WhiteHat and the Exploit Factory

Dynamically Loaded Libraries (DLL) are used in almost any project, because of their unique properties: modularity, ease to support, updatability. Unfortunately, this can be easily exploited and all it takes is for the attacker to simply replace the original DLL file with the malicious one (especially if project is no longer being maintained and does not have hashing to verify that the valid DLL is being loaded). Moreover attacker can load their DLL into a remote process (usually done to stay hidden, since after DLL is injected you can run malicious code "from within" a target process). To make is easier to visualize, here is a small diagram: For example, we have a program that displays number of seconds passed since it started (not to over complicate things): An attacker can create a malicious DLL that logs pressed keys, but in this case it simply displays a message box: And attacker also has an injector that will load their DLL into the target process: The way an...