Re: [Full-disclosure] DLL hijacking with Autorun on a USB drive

On Aug 31, 2010, at 2:20 PM, Charles Morris <cmorris@xxxxxxxxxx> wrote:

On Tue, Aug 31, 2010 at 5:15 PM, Dan Kaminsky <dan@xxxxxxxxxxx> wrote:

Again, the clicker can't differentiate word (the document) from
word (the
executable). The clicker also can't differentiate word (the
document) from
word (the code equivalent script).

The security model people keep presuming exists, doesn't.

Even the situation whereby a dll is dropped into a directory of
documents --
the closest to a real exploit path there is -- all those docs can be
repacked into executables.


I can differentiate my coolProposal.doc from msword.exe just fine..

Uh huh. Here, let me go ahead and create 2010 Quarterly
Numbers.ppt.exe with a changed icon, and see what you notice.

If your statement is that the windows defaults should be changed,
including the "hide extensions" default, then I wholeheartedly agree
as I detailed in my first post. It's the first thing I turn off.

Many people who think the same way have considered that a
vulnerability in windows for years, I wouldn't consider it part of
the "DLL Hijacking" fiasco.

Imagine if the browser lock meant arbitrary code could run.

I find your faith in small collections of pixels hilarious.


Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Relevant Pages