A security researcher has discovered that the automatic download feature of Google's Chrome and Microsoft's Edge browser provides cybercriminals the ability to make use of malicious DLL files that can hijack the installation of legitimate downloaded software. Google is working on a fix.
(Demonstration of the issue...)
The automatic download feature of the browsers downloads all files automatically to the directory c:\<username>\Downloads. Cybercriminals can use Javascript to automatically download a malicious .DLL file which then ends up in this default directory. If the user then starts an application from that directory it's possible the malicious DLL file is loaded allowing it to do its potential nasty tricks on the computer.
As Li Haifei, the security researcher who discovered the issue explains, "This is because that in the real world, most executables rely on DLLs. The "application directory" is the very first place in the search order when searching/loading for a DLL. So, probably, most of DLLs even the system DLLs could be hijacked when you place a same-named DLL in the executable’s directory, and that's not for the situation that the searched DLL doesn't exist anywhere on the system."
To explain it a little more, this means that when the setup of an application that normally uses e.g Example.DLL file residing in C:\Windows\System is presented with Example.DLL in the c:\<username>\Downloads it will load the latter instead. This means that cybercriminals could use Javascript to automatically download a malicious Example.DLL to the C:\<username>\Downloads directory. When the user then starts the installation of legitimate software that makes use of Example.DLL it will load the malicious file in that directory instead.
Haifei warns users to keep an eye on their download directory and delete or temporarily rename any suspicious files.
The security researcher, who works for Intel Security (formerly McAfee) has warned both Google and Microsoft. The Chrome development team has recognized the issue and is working on a fix. Both the Android and Windows version of Chrome are affected. Haifei didn't receive a response from Microsoft yet.
Users on Edge are already a bit protected from the issue. Edge warns users when they download an uncommon DLL file and offers users the option to either run or delete it.
On Chrome there is also a setting that can be changed to protect yourself, by going to Settings -> Show advanced settings and checking "Ask where to save each file before downloading" it's possible to change the download location for each file.
