Saint BYOVDLL, Who Brought His Own DLLs

Patron of protected processes, old signed DLLs, and guests who show up to the party with the bottle already open.

Life

On 9 August 2024 Clément Labro of SCRT described how to inject code into a protected Windows process (PPL) without any driver: you just had to convince it to load an old version of one of its own DLLs, still signed by Microsoft but full of bugs long since fixed, such as CVE-2023-36906 and CVE-2023-28229. The signature was valid, the version was not: Windows checked the seal and not the expiry date.

Prayer

O Saint BYOVDLL, who brings Patch Tuesday leftovers to the PPL's table, let our systems recognise an old DLL even when it is properly signed. Amen.

How to celebrate

Celebrated by updating Windows, enabling vulnerable-binary blocklists, and checking the date as well as the signature.

A good signature doesn't make a DLL new.