Save the Environment (Variable): Hijacking Legitimate Applications with a Minimal Footprint
Wietze Beukema
BSides NYC 2023 (0x04) · Day 1 · Talk - Red
In this insightful talk from BSides NYC, Wietze Beukema of CrowdStrike unveils a novel and stealthy technique for **DLL hijacking** that leverages **environment variables**. The presentation delves into how attackers can trick legitimate, trusted Windows executables into loading malicious DLLs from attacker-controlled locations, all while maintaining an incredibly minimal operational footprint. This method stands out because it bypasses many traditional detection mechanisms that focus on common DLL hijacking variants, offering a fresh perspective on an old attack vector.
AI review
Beukema takes a well-worn attack class and finds genuinely new surface by pivoting to process-level environment variable injection — a mechanism most DLL hijacking research walks right past. The scope of the finding (nearly 300 vulnerable combinations on a stock Win11 install, hitting Office, Chrome, Slack, Zoom) and the disciplined methodology (proxy DLLs, resource cloning, automated validation) make this worth the room's time. Doesn't reinvent the wheel, but drills meaningfully into a spoke nobody was looking at.