1

I recently installed a new printer in our network. Just because I was interested, I switched to wireshark when scanning for and adding the printer on windows. I noticed that it was discoverd through mdns and then instructed windows to download some drivers in form of dll files. Now I wonder: What if I would setup a rogue udp server that listens for mdns queries and then responds with a fake printer service that sends malicous dlls to windows hosts. Since they are automatically "installed" (and executed?), it would provide a very good way into a system. I also wonder how one could fix this (issue?) without breaking the comfort this feature gives users.

I tried to setup a socket that listens for mdns queries to respond to in python3, but cannot get it to work. And before wasting much more of my time. I figured I'll ask about this attack vector here.

  • 1
    "malicious dlls" is the big thing that might not be as easy as you think. – schroeder Sep 5 at 18:56
1

Windows only automatically installs drivers that have been digitally signed. Unsigned drivers, drivers that have invalid signatures and drivers that have been signed by untrusted publishers are not installed automatically. Instead, if the user is an Administrator, they are given a warning message informing them that the driver is unsigned or has been altered (and then are given the option to quit installation or continue anyways). Standard users are not given any option and the driver is not installed.

So to successfully install a driver the way you suggest, you would either have to compromise the private key of a vendor that Windows trusts, or somehow manage to get your own certificate onto Windows list of trusted publishers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.