developed by me. That's explains the good cheese in the market from my perspective.

    • by Anonymous Coward

      I have asked my Hyderabad team to investigate this problem and they have reported back to me that JDBC is a fix for it.

      Can anyone confirm if JDBC is a fix for this DLL problem?

      How would a Java database connectivity layer fix this if it's a problem with a C++ program interacting with a C++ DLL?

      • by Matheus ( 586080 )

        You should immediately discontinue using this team...

        Token car analogy:
        Q: "There is a problem with the ignition system in my car. Please investigate!"
        A: "Tires will fix your problem! Get Tires!"

    • Re:What's a DLL? (Score:4, Informative)

      by mikael ( 484 ) on Monday February 08, 2016 @05:11PM (#51465093)

      Dynamic Link Library or Shared Object. In the early days of UNIX, it was found that the huge amount of space was being used by GUI applications and command line programs statically linked to common libraries like standard IO, sockets, X-windows, GUI's, maths and crypto libraries. Huge amounts of disk space were being used to stored duplicate copies of compiled code. So they figured that it would be more cost effective to dynamically link at run-time instead of a compile-time with the bonus that they could be compiled into relocatable code only loaded into system when needed.

      If you run "ldd" on a program, you will see all the libraries needed for that program.

      By separating the library files from the applications, any bugs or problems could be fixed through a simple upgrade. The downside is that someone can rootkit a system by replacing a DLL used by applications that need system access.

    • You may incinerate your geek card. We don't even want it back.

    • The obvious question is; what's a DLL?

      ....and this ladies and gentlemen, are the coders we now have on /.

  • DLL Hijacking (Score:5, Informative)

    by Anonymous Coward on Monday February 08, 2016 @03:15PM (#51464303)

    There's an informative (and non-PDF) post on Fortinet's blog [fortinet.com] discussing DLL hijacking. You can use a registry tweak to harden a system against this technique.

  • by Anonymous Coward

    "UPDATE: Mr. Kanthak has told Softpedia that "most of the companies/vendors I contacted patched their products." Rapid7 went so far as to withdrew their ScanNow product altogether.

    "Some of the companies/vendors which did not reply to my reports in the first place contacted me after they became aware of the [public disclosure] posts and fixed their installers, or are working on a fix now," Mr. Kanthak also added.

    Additionally, there also some other software products for which Mr. Kanthak has not yet posted a

  • by Anonymous Coward

    If you have the ability to write a malicious DLL into a folder for the executable, you already have the ability to run administrator level code. Why bother with the DLL?

    cf: Raymond Chen

    • by tepples ( 727027 )

      I don't know how code signing verification policy works on Windows, but on OS X, Gatekeeper checks only an app's main executable for a signature against an Apple-issued code signing certificate, not other executables in the same folder that it loads.

      • by pr0fessor ( 1940368 ) on Monday February 08, 2016 @04:33PM (#51464855)

        In this case it would be up to the installer to verify that it is loading a valid library. The problem is if somehow a certain named and versioned dll can be downloaded to the same folder you execute the installer from it can execute arbitrary code when the installer initializes it using the elevated privileges you granted the installer.

        So in order to implement this side-loading you would to first need take advantage of another vulnerability to get that library in the right place.

        In order to protect against this they could simply not include the execution folder in the search path and validate the library in a manner other than just the name and version which can be faked.

        If someone where to try and exploit this chances are they would attempt to run their code in the background while leaving the rest of the library untouched so the installer would complete without tipping off the user. This means something as simple as a file size could validate there wasn't a bunch of extra code present, although there are better methods for validating a library.

         

    • by Anonymous Coward
      I could think of a real simple attack vector: Repackaged popular apps. Think... Um... I don't know... XcodeGhost: http://www.cultofmac.com/38970... [cultofmac.com]

      With Apple? A known good product (XCode) was replaced with a "changed" version. That changed version did "bad things".

