Windows DLL exploits boom; hackers post attacks for 40-plus apps
Publish exploits to subvert Firefox, Chrome, Word, Photoshop, Skype, dozens more
Computerworld - Some of the world's most popular Windows programs are vulnerable to attacks that exploit a major bug in the way they load critical code libraries, according to sites tracking attack code.
Among the Windows applications that are vulnerable to exploits that many have dubbed "DLL load hijacking" are the Firefox, Chrome, Safari and Opera browsers; Microsoft's Word 2007; Adobe's Photoshop; Skype; and the uTorrent BitTorrent client.
"Fast and furious, incredibly fast," said Andrew Storms, director of security operations for nCircle Security, referring to the pace of postings of exploits that target the vulnerability in Windows software. Called "DLL load hijacking" by some, the exploits are dubbed "binary planting" by others.
On Monday, Microsoft confirmed reports of unpatched vulnerabilities in a large number of Windows programs, then published a tool it said would block known attacks. The flaws stem from the way many Windows applications call code libraries -- dubbed "dynamic-link library," or "DLL" -- that give hackers wiggle room they can exploit by tricking an application into loading a malicious file with the same name as a required DLL.
If attackers can dupe users into visiting malicious Web sites or remote shares, or get them to plug in a USB drive -- and in some cases con them into opening a file -- they can hijack a PC and plant malware on it.
Even before Microsoft described the problem, published its protective tool, and said it could not address the wide-ranging issue by patching Windows without crippling countless program, researcher HD Moore posted tools to find vulnerable applications and generate proof-of-concept code.
The majority of the exploits published in the last 48 hours have been generated by Moore's auditing tool and the generic exploit module added to the open-source Metasploit penetration testing toolkit.
Several sites have taken to tracking the applications that people have found vulnerable, including an informal list kept by Peter Van Eeckhoutte, a Belgium IT manager, and a longer one of published proof-of-concept exploits maintained by Offensive Security, an online security training company.
Among the 40 exploits listed by Offensive were ones for several Adobe products, including InDesign, Illustrator and Photoshop; a number of Microsoft-made programs, including a pair that were revealed yesterday by Slovenian security firm Acros; and other popular applications, such as Foxit Reader, uTorrent and Wireshark.
As of 3 p.m. ET, more than 30 exploits had been posted on Wednesday alone.
The flood will likely continue: Yesterday, Moore updated his DLLHijackAuditKit to version 2, making it easier to use and quicker at identifying buggy programs.
"I don't recall seeing a list like that so quickly," said Marc Fossi, director of Symantec's security response team. "But at the same time I'm not surprised."
Fossi compared it to an earlier disclosure of a broad class of vulnerabilities that more than 10 years ago led to a large number of exploits in a short span of time. "It's like when format string errors were first discovered and you had all these apps being found that were vulnerable," Fossi said.
Format string vulnerabilities were long thought to be harmless, but in the late 1990s, researchers figured out how to exploit them to execute malware.
Moore had a different analogy in mind.
"The most recent example I can think of is the AxMan tool I released in 2006," said Moore in an e-mail reply to questions. "It resulted in hundreds of new ActiveX bugs and used a similar model of leveraging the security community at large to identify vulnerable applications."
AxMan was a Web-based fuzzing tool designed to find flaws in ActiveX controls, the widely-used and often-buggy add-on technology for Microsoft's Internet Explorer.
Moore believes that the rush of exploits will be a good thing in the end. "Overall, [AxMan] worked [and] ActiveX exploits sharply declined a few months after the tool's release and software vendors had an easy way to make sure they didn't repeat common mistakes," Moore said, referring to four years ago. "My hope is that having a quality assessment tool available for the DLL issue will lead to this being a non-issue in a few months."
Some developers, such as Wireshark and BitTorrent -- the latter maintains the uTorrent client -- have said they have fixes in the wings, and will update their software within days.
Microsoft, on the other hand, has declined to name vulnerable applications, even though researchers filed bug reports five months ago.
"Microsoft is analyzing its own applications to identify any that are affected by this new remote vector for DLL preloading attacks," Jerry Bryant, group manager with the Microsoft Security Response Center (MSRC), said in an e-mail Tuesday. "We will take appropriate actions to protect customers, which may include releasing security advisories with mitigations and workarounds and security updates to address the issue."
Until patches are available, Microsoft has urged users to download the free tool that blocks locks DLLs from loading from remote directories, USB drives, Web sites and an organization's network.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org.
Read more about Security in Computerworld's Security Topic Center.
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!