I have a situation where malicious files are being copied to the installation directory of some software and the software will load those files when making a call to LoadLibrary or DllImport (in .NET land).
If your software runs with administrator privileges, a P/Invoke on a malicious DLL can essentially run any code in an elevated fashion, using your application as a vehicle to do so on it's behalf.
Many of these techniques can be found in this question: Ways to inject malicious DLLs to exe file and run it
What I'm asking is how, as a software developer, can you prevent this type of attack? If I want to import
user32.dll into my application and make a call, how do I know it's loading the right one?
In the LoadLibrary documentation they do hint at this problem existing but don't exactly explain what you are supposed to do to avoid it at all costs.
Do not use the SearchPath function to retrieve a path to a DLL for a subsequent LoadLibrary call. The SearchPath function uses a different search order than LoadLibrary and it does not use safe process search mode unless this is explicitly enabled by calling SetSearchPathMode with BASE_SEARCH_PATH_ENABLE_SAFE_SEARCHMODE. Therefore, SearchPath is likely to first search the user’s current working directory for the specified DLL. If an attacker has copied a malicious version of a DLL into the current working directory, the path retrieved by SearchPath will point to the malicious DLL, which LoadLibrary will then load.
A simple solution like checking if the file is in a search path you don't expect (such as side-by-side with your executable) doesn't work very well because the assembly name can be changed and a redirect put in place.
UPDATE: This article on Dynamic-Link Library Security explains things well, however, all these techniques can easily be bypassed by the same process copying the malicious files. I've seen DLL Redirection used to redirect to the malicious files as well. I fear even programmatic approaches can fail because your applications can be modified anyway to still load the malicious files.
Are all Windows applications doomed to have this security flaw in them?