      Now that you're following along... Put up versions of all the afflicted applications... with 'adjusted' DLLs. What's that? You need my permission to install that program that I just downloaded? Of course you do *clicks accept permission eleva
    • by bluefoxlucid ( 723572 ) on Monday February 08, 2016 @03:54PM (#51464605) Journal

      Actually, you only have to insert it into the current working directory. For example: Get a dll file downloaded into Downloads, then wait for the user to run Setup.exe and have UAC hand it admin privileges. Now your non-privileged process has put a DLL file in the Downloads directory *with* Setup.exe, which loaded Downloads\CommDlg32.dll and was granted Administrator access. Now you have admin access.

      Microsoft Word used to do this if you had a DLL file with the same name as a System32 DLL in the same path as a Word document.

    • by nmb3000 ( 741169 ) <nmb3000@that-google-mail-site.com> on Monday February 08, 2016 @05:12PM (#51465103) Journal

      If you have the ability to write a malicious DLL into a folder for the executable, you already have the ability to run administrator level code. Why bother with the DLL?

      cf: Raymond Chen

      Exactly. Raymond covered this a few times in the past.

      Using delayload to detect functionality is a security vulnerability [microsoft.com]
      It rather involved being on the other side of this airtight hatchway: Disabling Safe DLL searching [microsoft.com]

      If Safe DLL Search Mode is enabled, then the Current Directory isn't searched until after all the system directories are searched. Safe DLL search mode is enabled by default starting with Windows XP with Service Pack 2 (SP2). [microsoft.com]

      This sounds like a complete non-story.

      • The issue for installers is that "the directory from which the application loaded" is the Downloads directory, not somewhere secure like c:\program files. This directory, which is not necessarily the current directory, is still first in the search order even when Safe DLL Search Mode is enabled.
  • by MSG ( 12810 ) on Monday February 08, 2016 @03:24PM (#51464373)

    I'm aware of the Windows DLL load behavior, and how it creates "DLL Hell." I never thought of the security implications, because I assumed that Windows behaved more ... sanely.

    The root of the problem is that the affected applications are installers, which need to be run with elevated rights. On Linux systems, for example, when an application is run with escalated rights (through SUID or sudo), the dynamic library loader uses only the system library paths and ignores user specified paths (such as the LD_LIBRARY_PATH environment variable).

    Why the HELL doesn't Windows do the same for apps run as administrator?

    • by The MAZZTer ( 911996 ) <megazzt&gmail,com> on Monday February 08, 2016 @04:29PM (#51464839) Homepage

      MSDN documents guidelines for preventing malicious DLL loading [microsoft.com]. Windows has already cut off "current directory" forms of attacks by changing the DLL load order (called "Safe DLL Search Mode" in that document), and with Vista locking down Program Files for admin-only access, "application directory" attacks are also out unless apps intentionally install themselves elsewhere (then they're on their own). As for installers, users have to get tricked into downloading the DLL first, and at least Chrome gives you a big warning that the file is suspicious due to its extension. And if you can get the user to do that, you might as well just give them an EXE and skip the warning. It's easier to put together a malicious EXE too.

    • by StormReaver ( 59959 ) on Monday February 08, 2016 @04:31PM (#51464849)

      ...because I assumed that Windows behaved more ... sanely.

      After all these years, why the hell would you think that?

  • by Anonymous Coward on Monday February 08, 2016 @03:29PM (#51464423)

    DOZENS!

  • Can static linking on windows be done? I mean, Firefox, who cares? But products like truecrypt should be statically compiled, and require no resources from their operating system.

    • absolutely it can, it's usually just a question of setting the right flags in your IDE.. In these days of laptops with 16 gigs of RAM, it's the way to go for most things.
      • It does leave you permanently vulnerable to any flaws in the particular version of the library you linked against, or such is my understanding. At least with dynamic linking you can blame the user for not keeping up to date!

        I still static link though because whenever I upload something (using a video filtering plugin) at least one person won't have the right runtime installed at all.

        • by swb ( 14022 )

          It does leave you permanently vulnerable to any flaws in the particular version of the library you linked against, or such is my understanding.

