Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm about to distribute a dll library (there's also a linux version) to my users but I'm afraid of dll preloading attacks (i.e. someone substituting its malicious dll to get called by mine and gain privileges).

I'm looking into digitally signing my dll and all the other dlls that my library loads with LoadLibrary/LoadLibraryEx, but I'd like to know whether only dlls loaded at runtime (with LoadLibrary / LoadLibraryEx) by my library are potentially unsafe, or either the dlls listed at load time in my library's IAT.

share|improve this question
I don't think signing is the best approach for this issue. Just ensure that you never load libraries from an attacker writable path. Any privileged application must only be installed into directories to which only privileged users have write access. – CodesInChaos Nov 5 '13 at 11:54
Yes but my dll is relocatable, it can be moved anywhere along with an .exe file. What I'm wondering right now is whether entries in the IAT may also be affected by this problem – Marco A. Nov 5 '13 at 12:10
If the exe file is in an attacker writable directory you're doomed anyways. If an admin misconfigures their system there isn't anything your application can do about it. There are related attacks if an application loads a dll from the working directory instead of the application directory. – CodesInChaos Nov 5 '13 at 12:20
It's not my job to prevent misconfigurations, but by signing I give the user a tool to verify that I wrote that dll and to my dll the chance to load another verified dll (at least at runtime with LoadLibrary) – Marco A. Nov 5 '13 at 12:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.