A security report was received that went something like this: <\/p>\n
The XYZ application does not load its DLLs securely. Create a directory, say,
C:\\Vulnerable<\/code>, and copyXYZ.EXE<\/code> and a rogue copy ofABC.DLL<\/code> in that directory. WhenC:\\Vulnerable\\XYZ.EXE<\/code> is run, the XYZ program will load the rogue DLL instead of the official copy in the System32 directory. This is a security flaw in the XYZ program. <\/p><\/blockquote>\nRecall that the directory is the application bundle<\/a>, The fact that the
XYZ.EXE<\/code> program loads ABC.DLL from the application directory rather than the System32 directory is not surprising because the ABC.DLL has been placed inside theXYZ.EXE<\/code> program’s trusted circle. <\/p>\nBut what is the security flaw, exactly? <\/p>\n
Let’s identify the attacker, the victim, and the attack scenario. <\/p>\n
The attacker is the person who created the directory with the copy of
XYZ.EXE<\/code> and the rogueABC.DLL<\/code>. <\/p>\nThe victim is whatever poor sap runs the
XYZ.EXE<\/code> program from the custom directory instead of from its normal location. <\/p>\nThe attack scenario is <\/p>\n
\n
- Attacker creates a directory, say,
C:\\Vulnerable<\/code>. \ncopy C:\\Windows\\System32\\XYZ.EXE C:\\Vulnerable\\XYZ.EXE<\/code> \ncopy rogue.dll C:\\Vulnerable\\ABC.DLL<\/code> \n- Convince a victim to run
C:\\Vulnerable\\XYZ.EXE<\/code>. <\/ul>\nWhen the victim runs
C:\\Vulnerable\\XYZ.EXE<\/code>, the rogue DLL gets loaded, and the victim is pwned. <\/p>\nBut the victim was already pwned even before getting to that point! Because the victim ran
C:\\Vulnerable\\XYZ.EXE<\/code>. <\/p>\nA much simpler attack is to do this: <\/p>\n
\n
- Attacker creates a directory, say,
C:\\Vulnerable<\/code>. \ncopy pwned.exe C:\\Vulnerable\\XYZ.EXE<\/code> \n- Convince a victim to run
C:\\Vulnerable\\XYZ.EXE<\/code>. <\/ul>\nThe rogue
ABC.DLL<\/code> is immaterial. All it does is crank up the degree of difficulty<\/a> without changing the fundamental issue: If you can trick a user into running a program you control, then the user is pwned. <\/p>\nThis is another case of if I can run an arbitrary program, then I can do arbitrary things<\/a>, also known as MS07-052: Code execution results in code execution<\/a>. <\/p>\n
Note that the real copy of
XYZ.EXE<\/code> in the System32 directory is unaffected. The attack doesn’t affect users which run the real copy. And sinceC:\\Vulnerable<\/code> isn’t on the defaultPATH<\/code>, the only way to get somebody to run the rogue copy is to trick them into running the wrong copy. <\/p>\nIt’s like saying that there’s a security flaw in Anna Kournikova because people can create things that look like Anna Kournikova and trick victims into running it. <\/p>\n","protected":false},"excerpt":{"rendered":"
Constructing an insecure directory.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-45024","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"
Constructing an insecure directory.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/45024","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=45024"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/45024\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=45024"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=45024"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=45024"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}