what is the difference between dll hijacking and dll injection

Question

I would like to know if DLL Hijacking and DLL Injection are the same or if they are different. I know that some malware use it to do malicious things.

Answer 1

DLL Hijacking is when you abuse the library search order to gain execution in a process. Being able to write to the directory an executable resides in allows a malicious actor the ability to drop a dll with the same name as one the executable will request via LoadLibrary. When the executable attempts to load the expected library, they will instead load the malicious one.

• A legitimateish use for DLL Hijacking could be to add functionality to a third party tool that doesn't directly support plugins.

• The finer details are explained by MSDN in the LoadLibrary entry.

• See also this SO Question

DLL Injection on the other hand is where a running process is manipulated to load a desired library. MSDN details a way to do so without directly touching the process, through SetWindowsHookEx. Another way is to open a process, write the desired library name into its memory space, and then create a thread in the process to call LoadLibrary using that name as the buffer. This second way is covered in a SO Question

Answer 2

Windows searches for dlls in this order:

1. it checks to see whether the requested dll is in KnownDlls(a list of dlls specified in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs) or not, if not
2. it follows the Microsoft dll search order defined by MSDN here.

Dll Hijacking: also known as load-order hijacking, affects only executables that are not in the system directory that try to access dlls from the system directory and aren't in the KnownDlls list it works by creating a malicious dll with the same name as the requested dll and placing it in the first,second or third place windows searches in in the dll search order, so when LoadLibrary is called,it will load the malicious library instead of the actual library.

Dll Injection: is when the malware launcher forces a victim process to load the malicious library by writing its name in the process memory and then creating a thread that loads the malicious library.

also there's the direct Dll injection method where the malware author doesn't really need to write the malicious code into a separate dll and then load it into the victim process, instead it writes the code directly into the victim process memory space using VirtualAllocEx and WriteProcessMemory twice.

Answer 3

I will explain both, DLL Hijacking & DLL Injecting.

• DLL Hijacking is a way for attackers to run unwanted code on your system. This means that if an attacker can get a file/program on your system (by social engineering, remote control, etc.) that file could be performed when the user runs an application that is vulnerable to DLL Hijacking.
• DLL injection is a method used for running code within the address space of another process by forcing it to load a dynamic-link library. DLL injection is often used by outer programs to manipulate the performance of another program in a way its creators did not expect or intend.