8 ms·

Isn't this "DLL hijacking" thing a bit overblown? The directory an application runs from on Windows has always been considered part of the security perimeter of

by caf 10y ago

Isn't this "DLL hijacking" thing a bit overblown? The directory an application runs from on Windows has always been considered part of the security perimeter of the application. If you can drop a malicious DLL where putty.exe lives, can't you just drop a malicious putty.exe?

__jal 10y ago
Not a windows person, so I can't speak to how the directory is treated, but I've watched enough people run applications from the Downloads directory to wonder about it.
- beachstartup 10y ago
  with putty i would be surprised if most didn't run it straight from the desktop. i would be a dirty liar if i said i haven't, countless times.
  - monk_e_boy 10y ago
    This. Without an installer that puts a link into the start menu, everyone I've ever worked with just dumps it on the desktop. I used to throw a symlink into the start menu, but when other devs used my machine they expected it to be on the desktop. Just one of those quirks of using PUTTY
    - marvy 10y ago
      But why not just use the installer?
      - gasda 10y ago
        I was going to say putty does not have an installer, but TIL putty now has an installer..
      - hermitdev 10y ago
        For a long time, there wasn't an installer for putty, so a lot of us became accustomed to just dropping the binary on our desktop or "bin" folder", but there is an installer now. Also, certain corporate environments that preclude the installer from working correctly, but won't mind you "installing" a program to your desktop/local app data.
        marvy 10y ago
        I find the corporate environment thing suspicious. I could imagine that if you don't have admin access, you can't install to Program Files, but couldn't you still install to your home directory, and still get those lovely start menu shortcuts?
        Jaruzel 10y ago
        Not really. Windows, by default requests elevated rights from the user (the UAC dialog) if you run any exe that has 'setup' or 'install' in the name, or if the manifest inside/alongside the exe defines a requirement for elevated rights. You can spot these files as they have a little Windows 'shield' overlay on their icons (Windows overlays that itself if it detects a file needing elevated rights). So, unless you can elevate your rights (i.e. be admin, or type in admin credentials), you can't run most installers. However, prior to Windows 7 your personal start menu folder wasn't locked down - and as a non-admin you could easily add/remove shortcuts from it. Since Windows 7 onwards it's now protected, so you need to elevate to be able to write to it. Windows allows you to run (by default) software from ANY folder you like, but you can only (by default, again) write to some of your user folders and the the %TEMP% location. So downloading the PuTTY exe and running it from the downloads folder or desktop is perfectly legitimate, although not good practice. As an aside: I'm not sure if Chrome still does it, but I recall that if you try to install it and you don't have admin rights, it just puts an icon on your desktop, and installs all the chrome files into a folder under ProgramData which resides in your user hierarchy, instead of the locked down Program Files area. Which is one way of getting around the lack of admin-rights.
        marvy 10y ago
- deleted 10y ago
  [deleted]
- chris0x00 10y ago
  That's an interesting point, otherwise I'd say it's basically the Windows equivalent of LD_PRELOAD. Running executables from the "downloads" directory is certainly a thing though, never realized the security implication there (beyond trusting the download natch)
JohnTHaller 10y ago
It's bad if you use an insecure browser like Chrome. Chrome allows any website you visit to download DLLs directly to your Downloads directory without user interaction. Then, any installer you download and run will use the infected DLLs unless specifically keyed to look in system32 for them. Additionally, something can infect your PC and alter your PATH. Then PuTTY might pick up a fake Windows DLL from elsewhere on your machine. But if your machine is infected and something is messing with the Windows path, you have bigger problems.
- lupin_sansei 10y ago
  Thankfully Chrome has fixed this issue. I just tried this and Chrome actually warns you about downloading DLLs and requires further user interaction to actually download DLL to the downloads folder: Screenshot: https://i.imgur.com/MvRwZBi.png https://i.imgur.com/MvRwZBi.png
  - JohnTHaller 10y ago
    All DLLs or just specific ones? I'd heard a while ago they were going to blacklist specific ones instead of just making it so a user has to purposely decide to download a file. I'm surprised they finally did something since we've been warning people not to use Chrome because of this issue for years.
    - Sunset 10y ago
      >blacklist specific ones Enumerating badness has always been a very bad idea.
      - Crespyl 10y ago
        I'll add that to my list of bad ideas.
YSFEJ4SWJUVU6 10y ago
Can't say anything definitive about “overblown”, but I like the change. Windows security model is inadequate, but it's good to work around it anyway.
- Keluri 10y ago
  How is Window's security model inadequate?
  - wruza 10y ago
    You can download/put different modules into the same folder and they will interact without any checks because of name clashes. Programs should be complete packages that depend only on known, protected system32-like locations.

