Wednesday, November 6, 2024
HomeCyber Security NewsNew DLL Hijacking Technique Let Attackers Bypass Windows Security

New DLL Hijacking Technique Let Attackers Bypass Windows Security

Published on

Malware protection

DLL hijacking is a technique where a malicious DLL (Dynamic Link Library) is placed in a directory that a vulnerable application searches before the legitimate one. 

When the application is launched, it unknowingly loads the malicious DLL instead, allowing attackers to:-

  • Execute arbitrary code
  • Compromise the system

Recently, the cybersecurity researchers at a multi-layered incident response company, Security Joes, discovered a new DLL hijacking technique that enables threat actors to bypass Windows mechanisms.

- Advertisement - SIEM as a Service

New DLL Hijacking Technique

This new technique exploits trusted WinSxS executables using DLL Search Order Hijacking. 

This enables threat actors to execute malicious code within Windows folders, which eliminates the need for extra binaries. 

Besides this, it’s compatible with both Windows 10 and 11, as it bypasses high privilege requirements.

The DLL Search Order Hijacking exploits how Windows apps load DLLs, taking advantage of those without specified file paths. 

Threat actors manipulate apps depending on predefined search orders that place a malicious DLL in a prioritized directory. 

Many methods for this require apps not to specify full paths, often due to development oversights.

Knowing how Windows loads DLLs and executables is one of the key things, and the system follows a sequence during the loading process.

This ensures efficient operation by locating necessary components like DLLs. Not only that even, it also provides an alternative method for finding resources.

Besides this, the Windows OS flow for searching and loading resources includes the following things:-

  • Application’s launch directory
  • C:\Windows\System32
  • C:\Windows\System
  • C:\Windows
  • Current working directory
  • Directories in the system’s
  • User’s PATH variables

Exploiting the loading process lets threat actors inject unauthorized code into the trusted processes, which helps in deceiving the:-

  • Security tools
  • Security experts/analysts

This new malicious technique is completely sophisticated and stealthy as it enables threat actors to achieve several types of malicious goals like:-

  • Compromise systems
  • Evade detection

The WinSxS folder is a critical component in Windows OS at “C:\Windows\WinSxS.” This vital component crucially maintains multiple versions of system files. 

Not only that even, it also preserves previous versions during updates, which causes the folder to grow with each update for the Windows operating system.

Execution flow of the DLL Search Order Hijacking
Execution flow of the DLL Search Order Hijacking (Source – Security Joes)

Here below, we have mentioned all the key purposes of the WinSxS folder:-

  • Version Management
  • System Integrity
  • Dynamic Activation

Advantages New DLL hijacking technique

Here below, we have mentioned all the key advantages of this new DLL hijacking technique:-

  • Circumventing High Privilege Requirements
  • Eliminating the Need for Additional Binaries
  • Enhancing Stealth

PoC

Here below, we have mentioned the Proof-of-Concept video:-

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

ToxicPanda Banking Malware Attacking Banking Users To Steal Logins

Recent research has uncovered a new strain of malware developed for Android devices, initially...

Azure API Management Vulnerabilities Let Attackers Escalate Privileges

Recent discoveries by Binary Security have revealed critical vulnerabilities in Azure API Management (APIM) that could...

Google Patches High-Severity Vulnerabilities in Chrome

Google has released a new update for its Chrome browser, addressing two high-severity vulnerabilities....

ClickFix Exploits GMeet & Zoom Pages to Deliver Sophisticated Malware

A new tactic, "ClickFix," has emerged. It exploits fake Google Meet and Zoom pages...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

ToxicPanda Banking Malware Attacking Banking Users To Steal Logins

Recent research has uncovered a new strain of malware developed for Android devices, initially...

Azure API Management Vulnerabilities Let Attackers Escalate Privileges

Recent discoveries by Binary Security have revealed critical vulnerabilities in Azure API Management (APIM) that could...

Google Patches High-Severity Vulnerabilities in Chrome

Google has released a new update for its Chrome browser, addressing two high-severity vulnerabilities....