3 ms·
It's not Microsoft's or the UAC's fault. It's Nullsoft's fault. NSIS (Nullsoft Scriptable Install System) loads and executes the DLL without any verification.
by winter_blue 11y ago
It's not Microsoft's or the UAC's fault. It's Nullsoft's fault.
NSIS (Nullsoft Scriptable Install System) loads and executes the DLL without any verification.
Also, you're not hijacking DLLs -- you're using a DLL to hijack NSIS (which runs with administrative privileges).
- icebraining 11y agoHow can NSIS verify the DLL? How can an installer from, say, 2012 know if the copy of shfolder.dll in Windows 10 is valid? And worse - in some cases, NSIS wasn't even directly loading the DLLs, Windows was doing it behind its back (eg. NSIS called a Win32 function called OleInitialize, which loaded UXTheme.dll by itself).
- Strom 11y agoAll valid points. I think it should be possible, at least for Microsoft DLLs, to specify a flag that you are willing to load only those signed by Microsoft. A malicious version.dll wouldn't probably have a Microsoft signature. The signature verification would be done by the OS and thus would be future-proof. Even a OS-local whitelist for exemptions could work, where an admin could add some unsigned DLL hashes to the list that would still load. None of the downloaded malicious DLL files would pass this test.
- deleted 11y ago[deleted]