by caf 10y ago

__jal 10y ago

Not a windows person, so I can't speak to how the directory is treated, but I've watched enough people run applications from the Downloads directory to wonder about it.

beachstartup 10y ago
with putty i would be surprised if most didn't run it straight from the desktop. i would be a dirty liar if i said i haven't, countless times.
- monk_e_boy 10y ago
  This. Without an installer that puts a link into the start menu, everyone I've ever worked with just dumps it on the desktop. I used to throw a symlink into the start menu, but when other devs used my machine they expected it to be on the desktop. Just one of those quirks of using PUTTY
  - marvy 10y ago
    But why not just use the installer?
    - gasda 10y ago
      I was going to say putty does not have an installer, but TIL putty now has an installer..
    - hermitdev 10y ago
      For a long time, there wasn't an installer for putty, so a lot of us became accustomed to just dropping the binary on our desktop or "bin" folder", but there is an installer now. Also, certain corporate environments that preclude the installer from working correctly, but won't mind you "installing" a program to your desktop/local app data.
      - marvy 10y ago
        I find the corporate environment thing suspicious. I could imagine that if you don't have admin access, you can't install to Program Files, but couldn't you still install to your home directory, and still get those lovely start menu shortcuts?
        Jaruzel 10y ago
        Not really. Windows, by default requests elevated rights from the user (the UAC dialog) if you run any exe that has 'setup' or 'install' in the name, or if the manifest inside/alongside the exe defines a requirement for elevated rights. You can spot these files as they have a little Windows 'shield' overlay on their icons (Windows overlays that itself if it detects a file needing elevated rights). So, unless you can elevate your rights (i.e. be admin, or type in admin credentials), you can't run most installers. However, prior to Windows 7 your personal start menu folder wasn't locked down - and as a non-admin you could easily add/remove shortcuts from it. Since Windows 7 onwards it's now protected, so you need to elevate to be able to write to it. Windows allows you to run (by default) software from ANY folder you like, but you can only (by default, again) write to some of your user folders and the the %TEMP% location. So downloading the PuTTY exe and running it from the downloads folder or desktop is perfectly legitimate, although not good practice. As an aside: I'm not sure if Chrome still does it, but I recall that if you try to install it and you don't have admin rights, it just puts an icon on your desktop, and installs all the chrome files into a folder under ProgramData which resides in your user hierarchy, instead of the locked down Program Files area. Which is one way of getting around the lack of admin-rights.
        marvy 10y ago
deleted 10y ago
[deleted]
chris0x00 10y ago
That's an interesting point, otherwise I'd say it's basically the Windows equivalent of LD_PRELOAD. Running executables from the "downloads" directory is certainly a thing though, never realized the security implication there (beyond trusting the download natch)

JohnTHaller 10y ago

It's bad if you use an insecure browser like Chrome. Chrome allows any website you visit to download DLLs directly to your Downloads directory without user interaction. Then, any installer you download and run will use the infected DLLs unless specifically keyed to look in system32 for them. Additionally, something can infect your PC and alter your PATH. Then PuTTY might pick up a fake Windows DLL from elsewhere on your machine. But if your machine is infected and something is messing with the Windows path, you have bigger problems.

lupin_sansei 10y ago
Thankfully Chrome has fixed this issue. I just tried this and Chrome actually warns you about downloading DLLs and requires further user interaction to actually download DLL to the downloads folder: Screenshot: https://i.imgur.com/MvRwZBi.png https://i.imgur.com/MvRwZBi.png
- JohnTHaller 10y ago
  All DLLs or just specific ones? I'd heard a while ago they were going to blacklist specific ones instead of just making it so a user has to purposely decide to download a file. I'm surprised they finally did something since we've been warning people not to use Chrome because of this issue for years.
  - Sunset 10y ago
    >blacklist specific ones Enumerating badness has always been a very bad idea.
    - Crespyl 10y ago
      I'll add that to my list of bad ideas.

YSFEJ4SWJUVU6 10y ago

Can't say anything definitive about “overblown”, but I like the change. Windows security model is inadequate, but it's good to work around it anyway.

Keluri 10y ago
How is Window's security model inadequate?
- wruza 10y ago
  You can download/put different modules into the same folder and they will interact without any checks because of name clashes. Programs should be complete packages that depend only on known, protected system32-like locations.