Search found 19 matches

by colebantam
Sat May 13, 2017 6:00 pm
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLLL HIJACKING Audacity 2.1.2

colebantam wrote: I have demonstrated several times now, that audacity loads those DLLs directly from UNC-Paths (aka network shares). I have demonstrated that it does not, under the circumstances I described: http://forum.audacityteam.org/viewtopic.php?p=326757#p326757. I have demonstrated in a vid...
by colebantam
Sat May 13, 2017 9:11 am
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLLL HIJACKING Audacity 2.1.2

We would appreciate you not misleading our users I'm not misleading anyone. We have confirmed that Audacity does NOT load DLLs from the project path This is only partial true... because executing Audacity from Program Files then opening the project does not load the DLL's This is true, but who open...
by colebantam
Fri May 12, 2017 9:05 am
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLLL HIJACKING Audacity 2.1.2

None of this gets us anywhere we have not visited before, does it? Oh, it does :) You have confirmed that Audacity loads DLLs from the project path, which is definitely a security issue. We have also learned, that Lame and FFmpeg must not be installed to make that Attack work. And we have learned h...
by colebantam
Thu May 11, 2017 7:22 pm
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLL HIJACKING Audacity 2.1.2

So, Gale, can you confirm now, that both DLLs (Lame and FFmpeg) are loaded from the project-path when opening a project-file from Explorer/Desktop on your test-setup?
(with no lame_enc.dll existing in system32-folder)
by colebantam
Thu May 11, 2017 5:05 pm
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLLL HIJACKING Audacity 2.1.2

I was wondering why it took so much longer for Lame to load than FFMpeg in the Logfile. I just realized, that Lame only loads when opening the Settings-Window. But FFMpeg DLLs are loaded immediately after opening the project without the need for any other user-input.
by colebantam
Thu May 11, 2017 4:55 pm
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLL HIJACKING Audacity 2.1.3

Using the steps (the shortcut to Audacity on the Desktop is not a required step), Audacity loads the three av* files, but not lame_enc.dll. The log shows Audacity does not see lame_enc.dll on the Desktop, only C:\WINDOWS\SYSTEM32\lame_enc.dll, which does not load because it does not have sufficient...
by colebantam
Thu May 11, 2017 1:25 pm
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLL HIJACKING Audacity 2.1.3

Adding a file path parameter when launching Audacity does not set the working directory to that file path. Sorry (for my poor english?), I don't understand what you want to tell me with that sentence. Its seems like that one of your sentences denies the other one. Because one line says "because you...
by colebantam
Thu May 11, 2017 9:35 am
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLL HIJACKING Audacity 2.1.3

As it seems like Gale and Steve are not able to reproduce the scenario so far, I decided to brake this up into two parts. First demonstrating that Audacity loads DLLs from the Project-Path, and keeping the Remote-Stuff for later when you both can reproduce this one. Honestly I'm super surprised that...
by colebantam
Mon May 01, 2017 5:49 pm
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLL HIJACKING Audacity 2.1.2

I guess I found out why the DLLs aren't loaded from the testdirectory on Gale's Test-Setup. I assume Gale has Lame and FFMpeg already configured in Audacity? Well, all advanced Audacity Users might have ;) I just copied the DLLs to the application folder and configured Audacity to use those DLLs. Wi...
by colebantam
Mon May 01, 2017 5:33 pm
Forum: Windows
Topic: DLLL HIJACKING Audacity 2.1.2
Replies: 49
Views: 9253

Re: DLL HIJACKING Audacity 2.1.2

The internet must obviously be "trusted", but it is the job of the system firewall to reject incoming data that is not the result of a request by the computer. No. The Network on which the testfiles resided was UNTRUSTED. And the files ARE requested by Audacity, so no reason for the firewall to dis...