Saturday, March 2, 2024

New DLL Hijacking Technique Let Attackers Bypass Windows Security

DLL hijacking is a technique where a malicious DLL (Dynamic Link Library) is placed in a directory that a vulnerable application searches before the legitimate one. 

When the application is launched, it unknowingly loads the malicious DLL instead, allowing attackers to:-

  • Execute arbitrary code
  • Compromise the system

Recently, the cybersecurity researchers at a multi-layered incident response company, Security Joes, discovered a new DLL hijacking technique that enables threat actors to bypass Windows mechanisms.

New DLL Hijacking Technique

This new technique exploits trusted WinSxS executables using DLL Search Order Hijacking

This enables threat actors to execute malicious code within Windows folders, which eliminates the need for extra binaries. 

Besides this, it’s compatible with both Windows 10 and 11, as it bypasses high privilege requirements.

The DLL Search Order Hijacking exploits how Windows apps load DLLs, taking advantage of those without specified file paths. 

Threat actors manipulate apps depending on predefined search orders that place a malicious DLL in a prioritized directory. 

Many methods for this require apps not to specify full paths, often due to development oversights.

Knowing how Windows loads DLLs and executables is one of the key things, and the system follows a sequence during the loading process.

This ensures efficient operation by locating necessary components like DLLs. Not only that even, it also provides an alternative method for finding resources.

Besides this, the Windows OS flow for searching and loading resources includes the following things:-

  • Application’s launch directory
  • C:\Windows\System32
  • C:\Windows\System
  • C:\Windows
  • Current working directory
  • Directories in the system’s
  • User’s PATH variables

Exploiting the loading process lets threat actors inject unauthorized code into the trusted processes, which helps in deceiving the:-

  • Security tools
  • Security experts/analysts

This new malicious technique is completely sophisticated and stealthy as it enables threat actors to achieve several types of malicious goals like:-

  • Compromise systems
  • Evade detection

The WinSxS folder is a critical component in Windows OS at “C:\Windows\WinSxS.” This vital component crucially maintains multiple versions of system files. 

Not only that even, it also preserves previous versions during updates, which causes the folder to grow with each update for the Windows operating system.

Execution flow of the DLL Search Order Hijacking
Execution flow of the DLL Search Order Hijacking (Source – Security Joes)

Here below, we have mentioned all the key purposes of the WinSxS folder:-

  • Version Management
  • System Integrity
  • Dynamic Activation

Advantages New DLL hijacking technique

Here below, we have mentioned all the key advantages of this new DLL hijacking technique:-

  • Circumventing High Privilege Requirements
  • Eliminating the Need for Additional Binaries
  • Enhancing Stealth

PoC

Here below, we have mentioned the Proof-of-Concept video:-

Website

Latest articles

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles