Last month, I presented a talk at the RSA USA Conference on an
increasingly popular threat vector called “Dynamic-Link Library
Side-Loading” (DLL Side-Loading). As with many vulnerabilities, this
exploit has existed for a rather long time and is the result of
Microsoft looking to make binary updates easier for Windows developers
through the Windows side-by-side (WinSxS) assembly feature.
Now, though, advanced persistent threat (APT) developers are using
the innocuous DLL Side-Loading method to sneak malware past anti-virus
(AV) scanners as the infected files run in-memory. In doing-so, the
malicious payload is using a benign application to be built in memory,
meaning that the malware does not sit running in the file system where
AV scans take place. In the figure below, you can see an example of
how this all plays out:
For a real-life example: in 2013, attackers exploited the executable
originally developed by Fortune 50 company using this technique in a
highly targeted attack. In such an attacks, the malware places a
spoofed, malicious DLL file in a Windows’ WinSxS directory so that the
operating system loaded the spoofed DLL instead of the legitimate
file. Furthermore, because the file in-question was white-listed by
hash in a public database, AV simply ignores it altogether.
In response to the growing use of DLL Side-Loading in APTs, we have
developed a full paper that describes the history of
Side-Loading and its role in the malware and software engineering arenas.
