Microsoft still mum on programs prone to DLL hijacking attacks
Instead, it offers automated tool to simplify attack blocking setup
Computerworld - Microsoft on Tuesday again abstained from naming which of its Windows programs, if any, contain bugs that could lead to widespread "DLL load hijacking" attacks.
Also on Tuesday, the company published an automated tool to make it easier for users to block attacks exploiting vulnerabilities in a host of Windows applications.
The DLL load hijacking vulnerabilities exist in many Windows applications because the programs don't call code libraries -- dubbed "dynamic-link library," or "DLL" -- using the full pathname, but instead use only the filename. Criminals can exploit that by tricking the application into loading a malicious file with the same name as the required DLL. The result: Hackers can hijack the PC and plant malware on the machine.
"Microsoft plans to address those of our products affected by this issue in the most appropriate way for customers," said Jerry Bryant, a group manager with the Microsoft Security Response Center, in a Tuesday entry on that team's blog. "This will primarily be in the form of security updates or defense-in-depth updates."
Although Microsoft again declined to call out its vulnerable software, outside researchers have identified as potential targets a number of its high-profile apps, including Word 2007, PowerPoint 2007 and 2010, Address Book and Windows Contact, and Windows Live Mail.
Other vendors' software may also be at risk, including Mozilla's Firefox, Google's Chrome, and Adobe's Photoshop.
Bryant hinted that some Microsoft software could be exploited. "Due to the fact that customers need to click through a series of warnings and dialogs to open a malicious file, we rate most of these vulnerabilities as Important," he said, referring to the second-highest threat ranking in the company's four-step scoring system.
Microsoft typically uses Important to describe bugs that can be exploited remotely -- via the Internet or e-mail, for example -- but which also require that the user assist the attack in some way, usually by clicking through warnings or opening a malicious file.
That tool blocks the loading of DLLs from remote directories, such as those on USB drives, Web sites and an organization's network, and is aimed at enterprise IT personnel.
Not surprisingly, Microsoft acknowledged that users have asked for more help with the tool. Shortly after its release, IT professionals complained that the tool was confusing and asked colleagues for advice on how to configure it.
To simplify things, Microsoft has posted a "Fix It" tool on its support site that automatically blocks any DLLs from loading from WebDAV or SMB (Server Message Block) shares, two of the most likely attack vectors. Users must still download and install the original tool, however.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts