Jonas L

DLL hijacking is a vaguely yawn-worthy attack. But sure, worthy of fixing. But a document that causes MS Word to directly launch an EXE file from the same directory as the document is sure new to me! I wonder how common it is to open documents from untrusted locations...pic.twitter.com/SA9hB37ttx

Thanks to @buffaloverflow pointing out that with Office 2013 and earlier, all that's required is opening up a file directly from Firefox. This (both file planting and vul trigger) requires a click to get out of Protected Mode, so I'm still trying to gauge how important this is...pic.twitter.com/W85GHnGjDT

Again from the same resource: https://research.nccgroup.com/2016/01/05/remote-exploitation-of-microsoft-office-dll-hijacking-ms15-132-via-browsers/ … Chromium-based browsers like Chrome and modern Edge download files w/o user interaction (WHY?!?) so this can be leveraged to pull off the attack on a system where everything is up do date.pic.twitter.com/za6gE81ozs

As I review my notes, I'm reminded that I first clearly explained this exact problem to @msftsecresponse in *2016* The case was dismissed as not being a vulnerability. So here I am, 1538 days later, putting together a report to confirm that this is really how they feel. <sigh>pic.twitter.com/oaKxTPgjZt