You often read about people who use many different security applications to protect their systems. Not only anti-virus, anti-spyware, firewall, HIPS, …, but also some other tools like anti-keyloggers, … And sometimes, when they argue about the additional protection such tools bring, you can read the following: “it does no harm…”.

Well, this time, I’ve a clear example where using a supplemental security tool does harm, even when it adds real protection.

When installed, this tool (which I’m not going to name here because of SEO reasons), installs a Windows explorer shell extension (we’ve discussed the risks of these shells before). The problem with this tool’s shell extension (a DLL), is that it is compiled without the dynamic base flag set. In other words, it doesn’t support ASLR.

On a default Windows Vista or Windows 7 install, all the DLLs of explorer.exe support ASLR. Even if a vulnerability is found in explorer.exe, it won’t be possible to bypass DEP and ASLR by borrowing code from a DLL to build an exploit with ROP gadgets. Unless you’ve installed this security tool, which adds a DLL with a fixed address to explorer.exe’s code space. Then an attacker can find ROP gadgets in this shell extension’s DLL.

This security tool harms the security of your system by opening it up to ROP exploits.

And shell extensions are not only loaded into explorer.exe. They find their way into many applications. For example, when you work with the common dialog control (like using the file open dialog)  in an application, shell extensions also get loaded into these applications. So this extension can get loaded into Adobe Reader, Microsoft Office applications, …

The risk this security tool brings to your system is not theoretical. There are malicious PDFs in the wild that use ROP gadgets.

Quickpost info

Full story: Didier Stevens

• Quickpost: Checking ASLR
  Some people asked me for a simple way to check shell extensions for their ASLR support. You can do this with Process Explorer. Start Process Explorer, and set the lower pane to display DLLs. Select p...
• Quickpost: Adobe Reader X
  In case you’ve not read Adobe’s announcement: Adobe Reader X is out. Use Adobe’s FTP server if you want to avoid their download manager. Protected Mode Adobe Reader comes with a sand...
• Quickpost: Adding Certificates to the Certificate Store
  A couple of people asked me how to get self-signed certificates recognized by Windows. For example, when you check the digital signature of one of my programs (like ariad.exe), you’ll see this: ...
• Quickpost: Ariad & DLL Preloading
  I’m writing this quickpost just in case you hadn’t figured this out for yourself: the techniques I described to protect machines from the .LNK vulnerability also help you mitigate the DLL ...
• Quickpost: .LNK Template Update
  I updated my .LNK template with info I got from comments from WndSks and Forrest Gump. This new version identifies well-known Shell GUIDs: Quickpost info View full post on Didier Steven...
• Quickpost: 2 .LNK Tools
  Microsoft has issued an emergency patch (MS10-046) for the .LNK file vulnerability (CVE-2010-2568). I’m releasing two small tools I developed to help me investigate this vulnerability. First one...
• Quickpost: Preventing the /Launch Action “cmd.exe” Bypass
  Adobe has released a new Adobe Reader version that contains functionality to block my /Launch action PoC, but Bkis found a bypass: just put double quotes around cmd.exe, like this:  “cmd.exeR...
• Quickpost: No Escape From PDF
  Adobe has released a new Adobe Reader version with a fix for my /Launch action PoC PDF. Before version 9.3.3: Since version 9.3.3: Not only is the dialog box fixed, but the /Launch action is also di...
• Quickpost: More Malformed PDFs
  Here’s a heads up for some malicious PDF samples that are deliberately malformed to avoid detection. The most important case is the missing endobj keyword: Adobe Reader will happily parse a PDF...
• Quickpost: NetworkMashup.xls
  NetworkMashup.xls is a spreadsheet with VBA macros I scraped from the Internet to execute pings and name/address resolution from within Excel with WIN32 API calls. Not only is it handy when you need t...