Thumbnail image for acros.jpgPerhaps the most serious class of Windows bugs just got more serious with research described by ACROS Security at the recent Hack in the Box conference. ACROS CEO and CTO Mitja Kolsek described a new class of "Remote Binary Planting" attacks which affect even the most recent versions of Windows and what are presumed to be the most secure applications.

It was last summer that ACROS Security first revealed remote binary planting to the world although, as they pointed out themselves, the basics of the attack had been suggested in 2000 by George Guninski. The core of the vulnerability is when Windows loads a DLL or EXE without an explicit file path. If the attacker can change the current working directory, or trick the user into changing it, he can trick the application into loading his own DLL or EXE instead of the intended one.

It was clear from the start that this vulnerability would be found in a broad variety of Windows applications and in Windows itself. Since that time we have seen a steady stream of security updates from Microsoft and others for various instances of it and, undoubtedly, many have been patched silently. It wasn't so clear from the beginning how serious it all was. ACROS's new presentation indicates that the bugs are far more widespread than thought at first and more serious. They also include constructive advice for administrators, users and developers.

The new class of remote binary planting attack uses COM (Component Object Model) servers. COM is a (very popular) system object interface standard, used by programs to interface with Windows and to allow Windows to interface with them. It's related to, but not the same as ActiveX. Skipping a few hundred pages of details, one fundamental part of COM is that objects can register the names of server programs accessible to the system through the registry. It's probably not a good idea, but it's not uncommon for those program names to be stored without a path. The programmer probably assumes that the COM server is in the same directory as any of the programs which may call it, so it's going to work. But if the COM server is called by some other program then the program with that name will be loaded from the current working directory, and that may be a malicious program.

ACROS argues that remote binary planting, even without the COM methods, has been overlooked by the careless; downplayed by those claiming the scenario is unusual (I've done this); and ignored, as large numbers of known bugs are unpatched and new software is being released with them.

ACROS even demonstrated how to do this using Internet Explorer 9 in Protected Mode on Windows 7, all patched up. See below.


Microsoft chose to address the problem on a case-by-case basis rather than addressing the source of the problem, specifically the behavior of Windows in loading executable code using the current working directory and path. Such a systemic change would likely have resulted in a many incompatibilities with existing software, something Microsoft avoids if at all possible. It may be that avoiding it will be less possible now.

Kolsek credited the research "mostly" to Luka Treiber, security researcher at ACROS Security.