Search Unity

Prevent Dll hijacking

Discussion in 'Windows' started by AndreasScholl, Aug 26, 2019.

  1. AndreasScholl

    AndreasScholl

    Joined:
    Oct 16, 2015
    Posts:
    12
    We got a request from one of our customers that is asking for dll hijacking prevention measurements.

    A third party security company discovered that it is possible to put malicious .dlls (i.e a modified xinput1_3.dll) into the application folder and have it loaded by unity on application start.

    Is there a common way to protect unity applications from dll hijacking? What would be the recommended procedure to protect our applications?

    Thanks a lot for any feedback or help,

    Andreas
     
    AndreasScholl, Aug 26, 2019
    #1

  2. FMark92

    FMark92

    Joined:
    May 18, 2017
    Posts:
    1,243
    Hardcode the file's checksum?
     
    FMark92, Aug 26, 2019
    #2

  3. AndreasScholl

    AndreasScholl

    Joined:
    Oct 16, 2015
    Posts:
    12
    Thanks for your reply. Are you relating to the checksum of the loaded dll, for example the xinput1_3.dll?

    How would you check for this file? Can we put the code to check the dlls inside the unity-application or will it already be to late to check there at this point?

    Do you know of any standard solutions for this?
     
    AndreasScholl, Aug 26, 2019
    #3

  4. FMark92

    FMark92

    Joined:
    May 18, 2017
    Posts:
    1,243
    https://stackoverflow.com/questions/10520048/calculate-md5-checksum-for-a-file

    Have the original checksum saved somewhere in your code and then just compare it to whatever
    md5.ComputeHash(stream); spits out.

    Depends. I don't think you'll be able to catch everything but you can exit if you detect alterations after application started.
     
    FMark92, Aug 26, 2019
    #4

  5. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,680
    You can't check the checksum. It can change with a Windows update.

    Generally this isn't considered a security vulnerability. Usually, programs are installed in Program Files directory, which is read only for non-admin users and write/read for administrators. So if a DLL can be placed next to your executable, you're already compromised.

    However, there are ways around this if you have a good reason to. Read this: https://support.microsoft.com/en-us...f-libraries-to-prevent-dll-preloading-attacks

    You could modify the game executable in a way that makes it not link to anything but kernel32.dll, then on startup call SetDllDirectory("") and then do LoadLibrary on UnityPlayer.dll with an absolute path to start up the game.
     
    Tautvydas-Zilys, Aug 26, 2019
    #5
    FMark92 likes this.

  6. EusebiuMarcu

    EusebiuMarcu

    Joined:
    Sep 20, 2018
    Posts:
    26
    Yes, you are correct, the admin account is compromised (and this can happen). But this does not mean that the admin account has some access that the normal user has (like access to a shared file location based on some AD group set of permissions).
    Hence, the app/game can access the data by the normal user (non-local admin) and then the dll could get the data loaded by the app/game. So, from this perspective it is a security vulnerability.

    Coming to your (&MS) solution, how would we do that modification of the game executable if we do not control the build process? How can we link it with only kernel32.dll, call SetDllDirectory("") and then LoadLibrary("path/to/UnityPlayer.dll")? I think this part should be done by Unity build system...
     
    EusebiuMarcu, Apr 8, 2022
    #6

  7. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,680
    The attacker could just replace the whole game executable with theirs if they can modify the game files.

    The source code for the game executable is shipped in "<UNITY_INSTALL_DIR>\Editor\Data\PlaybackEngines\windowsstandalonesupport\Source\WindowsPlayer". You can modify it any way you want.
     
    Last edited: Apr 8, 2022
    Tautvydas-Zilys, Apr 8, 2022
    #7

  8. EusebiuMarcu

    EusebiuMarcu

    Joined:
    Sep 20, 2018
    Posts:
    26
    Does not load in VS2022.

    C:\Program Files\Unity\Hub\Editor\2021.1.27f1\Editor\Data\PlaybackEngines\windowsstandalonesupport\Source\WindowsPlayer\WindowsPlayer\WindowsPlayer.vcxproj : error : The imported project "C:\Program Files\Unity\Hub\Editor\2021.1.27f1\Editor\Data\PlaybackEngines\windowsstandalonesupport\Source\WindowsPlayer\UnityCommon.props" was not found. Confirm that the expression in the Import declaration "C:\Program Files\Unity\Hub\Editor\2021.1.27f1\Editor\Data\PlaybackEngines\windowsstandalonesupport\Source\WindowsPlayer\UnityCommon.props" is correct, and that the file exists on disk. C:\Program Files\Unity\Hub\Editor\2021.1.27f1\Editor\Data\PlaybackEngines\windowsstandalonesupport\Source\WindowsPlayer\WindowsPlayer\UnityData.vcxitems
     
    Last edited: Apr 9, 2022
    EusebiuMarcu, Apr 9, 2022
    #8

  9. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,680
    The project in that folder is not complete, but the source code is. You can either build your Unity project or an empty Unity project using "Generate Visual Studio Solution" option and it will spit out a project that builds.
     
    Tautvydas-Zilys, Apr 9, 2022
    #9