Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 839048" data-attributes="member: 32260">Bypassing SmartScreen.It is worth to know that SmartScreen Application Reputation check, can be bypassed by DLL hijacking. Simply, the checked executable could be a legal (vulnerable) program with malicious DLL located in the same folder. This DLL will be loaded by the program after SmartScreen check and DLL will not be checked by SmartScreen.Such a method is often used via infected USB drives. Both &quot;Run As SmartScreen&quot; and &quot;Run By SmartScreen&quot; can prevent DLL hijacking when used on executables located on USB drives.The attackers can also use the packed spam attachments (ZIP, ARJ, 7-ZIP, etc. downloaded to hard disk), which can contain the legal EXE file alongside the malicious DLL to apply DLL hijacking. Usually, the attack starts from the script or shortcut that drops the malicious DLL and runs the EXE file - this method is prevented by H_C settings.But in theory, the attacker could also use social engineering to convince the user to run the EXE file directly - this would bypass SmartScreen even if unpacked files had MOTW.I will try to prevent the above in the next H_C version.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" /></blockquote>

[QUOTE="Andy Ful, post: 839048, member: 32260"] [B]Bypassing SmartScreen.[/B] It is worth to know that SmartScreen Application Reputation check, can be bypassed by DLL hijacking. Simply, the checked executable could be a legal (vulnerable) program with malicious DLL located in the same folder. This DLL will be loaded by the program after SmartScreen check and DLL will not be checked by SmartScreen. Such a method is often used via infected USB drives. Both "Run As SmartScreen" and "Run By SmartScreen" can prevent DLL hijacking when used on executables located on USB drives. The attackers can also use the packed spam attachments (ZIP, ARJ, 7-ZIP, etc. downloaded to hard disk), which can contain the legal EXE file alongside the malicious DLL to apply DLL hijacking. Usually, the attack starts from the script or shortcut that drops the malicious DLL and runs the EXE file - this method is prevented by H_C settings. But in theory, the attacker could also use social engineering to convince the user to run the EXE file directly - this would bypass SmartScreen even if unpacked files had MOTW. I will try to prevent the above in the next H_C version.:giggle: [/QUOTE]

Verification