Almost 300 Windows 10 Executables Are Open

Occasionally operating systems and other software vulnerabilities We see it happening. How critical these vulnerabilities are may vary. There is almost no chance that programs that are large and used on many different devices will not have vulnerabilities.

On the other hand, the newly emerging vulnerabilities of Windows 10 are both quite numerous They also seem very easy to exploit. about 300 While different vulnerabilities are discovered, it is possible to trigger these vulnerabilities with a simple VBScript.

PwC UK warned

Security researcher from PwC UK Wietze Beukema, in his statement about 300 Windows 10 He stated that the executable file is vulnerable to DLL hijacking attacks. While the statement states that the System32 file is vulnerable to relative path DLL hijacking, a simple VBScript It was stated that these application files can be used with and even UAC can be completely bypassed.

This explains, DLL hand passing It shows the so-called attacks. In this method, attackers cause a valid program to run a DLL of their choice. This is often used for harmful content.

In the post on Beukema's blog post, DLL replacement, DLL proxying, permission acceleration, DLL search order hijacking, DLL redirection It is stated that many different techniques can be used, such as. Of course, for such use, attackers must have high technical skills.

Example attack shown

The post also includes a computer. System32 A sample attack was shown by focusing on a computer in the folder. The security expert, who listed the DLLs used during the operation of a program, stated that each DLL was vulnerable to attack.

According to the researcher, to protect against such attacks, properly installed DLLs It is necessary to ensure that it is written to a special folder. Thus, the attackers' job becomes quite difficult. Additionally, not every DLL is the target of an attack.

Moreover Microsoft User Account Control (UAC) In case the files on the computer can be manipulated, we normally see the following "Do you allow this application to make changes to the files on the computer?" We cannot see the statement because the permissions can be processed by the attacker in the background. 

To protect against such attacks, look at the activities in Windows files, UAC settings Setting it to “always notify” is among the precautions that can be taken for the end user. Moreover DLL formation regions Monitoring and checking whether they are loaded in unexpected places also stands out as an alternative.