Reply to thread

Message

<blockquote data-quote="simmerskool" data-source="post: 1070677" data-attributes="member: 61091">[USER=62850]@danb[/USER] Security researchers have detailed a new variant of a dynamic link library (DLL) search order hijacking technique that could be used by threat actors to bypass security mechanisms and achieve execution of malicious code on systems running Microsoft Windows 10 and Windows 11.&nbsp; The approach &quot;leverages executables commonly found in the trusted WinSxS folder and exploits them via the classic DLL search order hijacking technique,&quot; cybersecurity firm Security Joes said in a new report exclusively shared with The Hacker News.[URL unfurl=&quot;true&quot;]https://thehackernews.com/2024/01/new-variant-of-dll-search-order.html[/URL]the above DLL warning was posted in another thread, but wonder if VS/CL protects against this threat? <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />curious on win10 hardware pc, using Edge with Malwarebytes Browser Guard it just blocked this download! with memo 2.6.17 |Heuristics: a suspicious download.but I also downloaded 7.68 on VM with Edge with Malwarebytes Browser Guard and it was not blocked.EDIT update, but on 2d try same Edge, this time 7.68 downloaded aok.anomaly day 2024... (and it&#039;s only day 002 <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite119" alt=":rolleyes:" title="Roll eyes&nbsp; &nbsp; :rolleyes:" loading="lazy" data-shortname=":rolleyes:" />)Installed 7.68 on hardware win10, CL Sandbox feature working as expected with Thunderbird... <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite116" alt=":D" title="Big grin&nbsp; &nbsp; :D" loading="lazy" data-shortname=":D" />and I have the Sandbox disabled on my VMware win10_VM, as it does not &quot;recognize&quot; the virtualization. Dan mentioned it might work to create a nested sandbox with the right tweaks. Not necessary, just wondering if anyone knows how to do this... <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" /></blockquote>

[QUOTE="simmerskool, post: 1070677, member: 61091"] [USER=62850]@danb[/USER] Security researchers have detailed a new variant of a dynamic link library (DLL) search order hijacking technique that could be used by threat actors to bypass security mechanisms and achieve execution of malicious code on systems running Microsoft Windows 10 and Windows 11. The approach "leverages executables commonly found in the trusted WinSxS folder and exploits them via the classic DLL search order hijacking technique," cybersecurity firm Security Joes said in a new report exclusively shared with The Hacker News. [URL unfurl="true"]https://thehackernews.com/2024/01/new-variant-of-dll-search-order.html[/URL] the above DLL warning was posted in another thread, but wonder if VS/CL protects against this threat? :unsure: curious on win10 hardware pc, using Edge with Malwarebytes Browser Guard it just blocked this download! with memo 2.6.17 |Heuristics: a suspicious download. but I also downloaded 7.68 on VM with Edge with Malwarebytes Browser Guard and it was not blocked. EDIT update, but on 2d try same Edge, this time 7.68 downloaded aok. anomaly day 2024... (and it's only day 002 :rolleyes:) Installed 7.68 on hardware win10, CL Sandbox feature working as expected with Thunderbird... :D and I have the Sandbox disabled on my VMware win10_VM, as it does not "recognize" the virtualization. Dan mentioned it might work to create a nested sandbox with the right tweaks. Not necessary, just wondering if anyone knows how to do this... :unsure: [/QUOTE]

Verification