A known security issue (CVE-2016 – 0603) that affects a wide range of applications (from web browsers to antivirus products, and a host of others) can be exploited by slightly tweaking a .dll.
The technique is called DLL side-loading or hijacking and uses DLL files that have the same name as the original ones in specific locations in the target's file system.
This type of attack is very old and allows legitimate applications to be compromised by tricking users. The technique has been widely used by software crackers. For example, a crack for Adobe Photoshop, which has been around for years, is amtlib.dll.
This particular file is an application file. However, crackers can activate the program by changing a single byte!
Imagine what could happen if a malicious user, instead of changing a byte to activate the program, added their own malicious code to the .dll….
Here is a short (possibly incomplete) list of applications found vulnerable to this attack: Firefox, Google Chrome, Adobe Reader, 7Zip, WinRAR, OpenOffice, VLC Media Player, Nmap, Python, TrueCrypt, and Apple's iTunes.
The vulnerabilities in the above software were discovered by German security researcher Stefan Kanthak.
Mr. Kanthak also seems to have paid special attention to antivirus software installers. Below are some of the security products vulnerable to DLL hijacking: ZoneAlarm, Emsisoft Anti-Malware, Trend Micro, ESET NOD32, Avira, Panda Security, McAfee Security, Microsoft Security Essentials, Bitdefender, ScanNowUPnP Rapid7, Kaspersky, and F-Secure.
All of the above applications (and probably many more) will need to release updates to protect their files from malicious users. Let's see how quickly they respond.
The only company that responded immediately was Oracle, patching the installers for Java versions 6, 7, and 8.
