Re: DLL hijacking with Autorun on a USB drive

[Dan Kaminsky <dan () doxpara com>]

On Fri, Aug 27, 2010 at 1:05 AM, <Valdis.Kletnieks () vt edu> wrote:

> On Thu, 26 Aug 2010 20:39:04 PDT, Dan Kaminsky said:
>
> > There may very well be a legitimate boundary cross from this DLL
> > stuff, but we haven't seen it yet. All the present stuff has the
> > indelible mark of a false boundary, in that no fix can be imagined
> > that actually closes the vector.
>
> Oh you're wrong there Dan.  I can imagine fixes that would close the
> vector (starting with fixes that impose a legitimate enforcable boundary).
>
> Fixes that will be accepted by Joe Sixpack? I think we saw where UAC ended
> up. :)

Hehe.  You start with the beginnings of imagining a fix.  Here, you say 'the
desktop will be aware of when it is launching content safe for viewing, vs.
dangerous, and will behave differently'.  Eventually you realize:

1) You have to build this database
2) You have to maintain this database, even in the face of third party apps
adding handlers
3) You have to determine what the differential behavior is going to be on a
safe vs. unsafe type

And it's in the middle of 3) that you end up...well...where UAC ended up :)

Again, let me emphasize.  Really interesting vector, will probably end up
attached to an unambiguous flaw.  But right now, we're just seeing flaws
along the lines of "Double clicking an icon in Explorer might execute
arbitrary code".  It doesn't matter that that's true even if there's a
network share, or a USB stick.  That's what Explorer *does*.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/