CODEWITHSUNDEEP
dllloadlibrarydlopendll-injection
ooxi
ooxi

Reputation: 3329

How to protect against DLL Hijacking?

Every now and then security advisories are published, warning about the risks of DLL injection.

Is there a general way to protect against DLL hijacking? I'm not familiar with the topic but requesting an absolute filename instead of a relative should be enough to protect against malicious DLLs in the working directory, shouldn't it?

If one can overwrite the DLL in my installation directory, one could also overwrite my executable thus a signature check seams useless.

Upvotes: 0

Views: 1322

Answers (2)

CandleCoder
CandleCoder

Reputation: 1503

In DLL Hijacking If, instead of a relative path, programmers start using absolute path, the vulnerability will be reduced. Reading the absolute path, the Windows or any other operating system will not depend on system variables for path and will go straight for the intended DLL, thereby dismissing the chances of loading the same name DLL in a higher priority path. This method too, is not fail-proof because if the system is compromised, and the cybercriminals know the exact path of DLL, they will replace the original DLL with the fake DLL. That would be overwriting the file so that the original DLL is changed into malicious code. But again, the cybercriminal will need to know the exact absolute path mentioned in the application that calls for the DLL. The process is tough for cybercriminals and hence can be counted upon.

Upvotes: 1

Alex
Alex

Reputation: 21766

DLL hijacking can be achieved for apps that request an DLL without using an absolute path. This triggers a search process and by placing the compromised DLL higher in the search patch that the real version, it is possible to have execute malicious code. However, your installation directory should be first in the search path, so it does not seem to be applicable in your case. Nevertheless you should be careful when passing sensitive data to your DLL, for example passwords and usernames.

Upvotes: 1

Related Questions