          The assumption being that anyone (for most definitions of anyone) knows what DLLs their application loads and what the status of their patch levels are.

          I still static link though because whenever I upload something (using a video filtering plugin) at least one person won't have the right runtime installed at all.

          Which IMHO is the main mitigating factor -- what's the

    • That would make sense but there are two things to consider. First, you may be using a different compiler or even language all together for a dll versus your main application. Second, there are legal implications with OSS licenses when it comes to dynamic versus static linking.
  • Start learning security issues early on!

    Sounds to me after all of Slashdot's articles that many software teams don't have a coding security expert or security team or we wouldn't have all these flaws.

  • More than tens of software products are vulnerable to key loggers installed in keyboard cables. More than tens of software products are vulnerable to compromise when executed from compromised systems.

    Come on people fix your vulnerable software or we will publically slut shame you for your indifference.

  • Am I alone in thinking that if malicious code has admin level write access to system disks then you're already fubar?

    The horse is gone! Shut the barn door!

    • I'm going to simplify this a bit, but consider you download two things songlist.zip. You extract songlist.zip, which is a data. You don't execute anything in that download. You just extract it to your downloads folder and use notepad to open the resulting songlist.txt. You don't notice that it also included a file called netssl.ddl, which sits in your downloads folder.

      Later, you download mcafee_setup.exe. You run macafee_setup.exe, which needs to run as admin. mcafee_setup.exe makes use of netssl.dll. I

      • So as a user you downloaded a suspect binary but it's the OS that's at fault?

        It's certainly true that Windows sucks for this kind of issue, and always has, but there's only so much you can do to protect idiot users from themselves.

        • > So as a user you downloaded a suspect binary but it's the OS that's at fault?

          Yes, it's a security flaw in the OS. I should be able to download fdisk.exe (as an unprivileged user) without the OS running fdisk.exe /wipe c: (as admin). Downloading as a user shouldn't mean executing as admin.

  • This is slashdot. Unless you are being sarcastic about a click-baity site that we need to laugh at, "Simple Bug" is not a valid replacement for "DLL Hijacking" or, more descriptively, "DLL Side Loading" or "DLL replacement."

    You want to know what will make Slashdot better? Good headlines is a fantastic start. :-)

  • I know this is offtopic, but why the use of the word "tens" in the the summary? Perhaps it's a regional thing (western US here) but the term "dozens" seems much more natural to me. Unless you're talking about the very narrow range of 20-23 items i can't think of a good reason why "tens" would be preferred.
  • This doesn't seem like a very big vulnerability because it still requires the user to explicitly trust an installer to install executable code. Whether that code is an executable or a DLL that gets loaded into another application, once you've installed malicious software, you're screwed.
  • The problem is the practice of requiring admin privileges to install most software. Software should not require admin install unless they really need it. Common frameworks (which are a big user of DLLs) do exacerbate the problem since they often want to be installed in a root location so all the applications can share it.

    A solution is to forbid third parties from bundling installers for common framework runtime binaries. If the framework is needed, then either install the binaries in the application directo

  • by Anonymous Coward

    Guys! I discovered a new vulnerability in Windows:

    If you replace an executable with a different executable and then execute it, you actually execute the new executable and not the executable you replaced. Where should I submit my paper for publication?

  • I like shitting on Windows apps as much as the next guy, but if you can replace a library on the drive, aren't you just going to like... win? Maybe there's more protection on real systems, but it's a binary that gets run with the permissions and privileges of whatever is running it. Can someone explain to me how this is a larger concern, and what was done to patch the security of this?

    It stands to reason that if you can overwrite a dll, you can overwrite a lot of stuff, same as with an .so or something.

  • That's a lot of name-dropping. Wonder if said researcher asked for a bit of hush money and if you paid up you were taken off the list? Smear campaigns for cash are hardly new.

"Irrigation of the land with sewater desalinated by fusion power is ancient. It's called 'rain'." -- Michael McClary, in alt.fusion

Working...