Newsletter Archives

• Born, BleepingComputer: Malwarebytes fixes AdwCleaner, removing a DLL hijacking vulnerability

  Posted on December 20, 2019 at 08:42 CST by woody • Comment in the Forums

  Günter Born is at it again. This time he found a DLL hijacking vulnerability in Malwarebytes’ AdwCleaner 8.

  If Windows shows unwanted programs or displaying unwanted ads after installing software possible adware has been involved. In order to clean the system of this unwanted programs, the tool Malwarebytes AdwCleaner may be used (its free for private use)…

  When AdwCleaner runs with administrative permissions, the code from the loaded DLL files is also executed as a process with administrative permissions. Normally this works well, because Windows does not find the DLL files in the folder of the program and then searches in the Windows folders. But if a malware knows that a tool has a DLL hijacking vulnerability for certain DLLs, it only needs to store a file with the same name in the folder containing the application.

  Born notified Malwarebytes on Dec. 10 and they sent him a beta copy of a new version. That version also had a major DLL hijacking problem. Ultimately, Malwarebytes released a smarter version 8.0.1 without the security hole on Wednesday.

  There’s a detailed explanation of the vulnerability and its resolution in this Lawrence Abrams post on BleepingComputer.

  Antivirus Apps AdwCleaner, DLL hijacking

• Avoiding DLL Hijacks

  Posted on August 28, 2010 at 07:57 CDT by woody • Comment in the Forums

  I’ve come up with two common-sense ideas for avoiding DLL Hijack attacks.

  Nothing high-tech or fancy. No Registry changes that may break other apps. Just two simple tricks that will break every DLL Hijack exploit that I’ve seen to date.

  This is important because the number of reported DLL Hijack-able applications is hovering around 100, and it’ll go higher. If you run any of those apps – Word 2007 and PowerPoint 2007 and 2010 are among them – you’re susceptible to having your machine taken over by simply opening a file. Microsoft isn’t going to fix Windows to block the attacks – they can’t; the hole arises from a feature that’s part and parcel of the way Windows has worked from the beginning. The only way things will get better is when application manufacturers clean up their code. (And, yes, Microsoft is one of the companies with apps that exhibit exploitable behavior.)

  If you didn’t catch my original explanation of the DLL Hijack technique, start with my Infoworld Tech Watch article on the basics. Then to see how to protect yourself in two easy steps, see my Tech Watch article How to thwart the new DLL hijacks.

  Windows Patches/Security DLL hijacking

• DLL hijacking

  Posted on August 25, 2010 at 16:02 CDT by woody • Comment in the Forums

  If you’re wondering what all the fuss is about, check out my Infoworld Tech Watch article.

  The sky isn’t falling, but the bad guys just got a potent new weapon.

  Windows Patches/Security DLL hijacking, PATH exploit